Overview

overview

10

Static

static

10

79f5147260...71.exe

windows7-x64

10

79f5147260...71.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    220s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2023 15:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71.exe

  • Size

    437KB

  • MD5

    625cb97439daa80940791f626bb4765c

  • SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

  • SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

  • SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

  • SSDEEP

    12288:C+mHU45lKN78RhFkvULfYOmBpumeYDDtKf:Ce45lKh87zLwp7Kf

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

4.12

C2

http://bitcoinstorm.cc

http://blackgold.top

http://emancipation1866.top
Attributes
  • strings_key

    550b275dd5aea0a3932bf7e10871e2c7

  • url_paths

    /g9sdjScV2/index.php

    /vdhe8ejs3/index.php

    /ghndbncg3S/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71.exe
    "C:\Users\Admin\AppData\Local\Temp\79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
      "C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:3532
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    1⤵
    • Executes dropped EXE
    PID:1624
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    1⤵
    • Executes dropped EXE
    PID:3148

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\598572287102
    Filesize

    84KB

    MD5

    ffd24056a119879dbba3fb149efb1c6b

    SHA1

    0126b5395c276dc51bbfeafaf57ba1cbd2cce43e

    SHA256

    bb321344b566b8922d1a85ade23966f35d1fc17ace5ab06cd94f1a58019b90fd

    SHA512

    ea698ec02bf2dcde77707c3ae20d1c18b11a14e68ef744a65a38ce12020dc03ebea7eecbf7fa02327bd8e361fe3990ac19bf50749b531b9adb0432b22e958061

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    Filesize

    437KB

    MD5

    625cb97439daa80940791f626bb4765c

    SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

    SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

    SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    Filesize

    437KB

    MD5

    625cb97439daa80940791f626bb4765c

    SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

    SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

    SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    Filesize

    437KB

    MD5

    625cb97439daa80940791f626bb4765c

    SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

    SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

    SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    Filesize

    437KB

    MD5

    625cb97439daa80940791f626bb4765c

    SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

    SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

    SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\d8bf47ee03\Utsysc.exe
    Filesize

    437KB

    MD5

    625cb97439daa80940791f626bb4765c

    SHA1

    af462cf5435efceefcd6786f212e192403e80c4b

    SHA256

    79f5147260484890fd1fab7a78619de557103717e124f1c249addc530b737a71

    SHA512

    145f8dba2288b45ef2f0ba1582861131501fb90697dfd1a79bfcdb93fa1d9110283ccb95e24317876082c7b5b24e32f2d7f954d93cb0cac2d819dec920d00891

    Download Submit
  • C:\Users\Admin\AppData\Roaming\c75c6c37b2d7a3\cred64.dll
    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

    Download Submit