amadey | 8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

Analysis

max time kernel
144s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x000900000001232c-1071.exe
Size

236KB
MD5

36956dd648b0b29efa66e11e206416c7
SHA1

a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27
SHA256

8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285
SHA512

07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be
SSDEEP

6144:f36hrz456we4lz7zzZ5my2IuViMqJnyJQ:Pxpz7LmeuVi3nN

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0x000900000001232c-1071.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	0x000900000001232c-1071.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 4 IoCs

Processes:

legenda.exelegenda.exelegenda.exelegenda.exe

pid process

5092 legenda.exe
632 legenda.exe
2952 legenda.exe
4288 legenda.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4768 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

456 schtasks.exe

pid	process
5092	legenda.exe
632	legenda.exe
2952	legenda.exe
4288	legenda.exe

pid	process
4768	rundll32.exe

pid	process
456	schtasks.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

0x000900000001232c-1071.exelegenda.execmd.exe

description	pid	process	target process
PID 3152 wrote to memory of 5092	3152	0x000900000001232c-1071.exe	legenda.exe
PID 3152 wrote to memory of 5092	3152	0x000900000001232c-1071.exe	legenda.exe
PID 3152 wrote to memory of 5092	3152	0x000900000001232c-1071.exe	legenda.exe
PID 5092 wrote to memory of 456	5092	legenda.exe	schtasks.exe
PID 5092 wrote to memory of 456	5092	legenda.exe	schtasks.exe
PID 5092 wrote to memory of 456	5092	legenda.exe	schtasks.exe
PID 5092 wrote to memory of 4816	5092	legenda.exe	cmd.exe
PID 5092 wrote to memory of 4816	5092	legenda.exe	cmd.exe
PID 5092 wrote to memory of 4816	5092	legenda.exe	cmd.exe
PID 4816 wrote to memory of 408	4816	cmd.exe	cmd.exe
PID 4816 wrote to memory of 408	4816	cmd.exe	cmd.exe
PID 4816 wrote to memory of 408	4816	cmd.exe	cmd.exe
PID 4816 wrote to memory of 4136	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 4136	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 4136	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 2784	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 2784	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 2784	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 1892	4816	cmd.exe	cmd.exe
PID 4816 wrote to memory of 1892	4816	cmd.exe	cmd.exe
PID 4816 wrote to memory of 1892	4816	cmd.exe	cmd.exe
PID 4816 wrote to memory of 2244	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 2244	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 2244	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 3884	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 3884	4816	cmd.exe	cacls.exe
PID 4816 wrote to memory of 3884	4816	cmd.exe	cacls.exe
PID 5092 wrote to memory of 4768	5092	legenda.exe	rundll32.exe
PID 5092 wrote to memory of 4768	5092	legenda.exe	rundll32.exe
PID 5092 wrote to memory of 4768	5092	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\0x000900000001232c-1071.exe
"C:\Users\Admin\AppData\Local\Temp\0x000900000001232c-1071.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
3⤵
- Creates scheduled task(s)
PID:456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:408

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
4⤵
PID:4136

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
4⤵
PID:2784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:1892

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
4⤵
PID:2244

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
4⤵
PID:3884

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:4768

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:632

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2952

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
236KB

MD5
36956dd648b0b29efa66e11e206416c7

SHA1
a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27

SHA256
8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

SHA512
07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
236KB

MD5
36956dd648b0b29efa66e11e206416c7

SHA1
a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27

SHA256
8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

SHA512
07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
236KB

MD5
36956dd648b0b29efa66e11e206416c7

SHA1
a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27

SHA256
8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

SHA512
07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
236KB

MD5
36956dd648b0b29efa66e11e206416c7

SHA1
a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27

SHA256
8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

SHA512
07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
236KB

MD5
36956dd648b0b29efa66e11e206416c7

SHA1
a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27

SHA256
8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

SHA512
07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
236KB

MD5
36956dd648b0b29efa66e11e206416c7

SHA1
a423745a0b136153cfdf2c9b9d24eb2ef4fbaa27

SHA256
8ff3525503afba265a953722f7e4ad44f366bdc3590da36a4351f5d92fed9285

SHA512
07fb3d256abb679cf3ab6a57f0c1fcefe1d1782d538df1a5328f4938ce3c14735756bad65c5ca678f94d7920522426a8c47228a20a4705e7dff8be4313e494be

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit