Analysis
- max time kernel
8s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
03/01/2024, 06:26
General
- Target ama.exe
- Size 4.2MB
- Sample240103-g67c8acbak
- SHA256 7067efc25c133206570865eb8e8063d59894e5a3c457e287ca050d6fc3d182d4
Malware Config
Extracted
-
amadey
-
4.13
-
http://185.172.128.5
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ama.exe"C:\Users\Admin\AppData\Local\Temp\ama.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main4⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\815711207184_Desktop.zip' -CompressionLevel Optimal5⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\clip64.dll, Main3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/548-130-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-155-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-156-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-154-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-153-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-152-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-142-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-151-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-143-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-149-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-150-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-146-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-148-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-147-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-145-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-144-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/548-135-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-132-0x0000000000400000-0x000000000100C000-memory.dmp
memory/548-131-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-39-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-115-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-38-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-43-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-50-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-51-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-52-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-53-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-54-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-55-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-56-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-57-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-58-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-59-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-60-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-61-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-62-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-63-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-69-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-70-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-68-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-77-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-76-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-79-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-78-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/1960-80-0x0000000000400000-0x000000000100C000-memory.dmp
memory/1960-127-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-14-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-16-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-1-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-2-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-5-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-12-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-13-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-0-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-17-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-36-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-37-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-35-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-31-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-23-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-22-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-21-0x0000000000400000-0x000000000100C000-memory.dmp
memory/2980-20-0x0000000077834000-0x0000000077836000-memory.dmp
memory/2980-19-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-15-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/2980-18-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/3668-95-0x000002181DD30000-0x000002181DD52000-memory.dmp
memory/3668-105-0x0000021836070000-0x0000021836080000-memory.dmp
memory/3668-106-0x0000021836070000-0x0000021836080000-memory.dmp
memory/3668-114-0x00007FFF31190000-0x00007FFF31C51000-memory.dmp
memory/3668-107-0x0000021836480000-0x0000021836492000-memory.dmp
memory/3668-108-0x0000021836460000-0x000002183646A000-memory.dmp
memory/3668-103-0x00007FFF31190000-0x00007FFF31C51000-memory.dmp
memory/3668-104-0x0000021836070000-0x0000021836080000-memory.dmp
memory/4308-169-0x0000000000400000-0x000000000100C000-memory.dmp
memory/4308-165-0x0000000000400000-0x000000000100C000-memory.dmp
memory/4308-164-0x0000000000400000-0x000000000100C000-memory.dmp
memory/4308-176-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-179-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-180-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-181-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-182-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-178-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-183-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-177-0x00000000774D0000-0x00000000775C0000-memory.dmp
memory/4308-184-0x0000000000400000-0x000000000100C000-memory.dmp
memory/4308-185-0x0000000000400000-0x000000000100C000-memory.dmp