Analysis
- max time kernel
3s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/01/2024, 01:38
General
- Target ama.exe
- Size 6.3MB
- Sample240104-b2dx8aeedn
- SHA256 24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15
Malware Config
Extracted
-
amadey
-
4.13
-
http://185.172.128.5
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ama.exe"C:\Users\Admin\AppData\Local\Temp\ama.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main4⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\497073144238_Desktop.zip' -CompressionLevel Optimal5⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\clip64.dll, Main3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/852-33-0x0000000000400000-0x000000000103B000-memory.dmp
memory/852-109-0x0000000000400000-0x000000000103B000-memory.dmp
memory/852-97-0x0000000000400000-0x000000000103B000-memory.dmp
memory/852-62-0x0000000000400000-0x000000000103B000-memory.dmp
memory/852-44-0x00000000012A0000-0x00000000012A1000-memory.dmp
memory/852-45-0x00000000012B0000-0x00000000012B1000-memory.dmp
memory/852-46-0x0000000000400000-0x000000000103B000-memory.dmp
memory/852-47-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/852-48-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/852-49-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/852-50-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/852-38-0x0000000000400000-0x000000000103B000-memory.dmp
memory/852-32-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-128-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
memory/1216-126-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/1216-117-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-113-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-112-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-111-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-123-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/1216-124-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/1216-125-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/1216-132-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-130-0x0000000000400000-0x000000000103B000-memory.dmp
memory/1216-127-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/1880-87-0x000001FEA2E40000-0x000001FEA2E50000-memory.dmp
memory/1880-85-0x00007FFE08C70000-0x00007FFE09731000-memory.dmp
memory/1880-89-0x000001FE8ACA0000-0x000001FE8ACAA000-memory.dmp
memory/1880-95-0x00007FFE08C70000-0x00007FFE09731000-memory.dmp
memory/1880-88-0x000001FEA3B80000-0x000001FEA3B92000-memory.dmp
memory/1880-86-0x000001FEA2E40000-0x000001FEA2E50000-memory.dmp
memory/1880-84-0x000001FE8AC60000-0x000001FE8AC82000-memory.dmp
memory/3488-140-0x0000000000400000-0x000000000103B000-memory.dmp
memory/3488-141-0x0000000000400000-0x000000000103B000-memory.dmp
memory/3488-159-0x0000000000400000-0x000000000103B000-memory.dmp
memory/3488-162-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-6-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-0-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-1-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-2-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-31-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-13-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/4968-18-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/4968-17-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/4968-16-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/4968-15-0x0000000000400000-0x000000000103B000-memory.dmp
memory/4968-14-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/4968-12-0x00000000011E0000-0x00000000011E1000-memory.dmp