amadey | c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

General

Target

file.exe
Size

415KB
MD5

4e12f53b36ae58a9e181cd3bc660e750
SHA1

d8643ea88ebc7a3c249f67d960bcbdd8f0256f62
SHA256

c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f
SHA512

3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16
SSDEEP

6144:/mjIyZwfLm4RP6BLMZhJrAHo496ZC4qVatxX4WcoBlCwh/yaV:/mjBZWi4RCBQ8oFQ3VatxrcWCsq

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

77.73.133.72/hfk3vK9/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
5056	gntuud.exe
1732	gntuud.exe
4396	gntuud.exe
4024	gntuud.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	gntuud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4920	4656	WerFault.exe	79
4812	1732	WerFault.exe	86
4464	4396	WerFault.exe	91
4496	4024	WerFault.exe	100

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1388	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5056	4656	file.exe	80
PID 4656 wrote to memory of 5056	4656	file.exe	80
PID 4656 wrote to memory of 5056	4656	file.exe	80
PID 5056 wrote to memory of 1388	5056	gntuud.exe	84
PID 5056 wrote to memory of 1388	5056	gntuud.exe	84
PID 5056 wrote to memory of 1388	5056	gntuud.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
  "C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 904
  2⤵
  - Program crash
  PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4656 -ip 4656
1⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
1⤵
- Executes dropped EXE
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 416
  2⤵
  - Program crash
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1732 -ip 1732
1⤵
PID:4016

C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
1⤵
- Executes dropped EXE
PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 424
  2⤵
  - Program crash
  PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4396 -ip 4396
1⤵
PID:404

C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
1⤵
- Executes dropped EXE
PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 424
  2⤵
  - Program crash
  PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4024 -ip 4024
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe

Filesize
415KB

MD5
4e12f53b36ae58a9e181cd3bc660e750

SHA1
d8643ea88ebc7a3c249f67d960bcbdd8f0256f62

SHA256
c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

SHA512
3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe

Filesize
415KB

MD5
4e12f53b36ae58a9e181cd3bc660e750

SHA1
d8643ea88ebc7a3c249f67d960bcbdd8f0256f62

SHA256
c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

SHA512
3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe

Filesize
415KB

MD5
4e12f53b36ae58a9e181cd3bc660e750

SHA1
d8643ea88ebc7a3c249f67d960bcbdd8f0256f62

SHA256
c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

SHA512
3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe

Filesize
415KB

MD5
4e12f53b36ae58a9e181cd3bc660e750

SHA1
d8643ea88ebc7a3c249f67d960bcbdd8f0256f62

SHA256
c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

SHA512
3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe

Filesize
415KB

MD5
4e12f53b36ae58a9e181cd3bc660e750

SHA1
d8643ea88ebc7a3c249f67d960bcbdd8f0256f62

SHA256
c3f33b61a8c1d216fd5cedf8bd44dfae0496420885507f415b26a3b0019a920f

SHA512
3932823c120a27c0174b079816ae35ee0289a07895bf7be695b2d89b825378ccab71e7293ad5286ad60ae1ce9beff8f34d1d6586ebeb91a56ca4dc5249281d16

Download Submit
memory/1732-146-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1732-145-0x0000000000504000-0x0000000000522000-memory.dmp

Filesize
120KB

Download
memory/4024-152-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4024-151-0x0000000000544000-0x0000000000562000-memory.dmp

Filesize
120KB

Download
memory/4396-149-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4396-148-0x0000000000744000-0x0000000000762000-memory.dmp

Filesize
120KB

Download
memory/4656-141-0x0000000000773000-0x0000000000792000-memory.dmp

Filesize
124KB

Download
memory/4656-142-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4656-133-0x00000000006D0000-0x000000000070E000-memory.dmp

Filesize
248KB

Download
memory/4656-134-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4656-132-0x0000000000773000-0x0000000000792000-memory.dmp

Filesize
124KB

Download
memory/5056-140-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5056-144-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5056-139-0x0000000000563000-0x0000000000582000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads