Analysis

  • max time kernel
    138s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2023 01:11

General

  • Target

    db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe

  • Size

    205KB

  • MD5

    79fa4eabaa10e7eade4ca7774f913964

  • SHA1

    e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

  • SHA256

    db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

  • SHA512

    09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

  • SSDEEP

    3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe
    "C:\Users\Admin\AppData\Local\Temp\db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
      "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2532
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1640
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "rugen.exe" /P "Admin:N"
            4⤵
              PID:2416
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "rugen.exe" /P "Admin:R" /E
              4⤵
                PID:1464
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:3932
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\200f691d32" /P "Admin:N"
                  4⤵
                    PID:4480
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\200f691d32" /P "Admin:R" /E
                    4⤵
                      PID:3068
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:3484
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:3256
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:4180
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:3732

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                79fa4eabaa10e7eade4ca7774f913964

                SHA1

                e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

                SHA256

                db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

                SHA512

                09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                79fa4eabaa10e7eade4ca7774f913964

                SHA1

                e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

                SHA256

                db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

                SHA512

                09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                79fa4eabaa10e7eade4ca7774f913964

                SHA1

                e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

                SHA256

                db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

                SHA512

                09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                79fa4eabaa10e7eade4ca7774f913964

                SHA1

                e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

                SHA256

                db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

                SHA512

                09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                79fa4eabaa10e7eade4ca7774f913964

                SHA1

                e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

                SHA256

                db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

                SHA512

                09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                79fa4eabaa10e7eade4ca7774f913964

                SHA1

                e5c9905b4fbf4da227a7ba91a59364e93c81ea7c

                SHA256

                db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45

                SHA512

                09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5