amadey | eef05482c60950b557ccf3d80619feb4cea965cf2a2986ae8f80f95164b6dbb8

General

Target
a5a1aa4d6204a1d4a645eefa50085193.exe
Size 224KB
Sample230725-qdacfsdc61
SHA256 eef05482c60950b557ccf3d80619feb4cea965cf2a2986ae8f80f95164b6dbb8
MD5 a5a1aa4d6204a1d4a645eefa50085193
SHA1 f24b3fe424e020d1277feaf288ac638a9945bf33
SHA512 1a939740fa84da838b0a2148b6566273c4534059c43813ad19188171d79bc55e88ec2fe04c458d2a068678e19a3e647320d916791917fcbd93b4d00baa858c13
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	a5a1aa4d6204a1d4a645eefa50085193.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 1 IoCs

pid	Process
4080	pdates.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4792	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	a5a1aa4d6204a1d4a645eefa50085193.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4080	4160	a5a1aa4d6204a1d4a645eefa50085193.exe	87
PID 4160 wrote to memory of 4080	4160	a5a1aa4d6204a1d4a645eefa50085193.exe	87
PID 4160 wrote to memory of 4080	4160	a5a1aa4d6204a1d4a645eefa50085193.exe	87
PID 4080 wrote to memory of 4792	4080	pdates.exe	88
PID 4080 wrote to memory of 4792	4080	pdates.exe	88
PID 4080 wrote to memory of 4792	4080	pdates.exe	88
PID 4080 wrote to memory of 5096	4080	pdates.exe	90
PID 4080 wrote to memory of 5096	4080	pdates.exe	90
PID 4080 wrote to memory of 5096	4080	pdates.exe	90
PID 5096 wrote to memory of 912	5096	cmd.exe	92
PID 5096 wrote to memory of 912	5096	cmd.exe	92
PID 5096 wrote to memory of 912	5096	cmd.exe	92
PID 5096 wrote to memory of 4864	5096	cmd.exe	93
PID 5096 wrote to memory of 4864	5096	cmd.exe	93
PID 5096 wrote to memory of 4864	5096	cmd.exe	93
PID 5096 wrote to memory of 240	5096	cmd.exe	94
PID 5096 wrote to memory of 240	5096	cmd.exe	94
PID 5096 wrote to memory of 240	5096	cmd.exe	94
PID 5096 wrote to memory of 1120	5096	cmd.exe	95
PID 5096 wrote to memory of 1120	5096	cmd.exe	95
PID 5096 wrote to memory of 1120	5096	cmd.exe	95
PID 5096 wrote to memory of 4848	5096	cmd.exe	96
PID 5096 wrote to memory of 4848	5096	cmd.exe	96
PID 5096 wrote to memory of 4848	5096	cmd.exe	96
PID 5096 wrote to memory of 248	5096	cmd.exe	97
PID 5096 wrote to memory of 248	5096	cmd.exe	97
PID 5096 wrote to memory of 248	5096	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\a5a1aa4d6204a1d4a645eefa50085193.exe
"C:\Users\Admin\AppData\Local\Temp\a5a1aa4d6204a1d4a645eefa50085193.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
  "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "pdates.exe" /P "Admin:N"
      4⤵
      PID:4864
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "pdates.exe" /P "Admin:R" /E
      4⤵
      PID:240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\925e7e99c5" /P "Admin:N"
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\925e7e99c5" /P "Admin:R" /E
      4⤵
      PID:248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 eef05482c60950b557ccf3d80619feb4cea965cf2a2986ae8f80f95164b6dbb8
MD5 a5a1aa4d6204a1d4a645eefa50085193
SHA1 f24b3fe424e020d1277feaf288ac638a9945bf33
SHA512 1a939740fa84da838b0a2148b6566273c4534059c43813ad19188171d79bc55e88ec2fe04c458d2a068678e19a3e647320d916791917fcbd93b4d00baa858c13
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 eef05482c60950b557ccf3d80619feb4cea965cf2a2986ae8f80f95164b6dbb8
MD5 a5a1aa4d6204a1d4a645eefa50085193
SHA1 f24b3fe424e020d1277feaf288ac638a9945bf33
SHA512 1a939740fa84da838b0a2148b6566273c4534059c43813ad19188171d79bc55e88ec2fe04c458d2a068678e19a3e647320d916791917fcbd93b4d00baa858c13
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdates.exe

Path C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
Size 224KB
SHA256 eef05482c60950b557ccf3d80619feb4cea965cf2a2986ae8f80f95164b6dbb8
MD5 a5a1aa4d6204a1d4a645eefa50085193
SHA1 f24b3fe424e020d1277feaf288ac638a9945bf33
SHA512 1a939740fa84da838b0a2148b6566273c4534059c43813ad19188171d79bc55e88ec2fe04c458d2a068678e19a3e647320d916791917fcbd93b4d00baa858c13
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads