amadey | 77003f2cbc1dd4626f248eee3cdf0255ecfacf1d7f17bce45c33eda218b5e3fa

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe
Size 712KB
Sample240613-qf96vszfpd
SHA256 77003f2cbc1dd4626f248eee3cdf0255ecfacf1d7f17bce45c33eda218b5e3fa
MD5 a5b7f46cabc128f02edca8227ec37943
SHA1 a1e8f602038cb805c98c876dff4f65e4fbaf0725
SHA512 91b7fe46c7c885ad6b2facba74eab65e7812ec89940a93e1ba11fbce4bc1c2764c3f4d80ed3045b54cc835c41f317852a26f66266054a7fbb470ab72a8b74365
SSDEEP 12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

1.99

217.8.117.41/nbDcw2d/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 1 IoCs

pid	Process
1632	bdif.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1556	schtasks.exe
2328	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\44def37582\bdif.exe:Zone.Identifier	a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4612	a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe
1632	bdif.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1632	4612	a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe	81
PID 4612 wrote to memory of 1632	4612	a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe	81
PID 4612 wrote to memory of 1632	4612	a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe	81
PID 1632 wrote to memory of 4304	1632	bdif.exe	92
PID 1632 wrote to memory of 4480	1632	bdif.exe	93
PID 1632 wrote to memory of 4480	1632	bdif.exe	93
PID 1632 wrote to memory of 4304	1632	bdif.exe	92
PID 1632 wrote to memory of 4480	1632	bdif.exe	93
PID 1632 wrote to memory of 4304	1632	bdif.exe	92
PID 1632 wrote to memory of 2996	1632	bdif.exe	95
PID 1632 wrote to memory of 2996	1632	bdif.exe	95
PID 1632 wrote to memory of 2996	1632	bdif.exe	95
PID 1632 wrote to memory of 2556	1632	bdif.exe	94
PID 1632 wrote to memory of 2556	1632	bdif.exe	94
PID 1632 wrote to memory of 2556	1632	bdif.exe	94
PID 4480 wrote to memory of 1556	4480	cmd.exe	100
PID 4480 wrote to memory of 1556	4480	cmd.exe	100
PID 4480 wrote to memory of 1556	4480	cmd.exe	100
PID 4304 wrote to memory of 2328	4304	cmd.exe	101
PID 4304 wrote to memory of 2328	4304	cmd.exe	101
PID 4304 wrote to memory of 2328	4304	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a5b7f46cabc128f02edca8227ec37943_JaffaCakes118.exe"
1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612
- \??\c:\programdata\44def37582\bdif.exe
  c:\programdata\44def37582\bdif.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN 83bb50ad72ec066ba3b2332b06c6d86c /TR c:\programdata\44def37582\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:1556
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def37582
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\44def37582
    3⤵
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bdif.exe

Path C:\ProgramData\44def37582\bdif.exe
Size 712KB
SHA256 77003f2cbc1dd4626f248eee3cdf0255ecfacf1d7f17bce45c33eda218b5e3fa
MD5 a5b7f46cabc128f02edca8227ec37943
SHA1 a1e8f602038cb805c98c876dff4f65e4fbaf0725
SHA512 91b7fe46c7c885ad6b2facba74eab65e7812ec89940a93e1ba11fbce4bc1c2764c3f4d80ed3045b54cc835c41f317852a26f66266054a7fbb470ab72a8b74365
SSDEEP 12288:W6qx+GgJOpEheBWpJ0NjYZZRKFdCFqPryQ32E9i/4B:8QlmWpJGYZZ4FsFEpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1632-26-0x0000000002190000-0x00000000021B5000-memory.dmp

Download

memory/1632-22-0x0000000002180000-0x0000000002190000-memory.dmp

Download

memory/1632-45-0x0000000000630000-0x0000000000638000-memory.dmp

Download

memory/4612-0-0x00000000005D0000-0x00000000005E0000-memory.dmp

Download

memory/4612-4-0x00000000005E0000-0x0000000000605000-memory.dmp

Download

memory/4612-17-0x00000000005C0000-0x00000000005CD000-memory.dmp

Download

memory/4612-20-0x00000000005B0000-0x00000000005B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads