amadey | bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3

Analysis

max time kernel
104s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2023 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe
Size

235KB
MD5

bc45f9797f848df442a883f994adad4a
SHA1

192cc4bc45c4f47147631d04a7fafe418acf7131
SHA256

bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3
SHA512

c4d4e2f53eaf779e889e86cc059c3b7a8518bb8c86e58dd0bd25d4b4683bca59ce36afd6e5b1cbf62e93437d08beda2c74aae74abf1af623678b636c83461031
SSDEEP

6144:AbxUDsiH4X/Et6xXQ31UrhfSK6uVyWVYN+tGgUO:AbQOXUghSuVyWVG+7

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.65

45.66.230.123/g8kdkeXs2qL/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 3 IoCs

pid	Process
876	nbveek.exe
3188	nbveek.exe
4028	nbveek.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	nbveek.exe

Loads dropped DLL 2 IoCs

pid	Process
2804	rundll32.exe
1804	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4236	1804	WerFault.exe	97

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
624	schtasks.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 876	4272	bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe	79
PID 4272 wrote to memory of 876	4272	bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe	79
PID 4272 wrote to memory of 876	4272	bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe	79
PID 876 wrote to memory of 624	876	nbveek.exe	80
PID 876 wrote to memory of 624	876	nbveek.exe	80
PID 876 wrote to memory of 624	876	nbveek.exe	80
PID 876 wrote to memory of 1656	876	nbveek.exe	82
PID 876 wrote to memory of 1656	876	nbveek.exe	82
PID 876 wrote to memory of 1656	876	nbveek.exe	82
PID 1656 wrote to memory of 2640	1656	cmd.exe	84
PID 1656 wrote to memory of 2640	1656	cmd.exe	84
PID 1656 wrote to memory of 2640	1656	cmd.exe	84
PID 1656 wrote to memory of 1524	1656	cmd.exe	85
PID 1656 wrote to memory of 1524	1656	cmd.exe	85
PID 1656 wrote to memory of 1524	1656	cmd.exe	85
PID 1656 wrote to memory of 1416	1656	cmd.exe	86
PID 1656 wrote to memory of 1416	1656	cmd.exe	86
PID 1656 wrote to memory of 1416	1656	cmd.exe	86
PID 1656 wrote to memory of 2284	1656	cmd.exe	87
PID 1656 wrote to memory of 2284	1656	cmd.exe	87
PID 1656 wrote to memory of 2284	1656	cmd.exe	87
PID 1656 wrote to memory of 2232	1656	cmd.exe	88
PID 1656 wrote to memory of 2232	1656	cmd.exe	88
PID 1656 wrote to memory of 2232	1656	cmd.exe	88
PID 1656 wrote to memory of 3740	1656	cmd.exe	89
PID 1656 wrote to memory of 3740	1656	cmd.exe	89
PID 1656 wrote to memory of 3740	1656	cmd.exe	89
PID 876 wrote to memory of 2804	876	nbveek.exe	96
PID 876 wrote to memory of 2804	876	nbveek.exe	96
PID 876 wrote to memory of 2804	876	nbveek.exe	96
PID 2804 wrote to memory of 1804	2804	rundll32.exe	97
PID 2804 wrote to memory of 1804	2804	rundll32.exe	97

C:\Users\Admin\AppData\Local\Temp\bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe
"C:\Users\Admin\AppData\Local\Temp\bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe
  "C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5ca56b659f" /P "Admin:N"&&CACLS "..\5ca56b659f" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "nbveek.exe" /P "Admin:N"
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "nbveek.exe" /P "Admin:R" /E
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\5ca56b659f" /P "Admin:N"
      4⤵
      PID:2232
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\5ca56b659f" /P "Admin:R" /E
      4⤵
      PID:3740
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1804
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1804 -s 688
        5⤵
        Program crash
        
        PID:4236

C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1804 -ip 1804
1⤵
PID:2720

C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe
1⤵
- Executes dropped EXE
PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe

Filesize
235KB

MD5
bc45f9797f848df442a883f994adad4a

SHA1
192cc4bc45c4f47147631d04a7fafe418acf7131

SHA256
bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3

SHA512
c4d4e2f53eaf779e889e86cc059c3b7a8518bb8c86e58dd0bd25d4b4683bca59ce36afd6e5b1cbf62e93437d08beda2c74aae74abf1af623678b636c83461031

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe

Filesize
235KB

MD5
bc45f9797f848df442a883f994adad4a

SHA1
192cc4bc45c4f47147631d04a7fafe418acf7131

SHA256
bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3

SHA512
c4d4e2f53eaf779e889e86cc059c3b7a8518bb8c86e58dd0bd25d4b4683bca59ce36afd6e5b1cbf62e93437d08beda2c74aae74abf1af623678b636c83461031

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe

Filesize
235KB

MD5
bc45f9797f848df442a883f994adad4a

SHA1
192cc4bc45c4f47147631d04a7fafe418acf7131

SHA256
bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3

SHA512
c4d4e2f53eaf779e889e86cc059c3b7a8518bb8c86e58dd0bd25d4b4683bca59ce36afd6e5b1cbf62e93437d08beda2c74aae74abf1af623678b636c83461031

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ca56b659f\nbveek.exe

Filesize
235KB

MD5
bc45f9797f848df442a883f994adad4a

SHA1
192cc4bc45c4f47147631d04a7fafe418acf7131

SHA256
bef6710dbe58cb2a400e94e471509b8bb3605ef74ba6c177f9744254ab2278e3

SHA512
c4d4e2f53eaf779e889e86cc059c3b7a8518bb8c86e58dd0bd25d4b4683bca59ce36afd6e5b1cbf62e93437d08beda2c74aae74abf1af623678b636c83461031

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.0MB

MD5
0017009aa184ebbd2d53a323114b0a34

SHA1
2049b480d74b0a9fe5f813e4ddb13328f930878d

SHA256
aafc78dfac130ded368b8a0eb3648d371c2f2332804732e43c8431ddf01033ce

SHA512
90434d597fd6d0cc65840a2607d4586d1cd855b42041ac80727b819cb3ada58ee29c2fc9e79ce2a566fd940d4b21acc9dcdc8bdc8b1a86f9bd3eaec80681e244

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.0MB

MD5
0017009aa184ebbd2d53a323114b0a34

SHA1
2049b480d74b0a9fe5f813e4ddb13328f930878d

SHA256
aafc78dfac130ded368b8a0eb3648d371c2f2332804732e43c8431ddf01033ce

SHA512
90434d597fd6d0cc65840a2607d4586d1cd855b42041ac80727b819cb3ada58ee29c2fc9e79ce2a566fd940d4b21acc9dcdc8bdc8b1a86f9bd3eaec80681e244

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.0MB

MD5
0017009aa184ebbd2d53a323114b0a34

SHA1
2049b480d74b0a9fe5f813e4ddb13328f930878d

SHA256
aafc78dfac130ded368b8a0eb3648d371c2f2332804732e43c8431ddf01033ce

SHA512
90434d597fd6d0cc65840a2607d4586d1cd855b42041ac80727b819cb3ada58ee29c2fc9e79ce2a566fd940d4b21acc9dcdc8bdc8b1a86f9bd3eaec80681e244

Download Submit
memory/624-135-0x0000000000000000-mapping.dmp

Download
memory/876-132-0x0000000000000000-mapping.dmp

Download
memory/1416-139-0x0000000000000000-mapping.dmp

Download
memory/1524-138-0x0000000000000000-mapping.dmp

Download
memory/1656-136-0x0000000000000000-mapping.dmp

Download
memory/1804-147-0x0000000000000000-mapping.dmp

Download
memory/2232-141-0x0000000000000000-mapping.dmp

Download
memory/2284-140-0x0000000000000000-mapping.dmp

Download
memory/2640-137-0x0000000000000000-mapping.dmp

Download
memory/2804-144-0x0000000000000000-mapping.dmp

Download
memory/3740-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads