amadey | be64ff756b067caa0e75330b7c3eda14ac836952bf892424a3688bd3cc546d19

General

Target

0ab81cf469e686dd487e750c15691b25.exe
Size

12.2MB
MD5

0ab81cf469e686dd487e750c15691b25
SHA1

0a9fad134e266ac396ebe51dbcffcc0fbbb9bcd1
SHA256

be64ff756b067caa0e75330b7c3eda14ac836952bf892424a3688bd3cc546d19
SHA512

62564259efcad1ab33372682ea1ebb8a1dbc97c460280f36ecd88f8455f59938af1b635976c0cdcd43fe15fa1e14fae7f0f792bd00ea212ccb0f181bf114913d
SSDEEP

393216:rKx81sE0EZgkLKNihH+MUoczZPmnTK0YfJW6HKDaFuK0qIxewx3kowTnUKlL70KA:3qcvYfsBtUwx3kowTdL70KfdAtIexX

Score

10^/10

amadey 9c88c6 discovery trojan

Malware Config

Extracted

Family

amadey

Version

5.04

Botnet

9c88c6

Attributes

install_dir
c0461fd49a
install_file
Gxtuum.exe
strings_key
1b8c0142f1804d4531696e70270c2eee
url_paths
/pLQvfD4d5/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 2852	4816	0ab81cf469e686dd487e750c15691b25.exe	82

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Magent Helper.job	more.com

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ab81cf469e686dd487e750c15691b25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4816	0ab81cf469e686dd487e750c15691b25.exe
4816	0ab81cf469e686dd487e750c15691b25.exe
2852	more.com
2852	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4816	0ab81cf469e686dd487e750c15691b25.exe
2852	more.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2852	4816	0ab81cf469e686dd487e750c15691b25.exe	82
PID 4816 wrote to memory of 2852	4816	0ab81cf469e686dd487e750c15691b25.exe	82
PID 4816 wrote to memory of 2852	4816	0ab81cf469e686dd487e750c15691b25.exe	82
PID 4816 wrote to memory of 2852	4816	0ab81cf469e686dd487e750c15691b25.exe	82
PID 2852 wrote to memory of 1636	2852	more.com	94
PID 2852 wrote to memory of 1636	2852	more.com	94
PID 2852 wrote to memory of 1636	2852	more.com	94
PID 2852 wrote to memory of 1636	2852	more.com	94
PID 2852 wrote to memory of 1636	2852	more.com	94

C:\Users\Admin\AppData\Local\Temp\0ab81cf469e686dd487e750c15691b25.exe
"C:\Users\Admin\AppData\Local\Temp\0ab81cf469e686dd487e750c15691b25.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f41d133c

Filesize
1.3MB

MD5
5aeccffb0ecefe9f23e0695076ec94a9

SHA1
32ed11f0a25bbb5200fe46058e58b2521b76810f

SHA256
03a50096cdff050d30edc026bfc089a936f8165bb92a8ee726d5487228ff17be

SHA512
523a038eb60531021239a338121b377ce77e843c4974b17263b4d8dbb39e06f9920c5a4135309cd6e0a8816be0945fcf7200e136f7f0d2406fe195f4cb2cbc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f910dcc1

Filesize
1.2MB

MD5
b47a12cd6044296a61450a3ab5e029c8

SHA1
a4f167d96622d82a492b56c1f6ac457f9a82acd2

SHA256
6f58ec57ffd2bfd855a9bc8a7864f295f92a0c460989e34790209c4e55e825d6

SHA512
c83b965ec3762c1f57cbbac5c467aee6d5a0551c7ae7eacb70b27711d0b4e588ee5f560c4e87aeadd838bd76e9b7b5b939f030f841d8f21014e31a5725003ffa

Download Submit
memory/1636-29-0x0000000000840000-0x00000000008CD000-memory.dmp

Filesize
564KB

Download
memory/1636-28-0x00007FFF894F0000-0x00007FFF896E5000-memory.dmp

Filesize
2.0MB

Download
memory/2852-16-0x00007FFF894F0000-0x00007FFF896E5000-memory.dmp

Filesize
2.0MB

Download
memory/2852-27-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/2852-23-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/2852-22-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/2852-20-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/2852-18-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/2852-14-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/4816-8-0x0000000074C53000-0x0000000074C55000-memory.dmp

Filesize
8KB

Download
memory/4816-12-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/4816-11-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/4816-10-0x0000000074C53000-0x0000000074C55000-memory.dmp

Filesize
8KB

Download
memory/4816-9-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download
memory/4816-0-0x0000000000490000-0x000000000115B000-memory.dmp

Filesize
12.8MB

Download
memory/4816-7-0x00007FFF894F0000-0x00007FFF896E5000-memory.dmp

Filesize
2.0MB

Download
memory/4816-6-0x0000000074C40000-0x0000000074DBB000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing