amadey | cd6329a56d8b4b480b73d44df1a481b7c528dcd8b397625defe12c4f58eab07b

Analysis

max time kernel
368s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2022, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 326KB
Sample221209-d37ysscc36
SHA256 cd6329a56d8b4b480b73d44df1a481b7c528dcd8b397625defe12c4f58eab07b
MD5 f9280b4ac9ee6950cb2211c7f856fdaa
SHA1 9a0db84fec65af4470d22bdf4898df1fe727d950
SHA512 774b67e7ae83cd5fc88c1a2db36185fbdb2c82b27a3e31386fc26a9600d0e77d7d0fc03ef4dae03c1d8bbc48de0560b3e373df7d4f6e0841376b142497755f5e
SSDEEP 6144:0mzOPExE/LlzfVqQG3qom0PMVD+dSTpxeSk1BVjfr0w:0mzOPEqTlzK3qofoD+qxedR0w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.50

77.73.133.72/hfk3vK9/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1520	gntuud.exe
4776	gntuud.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	gntuud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3752	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1520	3260	file.exe	80
PID 3260 wrote to memory of 1520	3260	file.exe	80
PID 3260 wrote to memory of 1520	3260	file.exe	80
PID 1520 wrote to memory of 3752	1520	gntuud.exe	83
PID 1520 wrote to memory of 3752	1520	gntuud.exe	83
PID 1520 wrote to memory of 3752	1520	gntuud.exe	83
PID 1520 wrote to memory of 2632	1520	gntuud.exe	88
PID 1520 wrote to memory of 2632	1520	gntuud.exe	88
PID 1520 wrote to memory of 2632	1520	gntuud.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
  "C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3752
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll, Main
    3⤵
    PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3260 -ip 3260
1⤵
PID:3328

C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4776 -ip 4776
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
Size 326KB
SHA256 cd6329a56d8b4b480b73d44df1a481b7c528dcd8b397625defe12c4f58eab07b
MD5 f9280b4ac9ee6950cb2211c7f856fdaa
SHA1 9a0db84fec65af4470d22bdf4898df1fe727d950
SHA512 774b67e7ae83cd5fc88c1a2db36185fbdb2c82b27a3e31386fc26a9600d0e77d7d0fc03ef4dae03c1d8bbc48de0560b3e373df7d4f6e0841376b142497755f5e
SSDEEP 6144:0mzOPExE/LlzfVqQG3qom0PMVD+dSTpxeSk1BVjfr0w:0mzOPEqTlzK3qofoD+qxedR0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
Size 326KB
SHA256 cd6329a56d8b4b480b73d44df1a481b7c528dcd8b397625defe12c4f58eab07b
MD5 f9280b4ac9ee6950cb2211c7f856fdaa
SHA1 9a0db84fec65af4470d22bdf4898df1fe727d950
SHA512 774b67e7ae83cd5fc88c1a2db36185fbdb2c82b27a3e31386fc26a9600d0e77d7d0fc03ef4dae03c1d8bbc48de0560b3e373df7d4f6e0841376b142497755f5e
SSDEEP 6144:0mzOPExE/LlzfVqQG3qom0PMVD+dSTpxeSk1BVjfr0w:0mzOPEqTlzK3qofoD+qxedR0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe
Size 326KB
SHA256 cd6329a56d8b4b480b73d44df1a481b7c528dcd8b397625defe12c4f58eab07b
MD5 f9280b4ac9ee6950cb2211c7f856fdaa
SHA1 9a0db84fec65af4470d22bdf4898df1fe727d950
SHA512 774b67e7ae83cd5fc88c1a2db36185fbdb2c82b27a3e31386fc26a9600d0e77d7d0fc03ef4dae03c1d8bbc48de0560b3e373df7d4f6e0841376b142497755f5e
SSDEEP 6144:0mzOPExE/LlzfVqQG3qom0PMVD+dSTpxeSk1BVjfr0w:0mzOPEqTlzK3qofoD+qxedR0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1520-140-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1520-138-0x00000000005D8000-0x00000000005F7000-memory.dmp

Download

memory/1520-139-0x0000000001F60000-0x0000000001F9E000-memory.dmp

Download

memory/1520-144-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3260-142-0x0000000000659000-0x0000000000678000-memory.dmp

Download

memory/3260-143-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3260-132-0x0000000000659000-0x0000000000678000-memory.dmp

Download

memory/3260-133-0x00000000005C0000-0x00000000005FE000-memory.dmp

Download

memory/3260-134-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4776-146-0x000000000079C000-0x00000000007BB000-memory.dmp

Download

memory/4776-147-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads