Analysis
- max time kernel
143s - max time network
153s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
07/01/2024, 16:51
General
- Target 93434f87336ad2bb2c75d64e1ab98572.exe
- Size 7.9MB
- Sample240107-vctf6aaggj
- SHA256 ea895be4bc7006fdb8e25a849c0aa26000c12b25d7a0342890a110ef79f9662f
Malware Config
Extracted
-
amadey
-
4.13
-
http://185.172.128.5
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 13 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 49 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93434f87336ad2bb2c75d64e1ab98572.exe"C:\Users\Admin\AppData\Local\Temp\93434f87336ad2bb2c75d64e1ab98572.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\470981204343_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {78535D70-8422-4CE2-A9DA-39992558D665} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Utsysc.exe
Utsysc.exe
Utsysc.exe
Utsysc.exe
Utsysc.exe
memory/804-95-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/804-121-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/804-6-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/804-8-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/804-10-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/804-13-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/804-15-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/804-18-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/804-20-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/804-23-0x0000000000280000-0x0000000000281000-memory.dmp
memory/804-25-0x0000000000280000-0x0000000000281000-memory.dmp
memory/804-28-0x0000000000290000-0x0000000000291000-memory.dmp
memory/804-30-0x0000000000290000-0x0000000000291000-memory.dmp
memory/804-31-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/804-33-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/804-35-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/804-36-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/804-38-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/804-40-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/804-42-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/804-44-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/804-41-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/804-45-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/804-47-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/804-48-0x0000000000350000-0x0000000000351000-memory.dmp
memory/804-50-0x0000000000350000-0x0000000000351000-memory.dmp
memory/804-52-0x0000000000350000-0x0000000000351000-memory.dmp
memory/804-53-0x0000000000360000-0x0000000000361000-memory.dmp
memory/804-55-0x0000000000360000-0x0000000000361000-memory.dmp
memory/804-57-0x0000000000360000-0x0000000000361000-memory.dmp
memory/804-58-0x0000000000370000-0x0000000000371000-memory.dmp
memory/804-60-0x0000000000370000-0x0000000000371000-memory.dmp
memory/804-62-0x0000000000370000-0x0000000000371000-memory.dmp
memory/804-63-0x0000000000380000-0x0000000000381000-memory.dmp
memory/804-65-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/804-66-0x0000000000380000-0x0000000000381000-memory.dmp
memory/804-3-0x0000000000190000-0x0000000000191000-memory.dmp
memory/804-96-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/804-101-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/804-120-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/804-5-0x0000000000190000-0x0000000000191000-memory.dmp
memory/804-122-0x0000000000A40000-0x0000000000A41000-memory.dmp
memory/804-119-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/804-132-0x0000000000A70000-0x0000000001252000-memory.dmp
memory/804-1-0x0000000000A70000-0x0000000001252000-memory.dmp
memory/804-0-0x0000000000190000-0x0000000000191000-memory.dmp
memory/1708-287-0x0000000002AD0000-0x0000000002B50000-memory.dmp
memory/1708-283-0x000000001B710000-0x000000001B9F2000-memory.dmp
memory/1708-285-0x0000000001D90000-0x0000000001D98000-memory.dmp
memory/1708-290-0x0000000002AD0000-0x0000000002B50000-memory.dmp
memory/1708-289-0x0000000002AD0000-0x0000000002B50000-memory.dmp
memory/1708-292-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp
memory/1708-286-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp
memory/1708-288-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp
memory/1708-291-0x0000000002AD0000-0x0000000002B50000-memory.dmp
memory/1904-546-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/1904-528-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/1904-547-0x0000000000970000-0x0000000000971000-memory.dmp
memory/1904-503-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/1904-550-0x0000000000A50000-0x0000000001232000-memory.dmp
memory/1904-529-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/1904-432-0x0000000000A50000-0x0000000001232000-memory.dmp
memory/1904-549-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2584-428-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2584-352-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2584-399-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/2584-408-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2584-426-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/2584-427-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/2584-429-0x0000000000A50000-0x0000000001232000-memory.dmp
memory/2584-309-0x0000000000A50000-0x0000000001232000-memory.dmp
memory/2584-353-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/2584-397-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2672-215-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2672-150-0x0000000000A50000-0x0000000001232000-memory.dmp
memory/2672-249-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/2672-250-0x0000000000960000-0x0000000000961000-memory.dmp
memory/2672-251-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2672-217-0x0000000077BE0000-0x0000000077BE1000-memory.dmp
memory/2672-231-0x0000000077BDF000-0x0000000077BE0000-memory.dmp
memory/2672-284-0x0000000000A50000-0x0000000001232000-memory.dmp