amadey | b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2

General

Target
c461ad93c386805d731218cd483bdb23.exe
Size 224KB
Sample230725-qc8hvsce97
SHA256 b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2
MD5 c461ad93c386805d731218cd483bdb23
SHA1 8be1c90ec9947f54d17f14a20bc7981abfae3613
SHA512 5fa8b65ddc1d42fa4691205aa1ec6f0e05ad14b497445b85c2f9d63b75e1f4f13911635f042621ba818b3d12cf4d5d52b773f93b1377640b1642bb5a65de855c
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	c461ad93c386805d731218cd483bdb23.exe
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 3 IoCs

pid	Process
1712	pdates.exe
1836	pdates.exe
1888	pdates.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3344	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
100	c461ad93c386805d731218cd483bdb23.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 1712	100	c461ad93c386805d731218cd483bdb23.exe	86
PID 100 wrote to memory of 1712	100	c461ad93c386805d731218cd483bdb23.exe	86
PID 100 wrote to memory of 1712	100	c461ad93c386805d731218cd483bdb23.exe	86
PID 1712 wrote to memory of 3344	1712	pdates.exe	87
PID 1712 wrote to memory of 3344	1712	pdates.exe	87
PID 1712 wrote to memory of 3344	1712	pdates.exe	87
PID 1712 wrote to memory of 1800	1712	pdates.exe	89
PID 1712 wrote to memory of 1800	1712	pdates.exe	89
PID 1712 wrote to memory of 1800	1712	pdates.exe	89
PID 1800 wrote to memory of 4700	1800	cmd.exe	91
PID 1800 wrote to memory of 4700	1800	cmd.exe	91
PID 1800 wrote to memory of 4700	1800	cmd.exe	91
PID 1800 wrote to memory of 2256	1800	cmd.exe	92
PID 1800 wrote to memory of 2256	1800	cmd.exe	92
PID 1800 wrote to memory of 2256	1800	cmd.exe	92
PID 1800 wrote to memory of 1496	1800	cmd.exe	93
PID 1800 wrote to memory of 1496	1800	cmd.exe	93
PID 1800 wrote to memory of 1496	1800	cmd.exe	93
PID 1800 wrote to memory of 1888	1800	cmd.exe	94
PID 1800 wrote to memory of 1888	1800	cmd.exe	94
PID 1800 wrote to memory of 1888	1800	cmd.exe	94
PID 1800 wrote to memory of 4940	1800	cmd.exe	95
PID 1800 wrote to memory of 4940	1800	cmd.exe	95
PID 1800 wrote to memory of 4940	1800	cmd.exe	95
PID 1800 wrote to memory of 1664	1800	cmd.exe	96
PID 1800 wrote to memory of 1664	1800	cmd.exe	96
PID 1800 wrote to memory of 1664	1800	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\c461ad93c386805d731218cd483bdb23.exe
"C:\Users\Admin\AppData\Local\Temp\c461ad93c386805d731218cd483bdb23.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:100
- C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4700
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "pdates.exe" /P "Admin:N"
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "pdates.exe" /P "Admin:R" /E
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1888
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\925e7e99c5" /P "Admin:N"
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\925e7e99c5" /P "Admin:R" /E
      4⤵
      PID:1664

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2
MD5 c461ad93c386805d731218cd483bdb23
SHA1 8be1c90ec9947f54d17f14a20bc7981abfae3613
SHA512 5fa8b65ddc1d42fa4691205aa1ec6f0e05ad14b497445b85c2f9d63b75e1f4f13911635f042621ba818b3d12cf4d5d52b773f93b1377640b1642bb5a65de855c
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2
MD5 c461ad93c386805d731218cd483bdb23
SHA1 8be1c90ec9947f54d17f14a20bc7981abfae3613
SHA512 5fa8b65ddc1d42fa4691205aa1ec6f0e05ad14b497445b85c2f9d63b75e1f4f13911635f042621ba818b3d12cf4d5d52b773f93b1377640b1642bb5a65de855c
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2
MD5 c461ad93c386805d731218cd483bdb23
SHA1 8be1c90ec9947f54d17f14a20bc7981abfae3613
SHA512 5fa8b65ddc1d42fa4691205aa1ec6f0e05ad14b497445b85c2f9d63b75e1f4f13911635f042621ba818b3d12cf4d5d52b773f93b1377640b1642bb5a65de855c
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2
MD5 c461ad93c386805d731218cd483bdb23
SHA1 8be1c90ec9947f54d17f14a20bc7981abfae3613
SHA512 5fa8b65ddc1d42fa4691205aa1ec6f0e05ad14b497445b85c2f9d63b75e1f4f13911635f042621ba818b3d12cf4d5d52b773f93b1377640b1642bb5a65de855c
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2
MD5 c461ad93c386805d731218cd483bdb23
SHA1 8be1c90ec9947f54d17f14a20bc7981abfae3613
SHA512 5fa8b65ddc1d42fa4691205aa1ec6f0e05ad14b497445b85c2f9d63b75e1f4f13911635f042621ba818b3d12cf4d5d52b773f93b1377640b1642bb5a65de855c
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads