Analysis
- max time kernel
5s - max time network
129s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
04/01/2024, 01:38
General
- Target ama.exe
- Size 6.3MB
- Sample240104-b2dx8aeedn
- SHA256 24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15
Malware Config
Extracted
-
amadey
-
4.13
-
http://185.172.128.5
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ama.exe"C:\Users\Admin\AppData\Local\Temp\ama.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main3⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\clip64.dll, Main3⤵
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {234F9362-A1F1-4081-AFF1-B3F60A543D96} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe2⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\627615824406_Desktop.zip' -CompressionLevel Optimal2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Utsysc.exe
memory/756-0-0x0000000000400000-0x000000000103B000-memory.dmp
memory/756-1-0x0000000000400000-0x000000000103B000-memory.dmp
memory/756-2-0x0000000000400000-0x000000000103B000-memory.dmp
memory/756-6-0x0000000000400000-0x000000000103B000-memory.dmp
memory/756-31-0x0000000000260000-0x0000000000261000-memory.dmp
memory/756-29-0x0000000000260000-0x0000000000261000-memory.dmp
memory/756-26-0x0000000000250000-0x0000000000251000-memory.dmp
memory/756-34-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/756-42-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/756-40-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/756-37-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/756-36-0x0000000000400000-0x000000000103B000-memory.dmp
memory/756-24-0x0000000000250000-0x0000000000251000-memory.dmp
memory/756-45-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/756-21-0x0000000000240000-0x0000000000241000-memory.dmp
memory/756-19-0x0000000000240000-0x0000000000241000-memory.dmp
memory/756-17-0x0000000000240000-0x0000000000241000-memory.dmp
memory/756-58-0x0000000005070000-0x0000000005CAB000-memory.dmp
memory/756-59-0x0000000005070000-0x0000000005CAB000-memory.dmp
memory/756-57-0x0000000000400000-0x000000000103B000-memory.dmp
memory/756-16-0x0000000000230000-0x0000000000231000-memory.dmp
memory/756-14-0x0000000000230000-0x0000000000231000-memory.dmp
memory/756-12-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1220-116-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1220-117-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1220-162-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1220-139-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2292-60-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2292-81-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2292-79-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2292-84-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2292-76-0x0000000000220000-0x0000000000221000-memory.dmp
memory/2292-61-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2292-66-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2292-74-0x0000000000220000-0x0000000000221000-memory.dmp
memory/2292-112-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2508-220-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2508-266-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2508-249-0x0000000000400000-0x000000000103B000-memory.dmp
memory/2508-221-0x0000000000400000-0x000000000103B000-memory.dmp
memory/3052-186-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp
memory/3052-190-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/3052-189-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp
memory/3052-187-0x0000000001E70000-0x0000000001E78000-memory.dmp
memory/3052-185-0x000000001B700000-0x000000001B9E2000-memory.dmp
memory/3052-193-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp
memory/3052-192-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/3052-191-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/3052-188-0x0000000002960000-0x00000000029E0000-memory.dmp