amadey | be64ff756b067caa0e75330b7c3eda14ac836952bf892424a3688bd3cc546d19

General

Target

0ab81cf469e686dd487e750c15691b25.exe
Size

12.2MB
MD5

0ab81cf469e686dd487e750c15691b25
SHA1

0a9fad134e266ac396ebe51dbcffcc0fbbb9bcd1
SHA256

be64ff756b067caa0e75330b7c3eda14ac836952bf892424a3688bd3cc546d19
SHA512

62564259efcad1ab33372682ea1ebb8a1dbc97c460280f36ecd88f8455f59938af1b635976c0cdcd43fe15fa1e14fae7f0f792bd00ea212ccb0f181bf114913d
SSDEEP

393216:rKx81sE0EZgkLKNihH+MUoczZPmnTK0YfJW6HKDaFuK0qIxewx3kowTnUKlL70KA:3qcvYfsBtUwx3kowTdL70KfdAtIexX

Score

10^/10

amadey 9c88c6 discovery trojan

Malware Config

Extracted

Family

amadey

Version

5.04

Botnet

9c88c6

Attributes

install_dir
c0461fd49a
install_file
Gxtuum.exe
strings_key
1b8c0142f1804d4531696e70270c2eee
url_paths
/pLQvfD4d5/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 2560	1700	0ab81cf469e686dd487e750c15691b25.exe	28

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Magent Helper.job	more.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2624	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ab81cf469e686dd487e750c15691b25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1700	0ab81cf469e686dd487e750c15691b25.exe
1700	0ab81cf469e686dd487e750c15691b25.exe
2560	more.com
2560	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1700	0ab81cf469e686dd487e750c15691b25.exe
2560	more.com

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2560	1700	0ab81cf469e686dd487e750c15691b25.exe	28
PID 1700 wrote to memory of 2560	1700	0ab81cf469e686dd487e750c15691b25.exe	28
PID 1700 wrote to memory of 2560	1700	0ab81cf469e686dd487e750c15691b25.exe	28
PID 1700 wrote to memory of 2560	1700	0ab81cf469e686dd487e750c15691b25.exe	28
PID 1700 wrote to memory of 2560	1700	0ab81cf469e686dd487e750c15691b25.exe	28
PID 2560 wrote to memory of 2624	2560	more.com	32
PID 2560 wrote to memory of 2624	2560	more.com	32
PID 2560 wrote to memory of 2624	2560	more.com	32
PID 2560 wrote to memory of 2624	2560	more.com	32
PID 2560 wrote to memory of 2624	2560	more.com	32
PID 2560 wrote to memory of 2624	2560	more.com	32
PID 2624 wrote to memory of 2604	2624	explorer.exe	33
PID 2624 wrote to memory of 2604	2624	explorer.exe	33
PID 2624 wrote to memory of 2604	2624	explorer.exe	33
PID 2624 wrote to memory of 2604	2624	explorer.exe	33

C:\Users\Admin\AppData\Local\Temp\0ab81cf469e686dd487e750c15691b25.exe
"C:\Users\Admin\AppData\Local\Temp\0ab81cf469e686dd487e750c15691b25.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 156
      4⤵
      Program crash
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6f40e79f

Filesize
1.3MB

MD5
5aeccffb0ecefe9f23e0695076ec94a9

SHA1
32ed11f0a25bbb5200fe46058e58b2521b76810f

SHA256
03a50096cdff050d30edc026bfc089a936f8165bb92a8ee726d5487228ff17be

SHA512
523a038eb60531021239a338121b377ce77e843c4974b17263b4d8dbb39e06f9920c5a4135309cd6e0a8816be0945fcf7200e136f7f0d2406fe195f4cb2cbc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\72a93c5d

Filesize
1.2MB

MD5
85fc3b6ecdbae05b5a6c7dd6e853943d

SHA1
ea0c87a79cbd0054cbe204d0c98e9f0affdecfdc

SHA256
8d76492842bf10196a1b806e3ecb941b53e45dd0ac8335a29df14fcfe843f276

SHA512
7965ea0d0414c55e51e60e9d6dbfc14ff54c485c5115c9a09bb9eed859f330617ddcc103a39a80e7a6500e070fedce066a299929c980dcb3ecf97e3b1b6163d9

Download Submit
memory/1700-0-0x0000000000400000-0x00000000010CB000-memory.dmp

Filesize
12.8MB

Download
memory/1700-6-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/1700-7-0x0000000077210000-0x00000000773B9000-memory.dmp

Filesize
1.7MB

Download
memory/1700-9-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/1700-8-0x0000000074383000-0x0000000074385000-memory.dmp

Filesize
8KB

Download
memory/1700-10-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2560-13-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2560-14-0x0000000077210000-0x00000000773B9000-memory.dmp

Filesize
1.7MB

Download
memory/2560-18-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2560-16-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2560-20-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2560-21-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2560-25-0x0000000074370000-0x00000000744E4000-memory.dmp

Filesize
1.5MB

Download
memory/2624-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2624-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2624-26-0x0000000000080000-0x000000000010D000-memory.dmp

Filesize
564KB

Download
memory/2624-28-0x0000000000080000-0x000000000010D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing