amadey | f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

General

Target

f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe
Size

6.5MB
MD5

047b5d2075c2d6610b0b63c34d0455be
SHA1

f5a29ddd6f1df5da62250f93094b754043cc586c
SHA256

f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba
SHA512

6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582
SSDEEP

196608:ohcmcCw4eb7tPjA5rAoYpB+2u54AXDkQcRDt8yhm0FpGn:ohPcfDtPc5sXpB+2umGd4DthtFO

Score

10^/10

amadey trojan vmprotect

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.166/b7djSDcPcZ/index.php

45.9.74.141/b7djSDcPcZ/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 2 IoCs

Processes:

bstyoops.exebstyoops.exe

pid process

2860 bstyoops.exe
2348 bstyoops.exe
Loads dropped DLL 1 IoCs

Processes:

f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe

pid process

2964 f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe

pid	process
2860	bstyoops.exe
2348	bstyoops.exe

pid	process
2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe

VMProtect packed file 14 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2964-56-0x0000000001000000-0x0000000001AA2000-memory.dmp	vmprotect
behavioral1/memory/2964-60-0x0000000001000000-0x0000000001AA2000-memory.dmp	vmprotect
\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe	vmprotect
behavioral1/memory/2964-75-0x0000000001000000-0x0000000001AA2000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe	vmprotect
behavioral1/memory/2860-78-0x00000000010F0000-0x0000000001B92000-memory.dmp	vmprotect
behavioral1/memory/2860-83-0x00000000010F0000-0x0000000001B92000-memory.dmp	vmprotect
behavioral1/memory/2860-86-0x00000000010F0000-0x0000000001B92000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe	vmprotect
behavioral1/memory/2348-90-0x00000000010F0000-0x0000000001B92000-memory.dmp	vmprotect
behavioral1/memory/2348-93-0x00000000010F0000-0x0000000001B92000-memory.dmp	vmprotect
behavioral1/memory/2348-100-0x00000000010F0000-0x0000000001B92000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2160 schtasks.exe
1336 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exebstyoops.exebstyoops.exe

pid process

2964 f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe
2860 bstyoops.exe
2348 bstyoops.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe

pid process

2964 f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe

pid	process
2160	schtasks.exe
1336	schtasks.exe

pid	process
2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe
2860	bstyoops.exe
2348	bstyoops.exe

pid	process
2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exebstyoops.execmd.exetaskeng.exebstyoops.execmd.exe

description	pid	process	target process
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2964 wrote to memory of 2860	2964	f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe	bstyoops.exe
PID 2860 wrote to memory of 2160	2860	bstyoops.exe	schtasks.exe
PID 2860 wrote to memory of 2160	2860	bstyoops.exe	schtasks.exe
PID 2860 wrote to memory of 2160	2860	bstyoops.exe	schtasks.exe
PID 2860 wrote to memory of 2160	2860	bstyoops.exe	schtasks.exe
PID 2860 wrote to memory of 2640	2860	bstyoops.exe	cmd.exe
PID 2860 wrote to memory of 2640	2860	bstyoops.exe	cmd.exe
PID 2860 wrote to memory of 2640	2860	bstyoops.exe	cmd.exe
PID 2860 wrote to memory of 2640	2860	bstyoops.exe	cmd.exe
PID 2640 wrote to memory of 2712	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2712	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2712	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2712	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2720	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2720	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2720	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2720	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2756	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2756	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2756	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2756	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2164	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2164	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2164	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 2164	2640	cmd.exe	cmd.exe
PID 2640 wrote to memory of 1760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 1760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 1760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 1760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2760	2640	cmd.exe	cacls.exe
PID 2640 wrote to memory of 2760	2640	cmd.exe	cacls.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 3028 wrote to memory of 2348	3028	taskeng.exe	bstyoops.exe
PID 2348 wrote to memory of 1336	2348	bstyoops.exe	schtasks.exe
PID 2348 wrote to memory of 1336	2348	bstyoops.exe	schtasks.exe
PID 2348 wrote to memory of 1336	2348	bstyoops.exe	schtasks.exe
PID 2348 wrote to memory of 1336	2348	bstyoops.exe	schtasks.exe
PID 2348 wrote to memory of 1724	2348	bstyoops.exe	cmd.exe
PID 2348 wrote to memory of 1724	2348	bstyoops.exe	cmd.exe
PID 2348 wrote to memory of 1724	2348	bstyoops.exe	cmd.exe
PID 2348 wrote to memory of 1724	2348	bstyoops.exe	cmd.exe
PID 1724 wrote to memory of 1532	1724	cmd.exe	cmd.exe
PID 1724 wrote to memory of 1532	1724	cmd.exe	cmd.exe
PID 1724 wrote to memory of 1532	1724	cmd.exe	cmd.exe
PID 1724 wrote to memory of 1532	1724	cmd.exe	cmd.exe
PID 1724 wrote to memory of 860	1724	cmd.exe	cacls.exe
PID 1724 wrote to memory of 860	1724	cmd.exe	cacls.exe
PID 1724 wrote to memory of 860	1724	cmd.exe	cacls.exe
PID 1724 wrote to memory of 860	1724	cmd.exe	cacls.exe
PID 1724 wrote to memory of 2028	1724	cmd.exe	cacls.exe
PID 1724 wrote to memory of 2028	1724	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe
"C:\Users\Admin\AppData\Local\Temp\f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2964

C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
"C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
3⤵
- Creates scheduled task(s)
PID:2160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:2712

C:\Windows\SysWOW64\cacls.exe
CACLS "bstyoops.exe" /P "Admin:N"
4⤵
PID:2720

C:\Windows\SysWOW64\cacls.exe
CACLS "bstyoops.exe" /P "Admin:R" /E
4⤵
PID:2756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:2164

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c2868ed41c" /P "Admin:N"
4⤵
PID:1760

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c2868ed41c" /P "Admin:R" /E
4⤵
PID:2760

C:\Windows\system32\taskeng.exe
taskeng.exe {379EEECB-EABA-4704-BDB7-C4D8DCD7C448} S-1-5-21-3408354897-1169622894-3874090110-1000:WGWIREOE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
3⤵
- Creates scheduled task(s)
PID:1336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\cacls.exe
CACLS "bstyoops.exe" /P "Admin:N"
4⤵
PID:860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:1532

C:\Windows\SysWOW64\cacls.exe
CACLS "bstyoops.exe" /P "Admin:R" /E
4⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:2532

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c2868ed41c" /P "Admin:N"
4⤵
PID:1720

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c2868ed41c" /P "Admin:R" /E
4⤵
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
Filesize
6.5MB

MD5
047b5d2075c2d6610b0b63c34d0455be

SHA1
f5a29ddd6f1df5da62250f93094b754043cc586c

SHA256
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

SHA512
6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
Filesize
6.5MB

MD5
047b5d2075c2d6610b0b63c34d0455be

SHA1
f5a29ddd6f1df5da62250f93094b754043cc586c

SHA256
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

SHA512
6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
Filesize
6.5MB

MD5
047b5d2075c2d6610b0b63c34d0455be

SHA1
f5a29ddd6f1df5da62250f93094b754043cc586c

SHA256
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

SHA512
6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
Filesize
6.5MB

MD5
047b5d2075c2d6610b0b63c34d0455be

SHA1
f5a29ddd6f1df5da62250f93094b754043cc586c

SHA256
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

SHA512
6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

Download Submit
\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
Filesize
6.5MB

MD5
047b5d2075c2d6610b0b63c34d0455be

SHA1
f5a29ddd6f1df5da62250f93094b754043cc586c

SHA256
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba

SHA512
6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582

Download Submit
memory/2348-95-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2348-90-0x00000000010F0000-0x0000000001B92000-memory.dmp

Filesize
10.6MB

Download
memory/2348-91-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2348-93-0x00000000010F0000-0x0000000001B92000-memory.dmp

Filesize
10.6MB

Download
memory/2348-96-0x00000000778F0000-0x00000000778F1000-memory.dmp

Filesize
4KB

Download
memory/2348-100-0x00000000010F0000-0x0000000001B92000-memory.dmp

Filesize
10.6MB

Download
memory/2860-86-0x00000000010F0000-0x0000000001B92000-memory.dmp

Filesize
10.6MB

Download
memory/2860-78-0x00000000010F0000-0x0000000001B92000-memory.dmp

Filesize
10.6MB

Download
memory/2860-81-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2860-83-0x00000000010F0000-0x0000000001B92000-memory.dmp

Filesize
10.6MB

Download
memory/2964-62-0x00000000778F0000-0x00000000778F1000-memory.dmp

Filesize
4KB

Download
memory/2964-75-0x0000000001000000-0x0000000001AA2000-memory.dmp

Filesize
10.6MB

Download
memory/2964-65-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2964-54-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2964-59-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2964-60-0x0000000001000000-0x0000000001AA2000-memory.dmp

Filesize
10.6MB

Download
memory/2964-57-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2964-56-0x0000000001000000-0x0000000001AA2000-memory.dmp

Filesize
10.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads