Analysis

  • max time kernel
    140s
  • max time network
    98s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/04/2023, 18:25

General

  • Target

    8512f8af53c6a0c143c4949957d83630ded757de067cf79ac5812a3e1a8e2509.exe

  • Size

    942KB

  • MD5

    3370fb1de1aa436397357c4794e83816

  • SHA1

    a8c271ac38b1fd7a5b0e6d1107fec301ad27ee61

  • SHA256

    8512f8af53c6a0c143c4949957d83630ded757de067cf79ac5812a3e1a8e2509

  • SHA512

    d892612e212fdb9d31728ba816279e966d8363d5c5102e41d406bf3c9f95b1d21a2d45ef38c15e5e495856ace2db64fbcf932a50013b05b6783ab87170cd9afc

  • SSDEEP

    24576:wy/r+XNNk45u4tOFhtBvnz2QTNJboogZdiAoy:3j+ff5X8R9zNTDovdT

Malware Config

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8512f8af53c6a0c143c4949957d83630ded757de067cf79ac5812a3e1a8e2509.exe
    "C:\Users\Admin\AppData\Local\Temp\8512f8af53c6a0c143c4949957d83630ded757de067cf79ac5812a3e1a8e2509.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQs1762.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQs1762.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zidl6687.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zidl6687.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it501764.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it501764.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr853861.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr853861.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5112
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp637334.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp637334.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr415924.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr415924.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:3940
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 620
        3⤵
        • Program crash
        PID:3412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 700
        3⤵
        • Program crash
        PID:3908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 840
        3⤵
        • Program crash
        PID:1660
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 828
        3⤵
        • Program crash
        PID:4020
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 876
        3⤵
        • Program crash
        PID:4632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 852
        3⤵
        • Program crash
        PID:4656
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1120
        3⤵
        • Program crash
        PID:4744
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1152
        3⤵
        • Program crash
        PID:4856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1140
        3⤵
        • Program crash
        PID:4872

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr415924.exe

    Filesize

    396KB

    MD5

    da8fa27c0d1e7ee3855aef315957461e

    SHA1

    3b847d83099e3c3ff4628549deb0ff98712fafc9

    SHA256

    fe1fa4271fa2e955d24e7efe6115a7a99080112fc9b404810b24696b001e672a

    SHA512

    d39c93d770aaf9492bd4f0c2857c9bb760bef1d86419206916c37bdd812c7d173fe2808710b6e9f9e5caf73bb0d53e8804f54ce1706d0e3eebf311cdaae88bc8

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr415924.exe

    Filesize

    396KB

    MD5

    da8fa27c0d1e7ee3855aef315957461e

    SHA1

    3b847d83099e3c3ff4628549deb0ff98712fafc9

    SHA256

    fe1fa4271fa2e955d24e7efe6115a7a99080112fc9b404810b24696b001e672a

    SHA512

    d39c93d770aaf9492bd4f0c2857c9bb760bef1d86419206916c37bdd812c7d173fe2808710b6e9f9e5caf73bb0d53e8804f54ce1706d0e3eebf311cdaae88bc8

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQs1762.exe

    Filesize

    619KB

    MD5

    bcce2cd8de4a3bd78a5f4bc7d2d4b7ba

    SHA1

    26acd2e505e19bd4aeb4d28ef5fabdb43e5c67b1

    SHA256

    cb13f0269d1851760d7ebf66361103535959ee38d6f22501194f45c27cffaaab

    SHA512

    7d766777eff1359658cf1feb53713beec9a32d097ae55e808e2e10775fbc151cc01de4bd69cb1951e5eb57dce35fd0eca8b808432a4512ab46d53e102351b2e4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQs1762.exe

    Filesize

    619KB

    MD5

    bcce2cd8de4a3bd78a5f4bc7d2d4b7ba

    SHA1

    26acd2e505e19bd4aeb4d28ef5fabdb43e5c67b1

    SHA256

    cb13f0269d1851760d7ebf66361103535959ee38d6f22501194f45c27cffaaab

    SHA512

    7d766777eff1359658cf1feb53713beec9a32d097ae55e808e2e10775fbc151cc01de4bd69cb1951e5eb57dce35fd0eca8b808432a4512ab46d53e102351b2e4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp637334.exe

    Filesize

    136KB

    MD5

    e7ae347f87257ec8c1177220be5cbfc1

    SHA1

    d721e86ae2c268a7e42662987bfcd9ffe11ca0f2

    SHA256

    733ccbf30055b9a527cc190ef42c803e4cb757572e24bae502298b09361bfd76

    SHA512

    8b61ab2ba8646293e8f279ceed7044136f5a51c93b6af715ead76a6d82b8b39d05440771adae7d407d9458de1df45d7c430b8b8251c1ca69461ea9b555480f78

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp637334.exe

    Filesize

    136KB

    MD5

    e7ae347f87257ec8c1177220be5cbfc1

    SHA1

    d721e86ae2c268a7e42662987bfcd9ffe11ca0f2

    SHA256

    733ccbf30055b9a527cc190ef42c803e4cb757572e24bae502298b09361bfd76

    SHA512

    8b61ab2ba8646293e8f279ceed7044136f5a51c93b6af715ead76a6d82b8b39d05440771adae7d407d9458de1df45d7c430b8b8251c1ca69461ea9b555480f78

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zidl6687.exe

    Filesize

    465KB

    MD5

    245da5d8d3ace104d1de280a2404031f

    SHA1

    0474d7e2a79cfdef56ec0ef41b055f11d7197fc7

    SHA256

    89e95e41ac806bc7446adfda0fe61aa3dc6c38a2310738c480a642aa92a50c12

    SHA512

    971fe92ded9f7c3cb6f65fe74d53228d24c717bb171351ff78ce250f9f701781a3f20ce91ba51340f1363dfcde5f17dfd96093e626168a97c9b0316cc3f3ac0c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zidl6687.exe

    Filesize

    465KB

    MD5

    245da5d8d3ace104d1de280a2404031f

    SHA1

    0474d7e2a79cfdef56ec0ef41b055f11d7197fc7

    SHA256

    89e95e41ac806bc7446adfda0fe61aa3dc6c38a2310738c480a642aa92a50c12

    SHA512

    971fe92ded9f7c3cb6f65fe74d53228d24c717bb171351ff78ce250f9f701781a3f20ce91ba51340f1363dfcde5f17dfd96093e626168a97c9b0316cc3f3ac0c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it501764.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it501764.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr853861.exe

    Filesize

    486KB

    MD5

    01c3dfb19555a68497bbad29b6c7eec1

    SHA1

    544dff572de55b9c90f320f94edf59fb358e410d

    SHA256

    d6afc5e467bbd5b993b2f2f531b026d43eb0922421622a0d8d6832c2247de79e

    SHA512

    5ac101cc5e4a7ed436a7495ccd864d9a111235b65d6134d1e1a1513779f822c68361d509f2433e5293223b515446408840bf0a509ea5e758d2e6137a57ddaf6c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr853861.exe

    Filesize

    486KB

    MD5

    01c3dfb19555a68497bbad29b6c7eec1

    SHA1

    544dff572de55b9c90f320f94edf59fb358e410d

    SHA256

    d6afc5e467bbd5b993b2f2f531b026d43eb0922421622a0d8d6832c2247de79e

    SHA512

    5ac101cc5e4a7ed436a7495ccd864d9a111235b65d6134d1e1a1513779f822c68361d509f2433e5293223b515446408840bf0a509ea5e758d2e6137a57ddaf6c

  • memory/3752-968-0x0000000007910000-0x000000000795B000-memory.dmp

    Filesize

    300KB

  • memory/3752-967-0x0000000000B90000-0x0000000000BB8000-memory.dmp

    Filesize

    160KB

  • memory/3752-969-0x0000000007960000-0x0000000007970000-memory.dmp

    Filesize

    64KB

  • memory/3940-977-0x0000000000810000-0x000000000084B000-memory.dmp

    Filesize

    236KB

  • memory/3940-975-0x0000000000810000-0x000000000084B000-memory.dmp

    Filesize

    236KB

  • memory/4300-142-0x0000000000950000-0x000000000095A000-memory.dmp

    Filesize

    40KB

  • memory/5112-186-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-204-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-157-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-160-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/5112-162-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/5112-161-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-158-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/5112-164-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-166-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-168-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-170-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-172-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-174-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-176-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-178-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-180-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-182-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-184-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-152-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-188-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-190-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-192-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-194-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-196-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-198-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-200-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-202-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-156-0x0000000000970000-0x00000000009B6000-memory.dmp

    Filesize

    280KB

  • memory/5112-206-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-208-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-210-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-212-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-214-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-216-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-218-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-947-0x0000000007DE0000-0x00000000083E6000-memory.dmp

    Filesize

    6.0MB

  • memory/5112-948-0x0000000007850000-0x0000000007862000-memory.dmp

    Filesize

    72KB

  • memory/5112-949-0x0000000007880000-0x000000000798A000-memory.dmp

    Filesize

    1.0MB

  • memory/5112-950-0x00000000079A0000-0x00000000079DE000-memory.dmp

    Filesize

    248KB

  • memory/5112-951-0x0000000007A20000-0x0000000007A6B000-memory.dmp

    Filesize

    300KB

  • memory/5112-952-0x0000000007CB0000-0x0000000007D16000-memory.dmp

    Filesize

    408KB

  • memory/5112-953-0x0000000008970000-0x0000000008A02000-memory.dmp

    Filesize

    584KB

  • memory/5112-954-0x0000000008A20000-0x0000000008A96000-memory.dmp

    Filesize

    472KB

  • memory/5112-955-0x0000000008AF0000-0x0000000008B0E000-memory.dmp

    Filesize

    120KB

  • memory/5112-956-0x0000000004800000-0x0000000004850000-memory.dmp

    Filesize

    320KB

  • memory/5112-154-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-151-0x0000000004D80000-0x0000000004DB5000-memory.dmp

    Filesize

    212KB

  • memory/5112-150-0x0000000004D80000-0x0000000004DBA000-memory.dmp

    Filesize

    232KB

  • memory/5112-149-0x0000000004E10000-0x000000000530E000-memory.dmp

    Filesize

    5.0MB

  • memory/5112-148-0x0000000004CE0000-0x0000000004D1C000-memory.dmp

    Filesize

    240KB

  • memory/5112-957-0x0000000008CB0000-0x0000000008E72000-memory.dmp

    Filesize

    1.8MB

  • memory/5112-958-0x0000000008E80000-0x00000000093AC000-memory.dmp

    Filesize

    5.2MB

  • memory/5112-960-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/5112-961-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB