amadey | 252850b3ba00d2467c4388bc99ce5c14abc78c21aba87062760bbb3d9aaf1df8

Analysis

max time kernel
143s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b24cd81963b57556ae1bd102ca8ee22a.exe
Size

482KB
MD5

b24cd81963b57556ae1bd102ca8ee22a
SHA1

e8c36efb9a650fe745dda09415d2a5d0813a7619
SHA256

252850b3ba00d2467c4388bc99ce5c14abc78c21aba87062760bbb3d9aaf1df8
SHA512

59198a8493f01a61d58eadfec5a96d97b96e0bb78e9a0776638fd02a53b7671e47d53254f2751801c548af65bfdceb7b6928da104ab3a53e35585ec36e5fb158
SSDEEP

12288:FC5b6bew+1WDhTk4qFLrcZfk585i5Q9pJfKPV:Q5BwuEZk40cpk585iwpJf

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.14

http://anfesq.com

http://cbinr.com

http://rimakc.ru

Attributes

install_dir
68fd3d7ade
install_file
Utsysc.exe
strings_key
27ec7fd6f50f63b8af0c1d3deefcc8fe
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2460	Utsysc.exe
584	Utsysc.exe
2800	Utsysc.exe

Loads dropped DLL 2 IoCs

pid	Process
2424	b24cd81963b57556ae1bd102ca8ee22a.exe
2424	b24cd81963b57556ae1bd102ca8ee22a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2592	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	b24cd81963b57556ae1bd102ca8ee22a.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2460	2424	b24cd81963b57556ae1bd102ca8ee22a.exe	28
PID 2424 wrote to memory of 2460	2424	b24cd81963b57556ae1bd102ca8ee22a.exe	28
PID 2424 wrote to memory of 2460	2424	b24cd81963b57556ae1bd102ca8ee22a.exe	28
PID 2424 wrote to memory of 2460	2424	b24cd81963b57556ae1bd102ca8ee22a.exe	28
PID 2460 wrote to memory of 2592	2460	Utsysc.exe	30
PID 2460 wrote to memory of 2592	2460	Utsysc.exe	30
PID 2460 wrote to memory of 2592	2460	Utsysc.exe	30
PID 2460 wrote to memory of 2592	2460	Utsysc.exe	30
PID 1108 wrote to memory of 584	1108	taskeng.exe	35
PID 1108 wrote to memory of 584	1108	taskeng.exe	35
PID 1108 wrote to memory of 584	1108	taskeng.exe	35
PID 1108 wrote to memory of 584	1108	taskeng.exe	35
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2460 wrote to memory of 2188	2460	Utsysc.exe	36
PID 2188 wrote to memory of 1696	2188	rundll32.exe	37
PID 2188 wrote to memory of 1696	2188	rundll32.exe	37
PID 2188 wrote to memory of 1696	2188	rundll32.exe	37
PID 2188 wrote to memory of 1696	2188	rundll32.exe	37
PID 1108 wrote to memory of 2800	1108	taskeng.exe	38
PID 1108 wrote to memory of 2800	1108	taskeng.exe	38
PID 1108 wrote to memory of 2800	1108	taskeng.exe	38
PID 1108 wrote to memory of 2800	1108	taskeng.exe	38
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 2460 wrote to memory of 1544	2460	Utsysc.exe	39
PID 1544 wrote to memory of 1652	1544	rundll32.exe	40
PID 1544 wrote to memory of 1652	1544	rundll32.exe	40
PID 1544 wrote to memory of 1652	1544	rundll32.exe	40
PID 1544 wrote to memory of 1652	1544	rundll32.exe	40
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 2460 wrote to memory of 432	2460	Utsysc.exe	41
PID 432 wrote to memory of 1260	432	rundll32.exe	42
PID 432 wrote to memory of 1260	432	rundll32.exe	42
PID 432 wrote to memory of 1260	432	rundll32.exe	42
PID 432 wrote to memory of 1260	432	rundll32.exe	42

C:\Users\Admin\AppData\Local\Temp\b24cd81963b57556ae1bd102ca8ee22a.exe
"C:\Users\Admin\AppData\Local\Temp\b24cd81963b57556ae1bd102ca8ee22a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2592
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:1696
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:1652
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:1260

C:\Windows\system32\taskeng.exe
taskeng.exe {5D675DE1-94F9-40F1-A9C2-27E2A00F6E68} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  2⤵
  - Executes dropped EXE
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\603059206200

Filesize
68KB

MD5
9acc816f35570eb90e89793c44e8c3c2

SHA1
ab48f77f42db57f0d7195ebdf8dc1547729a091c

SHA256
b1013ba96beefc0c960d009fbe2ae6275b926202472d929055d412d9e452df9b

SHA512
20caba6a3fb25988f05f856e291412611ffbb1ad87b693506299b8dc6e572a86a2535730b8dcf34cfe22f07bbae4e1053a12e036c1ee6dc2c3f76f9169585535

Download Submit
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe

Filesize
482KB

MD5
b24cd81963b57556ae1bd102ca8ee22a

SHA1
e8c36efb9a650fe745dda09415d2a5d0813a7619

SHA256
252850b3ba00d2467c4388bc99ce5c14abc78c21aba87062760bbb3d9aaf1df8

SHA512
59198a8493f01a61d58eadfec5a96d97b96e0bb78e9a0776638fd02a53b7671e47d53254f2751801c548af65bfdceb7b6928da104ab3a53e35585ec36e5fb158

Download Submit
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe

Filesize
295KB

MD5
140f1b8714120332855be65514d4f155

SHA1
24a0ffa209fc76a485025784a8ad2ea4d31050a2

SHA256
a1b3fd00e3652c30c30d49c3054ff71e113a6d62e4b0e6f7fadc2b8d5e40410b

SHA512
f47d6ae5e04825d7ad901593807e311b37fd1a6a9fd0f9e7b2f2506812acd47531d2e72f7692cbe802689459d192ca8c2d023863a94d30c8a43dda49473b0cfa

Download Submit
C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll

Filesize
400KB

MD5
ef69695087bd182678db21b230b33754

SHA1
48fcb6bbae316b839e7f5f409b0748fcbd8e88c2

SHA256
5c04ee3746397451fc77706a7c3b4b1f8b8bb57d20136555be4dae218dffe341

SHA512
7a4332c23128889693e10d4e43178de0cac7736e5a0ab1f25053f57d3b5d846b97804b74d6d86ca932398e37127bba7b655951509a226452cd4eb198c2e90aab

Download Submit
memory/584-45-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/584-46-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/2424-18-0x00000000002F0000-0x000000000035F000-memory.dmp

Filesize
444KB

Download
memory/2424-4-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2424-2-0x00000000002F0000-0x000000000035F000-memory.dmp

Filesize
444KB

Download
memory/2424-3-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2424-17-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/2424-1-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/2424-16-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2460-27-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2460-40-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2460-39-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/2460-21-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2460-20-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/2460-67-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2460-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2460-70-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2800-65-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2800-66-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/2800-69-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads