amadey | 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

Analysis

max time kernel
145s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2023, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe
Size 244KB
Sample230320-nlj6hsdc33
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	nbveek.exe

Executes dropped EXE 3 IoCs

pid	Process
4172	nbveek.exe
4964	nbveek.exe
3320	nbveek.exe

Loads dropped DLL 3 IoCs

pid	Process
2684	rundll32.exe
984	rundll32.exe
1484	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	984	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2548	schtasks.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4172	1472	SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe	86
PID 1472 wrote to memory of 4172	1472	SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe	86
PID 1472 wrote to memory of 4172	1472	SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe	86
PID 4172 wrote to memory of 2548	4172	nbveek.exe	87
PID 4172 wrote to memory of 2548	4172	nbveek.exe	87
PID 4172 wrote to memory of 2548	4172	nbveek.exe	87
PID 4172 wrote to memory of 1500	4172	nbveek.exe	89
PID 4172 wrote to memory of 1500	4172	nbveek.exe	89
PID 4172 wrote to memory of 1500	4172	nbveek.exe	89
PID 1500 wrote to memory of 324	1500	cmd.exe	91
PID 1500 wrote to memory of 324	1500	cmd.exe	91
PID 1500 wrote to memory of 324	1500	cmd.exe	91
PID 1500 wrote to memory of 348	1500	cmd.exe	92
PID 1500 wrote to memory of 348	1500	cmd.exe	92
PID 1500 wrote to memory of 348	1500	cmd.exe	92
PID 1500 wrote to memory of 5100	1500	cmd.exe	93
PID 1500 wrote to memory of 5100	1500	cmd.exe	93
PID 1500 wrote to memory of 5100	1500	cmd.exe	93
PID 1500 wrote to memory of 828	1500	cmd.exe	94
PID 1500 wrote to memory of 828	1500	cmd.exe	94
PID 1500 wrote to memory of 828	1500	cmd.exe	94
PID 1500 wrote to memory of 4164	1500	cmd.exe	95
PID 1500 wrote to memory of 4164	1500	cmd.exe	95
PID 1500 wrote to memory of 4164	1500	cmd.exe	95
PID 1500 wrote to memory of 5080	1500	cmd.exe	96
PID 1500 wrote to memory of 5080	1500	cmd.exe	96
PID 1500 wrote to memory of 5080	1500	cmd.exe	96
PID 4172 wrote to memory of 2684	4172	nbveek.exe	105
PID 4172 wrote to memory of 2684	4172	nbveek.exe	105
PID 4172 wrote to memory of 2684	4172	nbveek.exe	105
PID 4172 wrote to memory of 1484	4172	nbveek.exe	106
PID 4172 wrote to memory of 1484	4172	nbveek.exe	106
PID 4172 wrote to memory of 1484	4172	nbveek.exe	106
PID 2684 wrote to memory of 984	2684	rundll32.exe	107
PID 2684 wrote to memory of 984	2684	rundll32.exe	107

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
  "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "nbveek.exe" /P "Admin:N"
      4⤵
      PID:348
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "nbveek.exe" /P "Admin:R" /E
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\16de06bfb4" /P "Admin:N"
      4⤵
      PID:4164
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\16de06bfb4" /P "Admin:R" /E
      4⤵
      PID:5080
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:984
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 984 -s 644
        5⤵
        Program crash
        
        PID:1996
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1484

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 984 -ip 984
1⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Size 244KB
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Size 244KB
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Size 244KB
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Size 244KB
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Size 244KB
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

675742406747

Path C:\Users\Admin\AppData\Local\Temp\675742406747
Size 83KB
SHA256 4f7cc805e5969f5c4e451068cc06087320636b490f6c1f78232dd3c9fa944710
MD5 54a1db1b941752146c556d953651d5af
SHA1 4be27f82dfe8203e83632a48e9549b7f723803fc
SHA512 31366995f738f20c9bd6ffb6826a7c919c6067a1eb7bddf8bd67aac89880790e81da3ab65fa035037c70ca7c41787110de6d603c0f1887209d8c6ce9723d3823
SSDEEP 1536:s9hV96E90wE/tNM8YEnwMp6I1M8k7imYCYAUY:Sr96zdezFMa8k9f
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Size 89KB
SHA256 b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
MD5 d3074d3a19629c3c6a533c86733e044e
SHA1 5b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA512 7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
SSDEEP 1536:ouON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUfaI89p:ouhVZbtvbpxLHoUsYuNhV25LJUfaI89p
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Size 89KB
SHA256 b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
MD5 d3074d3a19629c3c6a533c86733e044e
SHA1 5b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA512 7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
SSDEEP 1536:ouON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUfaI89p:ouhVZbtvbpxLHoUsYuNhV25LJUfaI89p
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Size 89KB
SHA256 b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
MD5 d3074d3a19629c3c6a533c86733e044e
SHA1 5b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA512 7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
SSDEEP 1536:ouON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUfaI89p:ouhVZbtvbpxLHoUsYuNhV25LJUfaI89p
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Size 1.0MB
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
SSDEEP 24576:MVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vW35m:KAhQnZzrZSxxZfVlUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Size 1.0MB
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
SSDEEP 24576:MVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vW35m:KAhQnZzrZSxxZfVlUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Size 1.0MB
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
SSDEEP 24576:MVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vW35m:KAhQnZzrZSxxZfVlUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Size 1.0MB
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
SSDEEP 24576:MVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vW35m:KAhQnZzrZSxxZfVlUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads