amadey | 2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441

General

Target

f4a5122b23d930794978c4615b0ce6d9.exe
Size

5.8MB
MD5

f4a5122b23d930794978c4615b0ce6d9
SHA1

8e34c6a3da1d048b932c20b15fd6ba119677d57c
SHA256

2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
SHA512

bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
SSDEEP

98304:+houLKz8ObAUvRXrrmARbgc4RS6HrHbAdMd93J7OgVNLIKORMed6KSu:+h9LKz8CXhvrRL4RS67bAd63J7vREX0

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.13

C2

http://185.172.128.125

Attributes

install_dir
4fdb51ccdc
install_file
Utsysc.exe
strings_key
a70b05054314f381be1ab9a5cdc8b250
url_paths
/u6vhSc3PPq/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 3 IoCs

Processes:

Utsysc.exeUtsysc.exeUtsysc.exe

pid process

2596 Utsysc.exe
636 Utsysc.exe
1568 Utsysc.exe
Loads dropped DLL 1 IoCs

Processes:

f4a5122b23d930794978c4615b0ce6d9.exe

pid process

1732 f4a5122b23d930794978c4615b0ce6d9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2936 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f4a5122b23d930794978c4615b0ce6d9.exeUtsysc.exeUtsysc.exeUtsysc.exe

pid process

1732 f4a5122b23d930794978c4615b0ce6d9.exe
2596 Utsysc.exe
636 Utsysc.exe
1568 Utsysc.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

f4a5122b23d930794978c4615b0ce6d9.exe

pid process

1732 f4a5122b23d930794978c4615b0ce6d9.exe

pid	process
2596	Utsysc.exe
636	Utsysc.exe
1568	Utsysc.exe

pid	process
1732	f4a5122b23d930794978c4615b0ce6d9.exe

pid	process
2936	schtasks.exe

pid	process
1732	f4a5122b23d930794978c4615b0ce6d9.exe
2596	Utsysc.exe
636	Utsysc.exe
1568	Utsysc.exe

pid	process
1732	f4a5122b23d930794978c4615b0ce6d9.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

f4a5122b23d930794978c4615b0ce6d9.exeUtsysc.exetaskeng.exe

description	pid	process	target process
PID 1732 wrote to memory of 2596	1732	f4a5122b23d930794978c4615b0ce6d9.exe	Utsysc.exe
PID 1732 wrote to memory of 2596	1732	f4a5122b23d930794978c4615b0ce6d9.exe	Utsysc.exe
PID 1732 wrote to memory of 2596	1732	f4a5122b23d930794978c4615b0ce6d9.exe	Utsysc.exe
PID 1732 wrote to memory of 2596	1732	f4a5122b23d930794978c4615b0ce6d9.exe	Utsysc.exe
PID 2596 wrote to memory of 2936	2596	Utsysc.exe	schtasks.exe
PID 2596 wrote to memory of 2936	2596	Utsysc.exe	schtasks.exe
PID 2596 wrote to memory of 2936	2596	Utsysc.exe	schtasks.exe
PID 2596 wrote to memory of 2936	2596	Utsysc.exe	schtasks.exe
PID 844 wrote to memory of 636	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 636	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 636	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 636	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 1568	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 1568	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 1568	844	taskeng.exe	Utsysc.exe
PID 844 wrote to memory of 1568	844	taskeng.exe	Utsysc.exe

C:\Users\Admin\AppData\Local\Temp\f4a5122b23d930794978c4615b0ce6d9.exe
"C:\Users\Admin\AppData\Local\Temp\f4a5122b23d930794978c4615b0ce6d9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F
3⤵
- Creates scheduled task(s)
PID:2936

C:\Windows\system32\taskeng.exe
taskeng.exe {589AB7AD-5191-4F72-BFFE-21A8A42BEA74} S-1-5-21-1502336823-1680518048-858510903-1000:XARGEIVJ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:636

C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Filesize
2.1MB

MD5
ac639c7663cb764c0d69d0d448b624ad

SHA1
83338115007b7aed9711c01392bdda0561600301

SHA256
227365fb387d6177be72e8ec811e1da97e7d493f058a760ed122b58345e0dadd

SHA512
05113f2fc09d4fc2b5c9e685311976ff0628029937a0d399c8dbe3db67ce2199a89060dc39e21d59acc18461dea1fc739500ed993f4c9e06e223a87fda3ffbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Filesize
5.8MB

MD5
f4a5122b23d930794978c4615b0ce6d9

SHA1
8e34c6a3da1d048b932c20b15fd6ba119677d57c

SHA256
2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441

SHA512
bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Filesize
5.8MB

MD5
f4a5122b23d930794978c4615b0ce6d9

SHA1
8e34c6a3da1d048b932c20b15fd6ba119677d57c

SHA256
2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441

SHA512
bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Filesize
5.8MB

MD5
f4a5122b23d930794978c4615b0ce6d9

SHA1
8e34c6a3da1d048b932c20b15fd6ba119677d57c

SHA256
2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441

SHA512
bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Filesize
5.8MB

MD5
f4a5122b23d930794978c4615b0ce6d9

SHA1
8e34c6a3da1d048b932c20b15fd6ba119677d57c

SHA256
2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441

SHA512
bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca

Download Submit
\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Filesize
5.8MB

MD5
f4a5122b23d930794978c4615b0ce6d9

SHA1
8e34c6a3da1d048b932c20b15fd6ba119677d57c

SHA256
2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441

SHA512
bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca

Download Submit
memory/636-132-0x0000000001220000-0x0000000001BFF000-memory.dmp

Filesize
9.9MB

Download
memory/636-94-0x0000000001220000-0x0000000001BFF000-memory.dmp

Filesize
9.9MB

Download
memory/1568-175-0x0000000001220000-0x0000000001BFF000-memory.dmp

Filesize
9.9MB

Download
memory/1568-144-0x0000000077C40000-0x0000000077C41000-memory.dmp

Filesize
4KB

Download
memory/1568-145-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1568-136-0x0000000001220000-0x0000000001BFF000-memory.dmp

Filesize
9.9MB

Download
memory/1732-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1732-14-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1732-26-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1732-29-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1732-31-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1732-34-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1732-36-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1732-40-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1732-21-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1732-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1732-16-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1732-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1732-50-0x0000000000230000-0x0000000000C0F000-memory.dmp

Filesize
9.9MB

Download
memory/1732-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1732-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1732-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1732-7-0x0000000000230000-0x0000000000C0F000-memory.dmp

Filesize
9.9MB

Download
memory/1732-24-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1732-9-0x0000000077C40000-0x0000000077C41000-memory.dmp

Filesize
4KB

Download
memory/1732-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1732-11-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2596-77-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2596-61-0x0000000001220000-0x0000000001BFF000-memory.dmp

Filesize
9.9MB

Download
memory/2596-60-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2596-53-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2596-91-0x0000000001220000-0x0000000001BFF000-memory.dmp

Filesize
9.9MB

Download
memory/2596-65-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2596-67-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2596-70-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2596-75-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2596-72-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2596-63-0x0000000077C40000-0x0000000077C41000-memory.dmp

Filesize
4KB

Download
memory/2596-55-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2596-58-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads