amadey | fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb

General

Target

fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe
Size

9.0MB
MD5

12e8f6cd7924fdf8d5557c2f2e4cd3e4
SHA1

c9d25c9007480dcdc7dc49b519dd2f61c5a5b22a
SHA256

fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb
SHA512

31b322f3f18892831ba1c24dd0eccefbc84daa7894749cf6bb1ba06558cc7f8ae248744fa0e0946beb56eb34048f6d34a1fb9ceedb9d5ea00e2ff796e6249cc0
SSDEEP

196608:NA/TcGrPnA36xgX6OtTJ/jKcoL7P50dkmkjk9hhWZovwMJ+2t:Nuc70yiJFC1oMht

Score

10^/10

amadey c15c21 discovery trojan

Malware Config

Extracted

Family

amadey

Version

5.03

Botnet

c15c21

C2

http://45.93.20.135

Attributes

install_dir
12a728aeec
install_file
Gxtuum.exe
strings_key
5f9278bece2d0777966f092ec032e601
url_paths
/5nDshOg3cwA/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	4816	rundll32.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Gxtuum.exe

Executes dropped EXE 4 IoCs

pid	Process
3300	Gxtuum.exe
4840	Gxtuum.exe
3764	Gxtuum.exe
856	Gxtuum.exe

Loads dropped DLL 1 IoCs

pid	Process
4816	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Gxtuum.job	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3076	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe
3076	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe
3300	Gxtuum.exe
3300	Gxtuum.exe
4840	Gxtuum.exe
4840	Gxtuum.exe
3764	Gxtuum.exe
3764	Gxtuum.exe
856	Gxtuum.exe
856	Gxtuum.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3076	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3300	3076	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe	86
PID 3076 wrote to memory of 3300	3076	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe	86
PID 3076 wrote to memory of 3300	3076	fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe	86
PID 3300 wrote to memory of 4816	3300	Gxtuum.exe	100
PID 3300 wrote to memory of 4816	3300	Gxtuum.exe	100
PID 3300 wrote to memory of 4816	3300	Gxtuum.exe	100

C:\Users\Admin\AppData\Local\Temp\fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe
"C:\Users\Admin\AppData\Local\Temp\fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8ed54a5ebdec82\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4816

C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3764

C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\12a728aeec\Gxtuum.exe

Filesize
9.0MB

MD5
12e8f6cd7924fdf8d5557c2f2e4cd3e4

SHA1
c9d25c9007480dcdc7dc49b519dd2f61c5a5b22a

SHA256
fbf54cdbc5ee913a632567a80d1468822599d9a608c6e14eb0b2ffad0247f8fb

SHA512
31b322f3f18892831ba1c24dd0eccefbc84daa7894749cf6bb1ba06558cc7f8ae248744fa0e0946beb56eb34048f6d34a1fb9ceedb9d5ea00e2ff796e6249cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\932230532004

Filesize
77KB

MD5
d305292265ebaff7811a6f5afba330dd

SHA1
231d52db747f4f08bf26d7da00e1c7cecc7e0743

SHA256
3fdcd2dffc9461edf263535a194e40d3cd23e606d6f7acc975da3b906110e6a4

SHA512
534f5ed4f4ae2c4a7bb77f4b1ef9e4264b175a4c8778f8500808c696b8ace27b4e70f2afafe86475d5199d7d6c57cd5a14df4ff2d5e29ed9541c63e13d2a057f

Download Submit
C:\Users\Admin\AppData\Roaming\8ed54a5ebdec82\clip64.dll

Filesize
124KB

MD5
36850a3e00a8d66652f4e731b108bbf4

SHA1
a0a87f8db829471606d8dc0a0caf2d55242fff92

SHA256
17e13d82e219ea1553dcd3c15223494b6425357b6fcb27d9ac6a7697f56a19d6

SHA512
d9e8338ba109af9cad5b05ce3ae6e3d273b68e28c0d29a513e392ed86030c4d05fe66fd86743f3b62260e1cc235a2aab77457f02316a3ea4aceebecad42b6994

Download Submit
memory/856-57-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/856-56-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/3076-3-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3076-1-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/3076-5-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3076-6-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3076-18-0x000000000046C000-0x0000000000959000-memory.dmp

Filesize
4.9MB

Download
memory/3076-19-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3076-0-0x000000000046C000-0x0000000000959000-memory.dmp

Filesize
4.9MB

Download
memory/3300-24-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3300-26-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3300-36-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3300-25-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3300-20-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/3300-21-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/3764-51-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/3764-52-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download
memory/4840-40-0x0000000000400000-0x0000000001256000-memory.dmp

Filesize
14.3MB

Download

Analysis

Sharing