amadey | 21675cef02c5d516a93f59d70c16d083ffa8be9792fa8f40e53212708d321c6d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe
Size

320KB
MD5

eaf5487e09db15c107eafb82a3c3e30d
SHA1

c3f95ac8ee1b6e53dc1bed7dc4dcf11462f6555a
SHA256

cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389
SHA512

0dee5f7a105b6cdd2114a7fe54270cc7c21f45d837671953ff6306ece85a51574902ef482f79636ebd7ef1e35d6b5fdf9616e2a2d5e3a0b408e1ada8a8ac135c
SSDEEP

6144:KWy+bnr+Fp0yN90QE6rKEP3ve7yRfsK6KRFjEXtaBv7hf5c2ww4/:SMrly90UKU/e7RK6KRdEXYp79q2wx/

Score

10^/10

amadey mystic 59b440 persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m6680289.exe	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

l5564119.exesaves.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	l5564119.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 5 IoCs

Processes:

l5564119.exesaves.exem6680289.exesaves.exesaves.exe

pid process

3156 l5564119.exe
2420 saves.exe
1748 m6680289.exe
1700 saves.exe
3156 saves.exe

pid	process
3156	l5564119.exe
2420	saves.exe
1748	m6680289.exe
1700	saves.exe
3156	saves.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

624 schtasks.exe

pid	process
624	schtasks.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exel5564119.exesaves.execmd.exe

description	pid	process	target process
PID 5108 wrote to memory of 3156	5108	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe	l5564119.exe
PID 5108 wrote to memory of 3156	5108	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe	l5564119.exe
PID 5108 wrote to memory of 3156	5108	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe	l5564119.exe
PID 3156 wrote to memory of 2420	3156	l5564119.exe	saves.exe
PID 3156 wrote to memory of 2420	3156	l5564119.exe	saves.exe
PID 3156 wrote to memory of 2420	3156	l5564119.exe	saves.exe
PID 5108 wrote to memory of 1748	5108	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe	m6680289.exe
PID 5108 wrote to memory of 1748	5108	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe	m6680289.exe
PID 5108 wrote to memory of 1748	5108	cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe	m6680289.exe
PID 2420 wrote to memory of 624	2420	saves.exe	schtasks.exe
PID 2420 wrote to memory of 624	2420	saves.exe	schtasks.exe
PID 2420 wrote to memory of 624	2420	saves.exe	schtasks.exe
PID 2420 wrote to memory of 1544	2420	saves.exe	cmd.exe
PID 2420 wrote to memory of 1544	2420	saves.exe	cmd.exe
PID 2420 wrote to memory of 1544	2420	saves.exe	cmd.exe
PID 1544 wrote to memory of 1404	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 1404	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 1404	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 4208	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 4208	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 4208	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 3628	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 3628	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 3628	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 5116	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 5116	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 5116	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 1948	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 1948	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 1948	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 2528	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 2528	1544	cmd.exe	cacls.exe
PID 1544 wrote to memory of 2528	1544	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe
"C:\Users\Admin\AppData\Local\Temp\cf82c35e0a5a0683a1f51d3806ea0eb39a59d81fd4fc110c9762ff99d4e3f389.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l5564119.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l5564119.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
4⤵
- Creates scheduled task(s)
PID:624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1404

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:N"
5⤵
PID:4208

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:R" /E
5⤵
PID:3628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:5116

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:N"
5⤵
PID:1948

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:R" /E
5⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m6680289.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m6680289.exe
2⤵
- Executes dropped EXE
PID:1748

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1700

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3156

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l5564119.exe
Filesize
336KB

MD5
4ee7c7cb31fab1b3efb981cae58ac3cc

SHA1
2f2c41dfdc4b2bdf80663f98bdceebcef191ae4c

SHA256
e35f2035103c30317b9872c66ed20b7767da2e28ecea038f29819fa3de2553a5

SHA512
58bd57df900e5cdb53073b194346f515f2f8c14d893b8abe88d191ba62580230bf068ff6356e96fd164196c20c34aceced249874cd61427b96261e65ca2fe348

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m6680289.exe
Filesize
141KB

MD5
316a709af7f726dcbe3b11bb9e523602

SHA1
eb4d896f5cfcd25a7b408e3421db6c8ab090d866

SHA256
85e741e85dc0305b336dbc174ec2a1bc379b93146b2836fb4dcb43923780a46d

SHA512
db143837eb0cd5f75e35dacba18b239680df56c126586f1438e2d59b487dfcb3d49351f0d88fdca3ed8640b7cb3183de5f41eafd6e21346645b7fa58fcd95b12

Download Submit