Analysis

  • max time kernel
    26s
  • max time network
    32s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2023, 21:08

Errors

Reason
Machine shutdown

General

  • Target

    NEAS.236bd002777679b76a23909ad751fe13322cee61d5cd6f2988b5ad73b1367778_JC.exe

  • Size

    937KB

  • MD5

    a1807f6a73d1ff766096c4ecc2110576

  • SHA1

    0ee66413982bce51184292b48a2a8b70719a4fc6

  • SHA256

    236bd002777679b76a23909ad751fe13322cee61d5cd6f2988b5ad73b1367778

  • SHA512

    c2ce5d239e03bff38eab8bacb7fad701641a970b38554565275f947591d9e17174d6985b0222bfdb0aa90df67c3531b7481c4d543c0fe8f14330113016f0dd61

  • SSDEEP

    24576:dy6ePyPHA9rvt87AHlm3HsL9Kv1Yh+f6K7fz0zU1:467g9TmcHk3+AWK7fz+U

Malware Config

Extracted

Family

amadey

Version

3.87

C2

http://77.91.68.18/nice/index.php

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.236bd002777679b76a23909ad751fe13322cee61d5cd6f2988b5ad73b1367778_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.236bd002777679b76a23909ad751fe13322cee61d5cd6f2988b5ad73b1367778_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5602754.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5602754.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3752
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5290923.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5290923.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2425070.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2425070.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2296
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7122780.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7122780.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2776
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8854327.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8854327.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4440
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8566669.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8566669.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4464
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:364
                • C:\Windows\SysWOW64\shutdown.exe
                  shutdown -s -t 0
                  8⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2724
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa398b855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1904

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5602754.exe

          Filesize

          831KB

          MD5

          1f365f79e792d3d21c05d16ba4a303a8

          SHA1

          cdd54394267616a3ce108a9d8c8400fedfbca351

          SHA256

          7a49cb10d892e408e58d3fd164f22758c299419fa500108c4f2c5c03dff005f1

          SHA512

          f997a5936dc06031312a29bad4ce8601d9a4685bd384ab2c642757679cc6a5a496396841aa1414a9631b09544997b97545edcfe1bd401b6a95ae8c87bedb41b9

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5602754.exe

          Filesize

          831KB

          MD5

          1f365f79e792d3d21c05d16ba4a303a8

          SHA1

          cdd54394267616a3ce108a9d8c8400fedfbca351

          SHA256

          7a49cb10d892e408e58d3fd164f22758c299419fa500108c4f2c5c03dff005f1

          SHA512

          f997a5936dc06031312a29bad4ce8601d9a4685bd384ab2c642757679cc6a5a496396841aa1414a9631b09544997b97545edcfe1bd401b6a95ae8c87bedb41b9

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5290923.exe

          Filesize

          706KB

          MD5

          59cb97509d55179b699afa9c5c407ce3

          SHA1

          69dd84a073ed2ee6c0842a387f92c2128ccf15cd

          SHA256

          e10d1cc91e3636f42977e217f29c4e5fca159aa69871fa241c06d2f0db686d21

          SHA512

          4c2f449a4b6f6718e68d188a29460d6da2ca2f787740ed06a54ecbdda4e17519ca1b67886b20ba68f26077c2f0e88a9690abbb2cc77e5062ace93d1ca02ed4eb

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5290923.exe

          Filesize

          706KB

          MD5

          59cb97509d55179b699afa9c5c407ce3

          SHA1

          69dd84a073ed2ee6c0842a387f92c2128ccf15cd

          SHA256

          e10d1cc91e3636f42977e217f29c4e5fca159aa69871fa241c06d2f0db686d21

          SHA512

          4c2f449a4b6f6718e68d188a29460d6da2ca2f787740ed06a54ecbdda4e17519ca1b67886b20ba68f26077c2f0e88a9690abbb2cc77e5062ace93d1ca02ed4eb

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2425070.exe

          Filesize

          551KB

          MD5

          a438ce3d49256bac762f943a8909909a

          SHA1

          f7d5c973779c53eb52aebe932a9eb26ac2564d94

          SHA256

          f4e7f3c0c2b391a36cf5c81bb558f997c2df05200e9a38d331892694f6924e12

          SHA512

          af5f05e7b102060c9e5d9c99541bccc00024395365eccc2bfe312fa0ab7ab6017ce462a8acb5f8fff747e6b603d468b728800dcea5e41c50d5e486a4378a5738

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2425070.exe

          Filesize

          551KB

          MD5

          a438ce3d49256bac762f943a8909909a

          SHA1

          f7d5c973779c53eb52aebe932a9eb26ac2564d94

          SHA256

          f4e7f3c0c2b391a36cf5c81bb558f997c2df05200e9a38d331892694f6924e12

          SHA512

          af5f05e7b102060c9e5d9c99541bccc00024395365eccc2bfe312fa0ab7ab6017ce462a8acb5f8fff747e6b603d468b728800dcea5e41c50d5e486a4378a5738

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7122780.exe

          Filesize

          384KB

          MD5

          a517f984f4819aedf64cb779ec409fc5

          SHA1

          309614685ea8747abbe097d9e110edb1aade981d

          SHA256

          17a8a9702c61059064ef60847bc24c9dcaab061e41e9591b23df3be3ebbfabe4

          SHA512

          8b0b0335ab7ccc2b105c5f64432a64fd4ffaf0ed96be343e33032bfbe3ecdd413222ca1d6744478dbcc4a36c7d4a5ed5e270d9b43f2ecca980a90964930cd918

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7122780.exe

          Filesize

          384KB

          MD5

          a517f984f4819aedf64cb779ec409fc5

          SHA1

          309614685ea8747abbe097d9e110edb1aade981d

          SHA256

          17a8a9702c61059064ef60847bc24c9dcaab061e41e9591b23df3be3ebbfabe4

          SHA512

          8b0b0335ab7ccc2b105c5f64432a64fd4ffaf0ed96be343e33032bfbe3ecdd413222ca1d6744478dbcc4a36c7d4a5ed5e270d9b43f2ecca980a90964930cd918

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8854327.exe

          Filesize

          184KB

          MD5

          86e60d3c6b7a574d5599904da47d3955

          SHA1

          b160499b6cd745df984e8dd339cdfe24625ee5fc

          SHA256

          a34c3205391f7311f8137f7e301d4a44456f08f5ffa825ebaf798adfdb1e3034

          SHA512

          4af617d3a42555807c2aadf42d17d061a9ec31799b52e461449651dd95ac8dc0150f39cf3e2ba578d64a3d475987eca79abda1a507dfa0088db61f85869ff390

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8854327.exe

          Filesize

          184KB

          MD5

          86e60d3c6b7a574d5599904da47d3955

          SHA1

          b160499b6cd745df984e8dd339cdfe24625ee5fc

          SHA256

          a34c3205391f7311f8137f7e301d4a44456f08f5ffa825ebaf798adfdb1e3034

          SHA512

          4af617d3a42555807c2aadf42d17d061a9ec31799b52e461449651dd95ac8dc0150f39cf3e2ba578d64a3d475987eca79abda1a507dfa0088db61f85869ff390

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8566669.exe

          Filesize

          333KB

          MD5

          92e4486245785e61dec2ee306deb394c

          SHA1

          c42dc7dc08b374d8297b17fef829143824b5535d

          SHA256

          37b0a7541d8d68ba7070c04bf22b29f6166965e0a553584af303b2679cd921ee

          SHA512

          58b1c86938a21440c4f039d060699b986715caaf893f4515c36da77a8bbe793fc13faa4b57c2d7f85854ae577b70d9d1279192d31603cc53f584848b77b1b8f4

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8566669.exe

          Filesize

          333KB

          MD5

          92e4486245785e61dec2ee306deb394c

          SHA1

          c42dc7dc08b374d8297b17fef829143824b5535d

          SHA256

          37b0a7541d8d68ba7070c04bf22b29f6166965e0a553584af303b2679cd921ee

          SHA512

          58b1c86938a21440c4f039d060699b986715caaf893f4515c36da77a8bbe793fc13faa4b57c2d7f85854ae577b70d9d1279192d31603cc53f584848b77b1b8f4

        • memory/4440-44-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-54-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-39-0x0000000004B50000-0x00000000050F4000-memory.dmp

          Filesize

          5.6MB

        • memory/4440-40-0x0000000002500000-0x000000000251C000-memory.dmp

          Filesize

          112KB

        • memory/4440-41-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-42-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-38-0x0000000004B40000-0x0000000004B50000-memory.dmp

          Filesize

          64KB

        • memory/4440-46-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-48-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-50-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-52-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-37-0x0000000004B40000-0x0000000004B50000-memory.dmp

          Filesize

          64KB

        • memory/4440-56-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-58-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-60-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-62-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-64-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-66-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-68-0x0000000002500000-0x0000000002516000-memory.dmp

          Filesize

          88KB

        • memory/4440-69-0x0000000073F80000-0x0000000074730000-memory.dmp

          Filesize

          7.7MB

        • memory/4440-70-0x0000000004B40000-0x0000000004B50000-memory.dmp

          Filesize

          64KB

        • memory/4440-72-0x0000000073F80000-0x0000000074730000-memory.dmp

          Filesize

          7.7MB

        • memory/4440-36-0x0000000073F80000-0x0000000074730000-memory.dmp

          Filesize

          7.7MB

        • memory/4440-35-0x0000000002360000-0x000000000237E000-memory.dmp

          Filesize

          120KB