amadey | a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/07/2023, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4890ddadb9a81c4438a8e501d11e48a.exe
Size 224KB
Sample230725-mes96scf7x
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.86

77.91.68.61/rock/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 3 IoCs

pid	Process
2668	pdates.exe
676	pdates.exe
240	pdates.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	d4890ddadb9a81c4438a8e501d11e48a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2284	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	d4890ddadb9a81c4438a8e501d11e48a.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2668	2520	d4890ddadb9a81c4438a8e501d11e48a.exe	28
PID 2520 wrote to memory of 2668	2520	d4890ddadb9a81c4438a8e501d11e48a.exe	28
PID 2520 wrote to memory of 2668	2520	d4890ddadb9a81c4438a8e501d11e48a.exe	28
PID 2520 wrote to memory of 2668	2520	d4890ddadb9a81c4438a8e501d11e48a.exe	28
PID 2668 wrote to memory of 2284	2668	pdates.exe	29
PID 2668 wrote to memory of 2284	2668	pdates.exe	29
PID 2668 wrote to memory of 2284	2668	pdates.exe	29
PID 2668 wrote to memory of 2284	2668	pdates.exe	29
PID 2668 wrote to memory of 2848	2668	pdates.exe	31
PID 2668 wrote to memory of 2848	2668	pdates.exe	31
PID 2668 wrote to memory of 2848	2668	pdates.exe	31
PID 2668 wrote to memory of 2848	2668	pdates.exe	31
PID 2848 wrote to memory of 3020	2848	cmd.exe	33
PID 2848 wrote to memory of 3020	2848	cmd.exe	33
PID 2848 wrote to memory of 3020	2848	cmd.exe	33
PID 2848 wrote to memory of 3020	2848	cmd.exe	33
PID 2848 wrote to memory of 1632	2848	cmd.exe	34
PID 2848 wrote to memory of 1632	2848	cmd.exe	34
PID 2848 wrote to memory of 1632	2848	cmd.exe	34
PID 2848 wrote to memory of 1632	2848	cmd.exe	34
PID 2848 wrote to memory of 2856	2848	cmd.exe	35
PID 2848 wrote to memory of 2856	2848	cmd.exe	35
PID 2848 wrote to memory of 2856	2848	cmd.exe	35
PID 2848 wrote to memory of 2856	2848	cmd.exe	35
PID 2848 wrote to memory of 2828	2848	cmd.exe	36
PID 2848 wrote to memory of 2828	2848	cmd.exe	36
PID 2848 wrote to memory of 2828	2848	cmd.exe	36
PID 2848 wrote to memory of 2828	2848	cmd.exe	36
PID 2848 wrote to memory of 2808	2848	cmd.exe	37
PID 2848 wrote to memory of 2808	2848	cmd.exe	37
PID 2848 wrote to memory of 2808	2848	cmd.exe	37
PID 2848 wrote to memory of 2808	2848	cmd.exe	37
PID 2848 wrote to memory of 2960	2848	cmd.exe	38
PID 2848 wrote to memory of 2960	2848	cmd.exe	38
PID 2848 wrote to memory of 2960	2848	cmd.exe	38
PID 2848 wrote to memory of 2960	2848	cmd.exe	38
PID 2400 wrote to memory of 676	2400	taskeng.exe	43
PID 2400 wrote to memory of 676	2400	taskeng.exe	43
PID 2400 wrote to memory of 676	2400	taskeng.exe	43
PID 2400 wrote to memory of 676	2400	taskeng.exe	43
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2668 wrote to memory of 2692	2668	pdates.exe	44
PID 2400 wrote to memory of 240	2400	taskeng.exe	45
PID 2400 wrote to memory of 240	2400	taskeng.exe	45
PID 2400 wrote to memory of 240	2400	taskeng.exe	45
PID 2400 wrote to memory of 240	2400	taskeng.exe	45

C:\Users\Admin\AppData\Local\Temp\d4890ddadb9a81c4438a8e501d11e48a.exe
"C:\Users\Admin\AppData\Local\Temp\d4890ddadb9a81c4438a8e501d11e48a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "pdates.exe" /P "Admin:N"
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "pdates.exe" /P "Admin:R" /E
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2828
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\925e7e99c5" /P "Admin:N"
      4⤵
      PID:2808
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\925e7e99c5" /P "Admin:R" /E
      4⤵
      PID:2960
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    PID:2692

C:\Windows\system32\taskeng.exe
taskeng.exe {240DDC03-BAC2-4B2B-93BF-15469E675463} S-1-5-21-4219371764-2579186923-3390623117-1000:NVACMPYA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  2⤵
  - Executes dropped EXE
  PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 48KB
SHA256 70b0761396bc2dcaddf02329238419ce4022db9cc4a447cc1dc54180124623cf
MD5 9f6228bb179746a286e98703d17660e0
SHA1 7a490a9d56fdb5991db4b319cfbd4debbd90aff6
SHA512 5537e0254fb30a66a3fc78f60cfa000cca689a0a498849e5d77738be1be1a970c8b5c568a6b5e024d516e27e94596b2c68396456f5e69593f25f32832695b43e
SSDEEP 768:pokX4NBNfZQuSm7fyzIMis2gWUIbbq+PYwzSoOrRKp8yIoW9m9oXEsKI916srQ:Oo4NPCKLbqoYkbpplW9YoUsxXzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 48KB
SHA256 70b0761396bc2dcaddf02329238419ce4022db9cc4a447cc1dc54180124623cf
MD5 9f6228bb179746a286e98703d17660e0
SHA1 7a490a9d56fdb5991db4b319cfbd4debbd90aff6
SHA512 5537e0254fb30a66a3fc78f60cfa000cca689a0a498849e5d77738be1be1a970c8b5c568a6b5e024d516e27e94596b2c68396456f5e69593f25f32832695b43e
SSDEEP 768:pokX4NBNfZQuSm7fyzIMis2gWUIbbq+PYwzSoOrRKp8yIoW9m9oXEsKI916srQ:Oo4NPCKLbqoYkbpplW9YoUsxXzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 273B
SHA256 03afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f
MD5 9851b884bf4aadfade57d911a3f03332
SHA1 aaadd1c1856c22844bb9fbb030cf4f586ed8866a
SHA512 a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327
MD5 SHA1 SHA512

Submit Download

pdates.exe

Path \Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a
MD5 d4890ddadb9a81c4438a8e501d11e48a
SHA1 bb7715adfb42ddae5a7a91ae8f265df9e099080f
SHA512 9617f14c8a065fcbc9549254bcfae06f07f340e9497e59ee3d55387ec644416ab47c8d96e0cf5163425d2442a6f1404fd456f3817f1d3a9bc9ebb069039f4a89
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2520-54-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads