General

  • Target

    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

  • Size

    418KB

  • Sample

    231126-2dyktscg4z

  • MD5

    0099a99f5ffb3c3ae78af0084136fab3

  • SHA1

    0205a065728a9ec1133e8a372b1e3864df776e8c

  • SHA256

    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

  • SHA512

    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

  • SSDEEP

    12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes
  • install_dir

    cd1f156d67

  • install_file

    Utsysc.exe

  • strings_key

    0dd3e5ee91b367c60c9e575983554b30

  • url_paths

    /ghsdh39s/index.php

rc4.plain

Targets

    • Target

      919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

    • Size

      418KB

    • MD5

      0099a99f5ffb3c3ae78af0084136fab3

    • SHA1

      0205a065728a9ec1133e8a372b1e3864df776e8c

    • SHA256

      919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

    • SHA512

      5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

    • SSDEEP

      12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY

    Score
    8/10
    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks