amadey | 89075466857b6ae98f929587425faa6817caf02d546b6f0ee53b966127d44b29

General

Target

770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
Size

712KB
MD5

770e01ce4d963b40fe2ccb68797da7a8
SHA1

3b93283b990b8215967c29f5bc784c4d85d1c2e4
SHA256

89075466857b6ae98f929587425faa6817caf02d546b6f0ee53b966127d44b29
SHA512

affedb9c56960fb7ca1efd63e899d8e2d075ee6d070d1f6074b5708cad841804adaffb1fbb15a6b0981064732c6dd7af392801589266877d4cc7f512ccee0ac9
SSDEEP

12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

1.99

C2

217.8.117.41/nbDcw2d/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

2896 bdif.exe
Loads dropped DLL 2 IoCs

Processes:

770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe

pid process

1712 770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
1712 770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1900 schtasks.exe
1200 schtasks.exe
NTFS ADS 1 IoCs

Processes:

770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe

description ioc process

File created \??\c:\programdata\44def37582\bdif.exe:Zone.Identifier 770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exebdif.exe

pid process

1712 770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
2896 bdif.exe

pid	process
2896	bdif.exe

pid	process
1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe

pid	process
1900	schtasks.exe
1200	schtasks.exe

description	ioc	process
File created	\??\c:\programdata\44def37582\bdif.exe:Zone.Identifier	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe

pid	process
1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
2896	bdif.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exebdif.execmd.execmd.exe

description	pid	process	target process
PID 1712 wrote to memory of 2896	1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe	bdif.exe
PID 1712 wrote to memory of 2896	1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe	bdif.exe
PID 1712 wrote to memory of 2896	1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe	bdif.exe
PID 1712 wrote to memory of 2896	1712	770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe	bdif.exe
PID 2896 wrote to memory of 1120	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1120	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1120	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1120	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1084	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1084	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1084	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1084	2896	bdif.exe	cmd.exe
PID 2896 wrote to memory of 1756	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 1756	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 1756	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 1756	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 832	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 832	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 832	2896	bdif.exe	REG.exe
PID 2896 wrote to memory of 832	2896	bdif.exe	REG.exe
PID 1084 wrote to memory of 1900	1084	cmd.exe	schtasks.exe
PID 1084 wrote to memory of 1900	1084	cmd.exe	schtasks.exe
PID 1084 wrote to memory of 1900	1084	cmd.exe	schtasks.exe
PID 1084 wrote to memory of 1900	1084	cmd.exe	schtasks.exe
PID 1120 wrote to memory of 1200	1120	cmd.exe	schtasks.exe
PID 1120 wrote to memory of 1200	1120	cmd.exe	schtasks.exe
PID 1120 wrote to memory of 1200	1120	cmd.exe	schtasks.exe
PID 1120 wrote to memory of 1200	1120	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\770e01ce4d963b40fe2ccb68797da7a8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- \??\c:\programdata\44def37582\bdif.exe
  c:\programdata\44def37582\bdif.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:1900
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def37582
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def37582
    3⤵
    PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\44def37582\bdif.exe

Filesize
712KB

MD5
770e01ce4d963b40fe2ccb68797da7a8

SHA1
3b93283b990b8215967c29f5bc784c4d85d1c2e4

SHA256
89075466857b6ae98f929587425faa6817caf02d546b6f0ee53b966127d44b29

SHA512
affedb9c56960fb7ca1efd63e899d8e2d075ee6d070d1f6074b5708cad841804adaffb1fbb15a6b0981064732c6dd7af392801589266877d4cc7f512ccee0ac9

Download Submit
memory/1712-0-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1712-3-0x0000000000350000-0x000000000035D000-memory.dmp

Filesize
52KB

Download
memory/1712-5-0x0000000000370000-0x0000000000395000-memory.dmp

Filesize
148KB

Download
memory/2896-25-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2896-29-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads