amadey | ab4266beccfd9680846605cae4639ad76fb624622e019cd99efc3821213f6bf1

General

Target

761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
Size

712KB
MD5

761fd3f46be0c4b7440fc719a88495ec
SHA1

b49e740f68fc8882939111dc6a0b1bf27d738b51
SHA256

ab4266beccfd9680846605cae4639ad76fb624622e019cd99efc3821213f6bf1
SHA512

a1845e618b67c89cd6e958a4b2f4f4f46bb2b8b622df13bb7ba1568e349d29e19d62b2e3dc62589bc32db265c9d1caa2c2ca03efc84f463feded1a6cc028f15f
SSDEEP

12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

1.99

C2

217.8.117.41/nbDcw2d/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

2228 bdif.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1804 schtasks.exe
3660 schtasks.exe
NTFS ADS 1 IoCs

Processes:

761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe

description ioc process

File created \??\c:\programdata\44def37582\bdif.exe:Zone.Identifier 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exebdif.exe

pid process

4068 761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
2228 bdif.exe

pid	process
2228	bdif.exe

pid	process
1804	schtasks.exe
3660	schtasks.exe

description	ioc	process
File created	\??\c:\programdata\44def37582\bdif.exe:Zone.Identifier	761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe

pid	process
4068	761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
2228	bdif.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exebdif.execmd.execmd.exe

description	pid	process	target process
PID 4068 wrote to memory of 2228	4068	761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe	bdif.exe
PID 4068 wrote to memory of 2228	4068	761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe	bdif.exe
PID 4068 wrote to memory of 2228	4068	761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe	bdif.exe
PID 2228 wrote to memory of 1976	2228	bdif.exe	cmd.exe
PID 2228 wrote to memory of 1976	2228	bdif.exe	cmd.exe
PID 2228 wrote to memory of 1976	2228	bdif.exe	cmd.exe
PID 2228 wrote to memory of 64	2228	bdif.exe	cmd.exe
PID 2228 wrote to memory of 64	2228	bdif.exe	cmd.exe
PID 2228 wrote to memory of 64	2228	bdif.exe	cmd.exe
PID 2228 wrote to memory of 4592	2228	bdif.exe	REG.exe
PID 2228 wrote to memory of 4592	2228	bdif.exe	REG.exe
PID 2228 wrote to memory of 4592	2228	bdif.exe	REG.exe
PID 2228 wrote to memory of 3896	2228	bdif.exe	REG.exe
PID 2228 wrote to memory of 3896	2228	bdif.exe	REG.exe
PID 2228 wrote to memory of 3896	2228	bdif.exe	REG.exe
PID 1976 wrote to memory of 1804	1976	cmd.exe	schtasks.exe
PID 1976 wrote to memory of 1804	1976	cmd.exe	schtasks.exe
PID 1976 wrote to memory of 1804	1976	cmd.exe	schtasks.exe
PID 64 wrote to memory of 3660	64	cmd.exe	schtasks.exe
PID 64 wrote to memory of 3660	64	cmd.exe	schtasks.exe
PID 64 wrote to memory of 3660	64	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\761fd3f46be0c4b7440fc719a88495ec_JaffaCakes118.exe"
1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068

\??\c:\programdata\44def37582\bdif.exe
c:\programdata\44def37582\bdif.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
4⤵
- Creates scheduled task(s)
PID:1804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
4⤵
- Creates scheduled task(s)
PID:3660

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def37582
3⤵
PID:4592

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def37582
3⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44def37582\bdif.exe
Filesize
712KB

MD5
761fd3f46be0c4b7440fc719a88495ec

SHA1
b49e740f68fc8882939111dc6a0b1bf27d738b51

SHA256
ab4266beccfd9680846605cae4639ad76fb624622e019cd99efc3821213f6bf1

SHA512
a1845e618b67c89cd6e958a4b2f4f4f46bb2b8b622df13bb7ba1568e349d29e19d62b2e3dc62589bc32db265c9d1caa2c2ca03efc84f463feded1a6cc028f15f

Download Submit
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2228-26-0x0000000002190000-0x00000000021B5000-memory.dmp

Filesize
148KB

Download
memory/2228-22-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/2228-45-0x0000000002150000-0x0000000002158000-memory.dmp

Filesize
32KB

Download
memory/4068-0-0x0000000000890000-0x00000000008A0000-memory.dmp

Filesize
64KB

Download
memory/4068-5-0x0000000000880000-0x000000000088D000-memory.dmp

Filesize
52KB

Download
memory/4068-4-0x00000000022C0000-0x00000000022E5000-memory.dmp

Filesize
148KB

Download
memory/4068-21-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads