amadey | 6b792ffcc0a171ad6515ad057b425b886b7fa8ddee7ca58a59205852d9e32897

Analysis

max time kernel
182s
max time network
254s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23/08/2023, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

h5958588.exe
Size

316KB
MD5

87f51eb08a6ffc9423ccbacec6d424cf
SHA1

9fd23bcb2e488c472734d6a289d6c402630c1b3f
SHA256

6b792ffcc0a171ad6515ad057b425b886b7fa8ddee7ca58a59205852d9e32897
SHA512

1abec28fa2b7063edc015f19f6b23e70e6b62f6844870429d4bd165abc3832665c21773f6a8a1d377cffd05002d2fde50a2faa9f31f40dccf9223feb31d23f90
SSDEEP

6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

S-%lu-

77.91.68.18/nice/index.php

3.87/nice/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4208	saves.exe
4512	saves.exe
3352	saves.exe

Loads dropped DLL 1 IoCs

pid	Process
4800	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2712	schtasks.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4208	3156	h5958588.exe	69
PID 3156 wrote to memory of 4208	3156	h5958588.exe	69
PID 3156 wrote to memory of 4208	3156	h5958588.exe	69
PID 4208 wrote to memory of 2712	4208	saves.exe	70
PID 4208 wrote to memory of 2712	4208	saves.exe	70
PID 4208 wrote to memory of 2712	4208	saves.exe	70
PID 4208 wrote to memory of 1824	4208	saves.exe	72
PID 4208 wrote to memory of 1824	4208	saves.exe	72
PID 4208 wrote to memory of 1824	4208	saves.exe	72
PID 1824 wrote to memory of 4828	1824	cmd.exe	74
PID 1824 wrote to memory of 4828	1824	cmd.exe	74
PID 1824 wrote to memory of 4828	1824	cmd.exe	74
PID 1824 wrote to memory of 4108	1824	cmd.exe	75
PID 1824 wrote to memory of 4108	1824	cmd.exe	75
PID 1824 wrote to memory of 4108	1824	cmd.exe	75
PID 1824 wrote to memory of 3768	1824	cmd.exe	76
PID 1824 wrote to memory of 3768	1824	cmd.exe	76
PID 1824 wrote to memory of 3768	1824	cmd.exe	76
PID 1824 wrote to memory of 4796	1824	cmd.exe	77
PID 1824 wrote to memory of 4796	1824	cmd.exe	77
PID 1824 wrote to memory of 4796	1824	cmd.exe	77
PID 1824 wrote to memory of 4080	1824	cmd.exe	78
PID 1824 wrote to memory of 4080	1824	cmd.exe	78
PID 1824 wrote to memory of 4080	1824	cmd.exe	78
PID 1824 wrote to memory of 4776	1824	cmd.exe	79
PID 1824 wrote to memory of 4776	1824	cmd.exe	79
PID 1824 wrote to memory of 4776	1824	cmd.exe	79
PID 4208 wrote to memory of 4800	4208	saves.exe	82
PID 4208 wrote to memory of 4800	4208	saves.exe	82
PID 4208 wrote to memory of 4800	4208	saves.exe	82

C:\Users\Admin\AppData\Local\Temp\h5958588.exe
"C:\Users\Admin\AppData\Local\Temp\h5958588.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
  "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4828
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "saves.exe" /P "Admin:N"
      4⤵
      PID:4108
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "saves.exe" /P "Admin:R" /E
      4⤵
      PID:3768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4796
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\b40d11255d" /P "Admin:N"
      4⤵
      PID:4080
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\b40d11255d" /P "Admin:R" /E
      4⤵
      PID:4776
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4800

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
316KB

MD5
87f51eb08a6ffc9423ccbacec6d424cf

SHA1
9fd23bcb2e488c472734d6a289d6c402630c1b3f

SHA256
6b792ffcc0a171ad6515ad057b425b886b7fa8ddee7ca58a59205852d9e32897

SHA512
1abec28fa2b7063edc015f19f6b23e70e6b62f6844870429d4bd165abc3832665c21773f6a8a1d377cffd05002d2fde50a2faa9f31f40dccf9223feb31d23f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
316KB

MD5
87f51eb08a6ffc9423ccbacec6d424cf

SHA1
9fd23bcb2e488c472734d6a289d6c402630c1b3f

SHA256
6b792ffcc0a171ad6515ad057b425b886b7fa8ddee7ca58a59205852d9e32897

SHA512
1abec28fa2b7063edc015f19f6b23e70e6b62f6844870429d4bd165abc3832665c21773f6a8a1d377cffd05002d2fde50a2faa9f31f40dccf9223feb31d23f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
316KB

MD5
87f51eb08a6ffc9423ccbacec6d424cf

SHA1
9fd23bcb2e488c472734d6a289d6c402630c1b3f

SHA256
6b792ffcc0a171ad6515ad057b425b886b7fa8ddee7ca58a59205852d9e32897

SHA512
1abec28fa2b7063edc015f19f6b23e70e6b62f6844870429d4bd165abc3832665c21773f6a8a1d377cffd05002d2fde50a2faa9f31f40dccf9223feb31d23f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
316KB

MD5
87f51eb08a6ffc9423ccbacec6d424cf

SHA1
9fd23bcb2e488c472734d6a289d6c402630c1b3f

SHA256
6b792ffcc0a171ad6515ad057b425b886b7fa8ddee7ca58a59205852d9e32897

SHA512
1abec28fa2b7063edc015f19f6b23e70e6b62f6844870429d4bd165abc3832665c21773f6a8a1d377cffd05002d2fde50a2faa9f31f40dccf9223feb31d23f90

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads