amadey | ffb44a5388958cda3be00af5170e3fa51c5bc59e7b6ea659836417a17594d18c

Analysis

max time kernel
124s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Amdau.exe
Size

3.2MB
MD5

c3ee25c18f2c408c9054d9c6d4c1e147
SHA1

80d2395709b713647b199c22fdec5415d3a68052
SHA256

c406b733897d091408ed5a656cfbf043623a8d08092269918184ccefd87971f0
SHA512

d91a1675ca9a2923020ce244d00da6a9b686240dc7ef50185709ecbc2f6b8f92c371ee94ec277a2d3b0e33704c532d2f8779b39ac9f630b9b40f0794312d72f4
SSDEEP

24576:0cUe92VHXy4fv6hfZQGwSWF6r+tLq9rNE0TR5sTlcJxbTGX+tIonLiMjrWD:rt9L4p7GJEeR51TGX10LPjrWD

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://45.9.74.182/b7djSDcPcZ/index.php

Attributes

install_dir
f3f10bd848
install_file
bstyoops.exe
strings_key
05986a1cda6dc6caabf469f27fb6c32d

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edddegyjjykj.lnk	Amdau.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 3640	5016	Amdau.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	Amdau.exe
5016	Amdau.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	Amdau.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1524	5016	Amdau.exe	91
PID 5016 wrote to memory of 1524	5016	Amdau.exe	91
PID 5016 wrote to memory of 1524	5016	Amdau.exe	91
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92
PID 5016 wrote to memory of 3640	5016	Amdau.exe	92

C:\Users\Admin\AppData\Local\Temp\Amdau.exe
"C:\Users\Admin\AppData\Local\Temp\Amdau.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:1524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3640-31-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3640-35-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3640-34-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3640-33-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3640-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5016-18-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-26-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-8-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-10-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-12-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-14-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-16-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-0-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/5016-20-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-22-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-24-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-6-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-28-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-29-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/5016-30-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/5016-5-0x0000000000C10000-0x0000000000C25000-memory.dmp

Filesize
84KB

Download
memory/5016-4-0x0000000000C10000-0x0000000000C2C000-memory.dmp

Filesize
112KB

Download
memory/5016-3-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/5016-2-0x00000000050B0000-0x000000000514C000-memory.dmp

Filesize
624KB

Download
memory/5016-1-0x00000000003E0000-0x0000000000714000-memory.dmp

Filesize
3.2MB

Download
memory/5016-36-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/5016-42-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download