Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2023 08:15

General

  • Target

    file.exe

  • Size

    235KB

  • MD5

    f9167334aa7188f57755ebe55a4e98a2

  • SHA1

    d340ed530dd32829f614bd0d0850cc51f8e4ac4b

  • SHA256

    7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f

  • SHA512

    ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256

  • SSDEEP

    6144:RSRg+A7AZGFDubDXagraG0JzSRuVyLWNgrQqgE:RPsEjgwJ4uVyCNKJ

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.92/so57Nst/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2120
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1960
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "nbveek.exe" /P "Admin:N"
            4⤵
              PID:4916
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "nbveek.exe" /P "Admin:R" /E
              4⤵
                PID:4856
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:5116
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\4b9a106e76" /P "Admin:N"
                  4⤵
                    PID:4832
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\4b9a106e76" /P "Admin:R" /E
                    4⤵
                      PID:1964
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:516
              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                1⤵
                • Executes dropped EXE
                PID:960
              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                1⤵
                • Executes dropped EXE
                PID:2512

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Scheduled Task

              1
              T1053

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              2
              T1082

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                Filesize

                235KB

                MD5

                f9167334aa7188f57755ebe55a4e98a2

                SHA1

                d340ed530dd32829f614bd0d0850cc51f8e4ac4b

                SHA256

                7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f

                SHA512

                ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                Filesize

                235KB

                MD5

                f9167334aa7188f57755ebe55a4e98a2

                SHA1

                d340ed530dd32829f614bd0d0850cc51f8e4ac4b

                SHA256

                7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f

                SHA512

                ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                Filesize

                235KB

                MD5

                f9167334aa7188f57755ebe55a4e98a2

                SHA1

                d340ed530dd32829f614bd0d0850cc51f8e4ac4b

                SHA256

                7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f

                SHA512

                ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                Filesize

                235KB

                MD5

                f9167334aa7188f57755ebe55a4e98a2

                SHA1

                d340ed530dd32829f614bd0d0850cc51f8e4ac4b

                SHA256

                7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f

                SHA512

                ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                Filesize

                89KB

                MD5

                ceed9963147776251f456f01ad11a741

                SHA1

                c52aa99aa7d0d6c27aeb740017f84b56e5ae9350

                SHA256

                1df2a7888b8fc78d43b3a58788d1dddf388c07d7bd0f80606528d5beb74ddcc2

                SHA512

                52f646e75945e02c35d5d2e74d389ffa03341bae137959ccd53a6caedf7eb0a502c5d2b5d1cfbf26879936f9c2bc80f207bdc42027eceaee143b77d6f51e893c

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                Filesize

                89KB

                MD5

                ceed9963147776251f456f01ad11a741

                SHA1

                c52aa99aa7d0d6c27aeb740017f84b56e5ae9350

                SHA256

                1df2a7888b8fc78d43b3a58788d1dddf388c07d7bd0f80606528d5beb74ddcc2

                SHA512

                52f646e75945e02c35d5d2e74d389ffa03341bae137959ccd53a6caedf7eb0a502c5d2b5d1cfbf26879936f9c2bc80f207bdc42027eceaee143b77d6f51e893c

              • memory/516-144-0x0000000000000000-mapping.dmp
              • memory/1960-137-0x0000000000000000-mapping.dmp
              • memory/1964-142-0x0000000000000000-mapping.dmp
              • memory/2120-135-0x0000000000000000-mapping.dmp
              • memory/4056-132-0x0000000000000000-mapping.dmp
              • memory/4832-141-0x0000000000000000-mapping.dmp
              • memory/4856-139-0x0000000000000000-mapping.dmp
              • memory/4912-136-0x0000000000000000-mapping.dmp
              • memory/4916-138-0x0000000000000000-mapping.dmp
              • memory/5116-140-0x0000000000000000-mapping.dmp