amadey | cb5b534f0189a845cb43ea11408e4390f3b036d447c3ceedd337c2c88af0cc4c

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify Premium/Setup.exe
Size

630.2MB
MD5

32a4d0a4ab16a702c4a00b41a6d1377e
SHA1

cf9935a37c5477fdd991f50078d0fbe0da51f8df
SHA256

6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf
SHA512

c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf
SSDEEP

6144:TfbOrBANQk+LQ9JfIzgPO6gsURuloFxdPQ:MO//AzgmuqO

Score

10^/10

amadey 563433 discovery trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

563433

http://31.41.244.146

Attributes

install_dir
23e20ad4db
install_file
oneetx.exe
strings_key
3d2ec53af224847a59d1d611532d52aa
url_paths
/u83mfdS2/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 3 IoCs

pid	Process
4600	oneetx.exe
1608	oneetx.exe
1520	oneetx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
3572	4828	WerFault.exe	80
1800	4828	WerFault.exe	80
1940	4828	WerFault.exe	80
3152	4828	WerFault.exe	80
32	4828	WerFault.exe	80
5032	4828	WerFault.exe	80
4964	4828	WerFault.exe	80
2372	4828	WerFault.exe	80
4228	4828	WerFault.exe	80
3708	4828	WerFault.exe	80
472	4828	WerFault.exe	80
3440	4828	WerFault.exe	80
1652	4828	WerFault.exe	80
1108	4600	WerFault.exe	104
2480	4600	WerFault.exe	104
3952	4600	WerFault.exe	104
3684	4600	WerFault.exe	104
2380	4600	WerFault.exe	104
1848	4600	WerFault.exe	104
4260	4600	WerFault.exe	104
3860	4600	WerFault.exe	104
5116	4600	WerFault.exe	104
2500	4600	WerFault.exe	104
4564	4600	WerFault.exe	104
3620	4600	WerFault.exe	104
5032	4600	WerFault.exe	104
1964	4600	WerFault.exe	104
2916	1608	WerFault.exe	156
1028	1520	WerFault.exe	159
4404	4600	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4648	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4828	Setup.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4600	4828	Setup.exe	104
PID 4828 wrote to memory of 4600	4828	Setup.exe	104
PID 4828 wrote to memory of 4600	4828	Setup.exe	104
PID 4600 wrote to memory of 4648	4600	oneetx.exe	130
PID 4600 wrote to memory of 4648	4600	oneetx.exe	130
PID 4600 wrote to memory of 4648	4600	oneetx.exe	130
PID 4600 wrote to memory of 3292	4600	oneetx.exe	136
PID 4600 wrote to memory of 3292	4600	oneetx.exe	136
PID 4600 wrote to memory of 3292	4600	oneetx.exe	136
PID 3292 wrote to memory of 3508	3292	cmd.exe	140
PID 3292 wrote to memory of 3508	3292	cmd.exe	140
PID 3292 wrote to memory of 3508	3292	cmd.exe	140
PID 3292 wrote to memory of 1712	3292	cmd.exe	141
PID 3292 wrote to memory of 1712	3292	cmd.exe	141
PID 3292 wrote to memory of 1712	3292	cmd.exe	141
PID 3292 wrote to memory of 3616	3292	cmd.exe	142
PID 3292 wrote to memory of 3616	3292	cmd.exe	142
PID 3292 wrote to memory of 3616	3292	cmd.exe	142
PID 3292 wrote to memory of 1800	3292	cmd.exe	143
PID 3292 wrote to memory of 1800	3292	cmd.exe	143
PID 3292 wrote to memory of 1800	3292	cmd.exe	143
PID 3292 wrote to memory of 1616	3292	cmd.exe	144
PID 3292 wrote to memory of 1616	3292	cmd.exe	144
PID 3292 wrote to memory of 1616	3292	cmd.exe	144
PID 3292 wrote to memory of 2904	3292	cmd.exe	145
PID 3292 wrote to memory of 2904	3292	cmd.exe	145
PID 3292 wrote to memory of 2904	3292	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 732
  2⤵
  - Program crash
  PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 848
  2⤵
  - Program crash
  PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 764
  2⤵
  - Program crash
  PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 992
  2⤵
  - Program crash
  PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1000
  2⤵
  - Program crash
  PID:32
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1000
  2⤵
  - Program crash
  PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1244
  2⤵
  - Program crash
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1272
  2⤵
  - Program crash
  PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1340
  2⤵
  - Program crash
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 584
    3⤵
    - Program crash
    PID:1108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 708
    3⤵
    - Program crash
    PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 808
    3⤵
    - Program crash
    PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 944
    3⤵
    - Program crash
    PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 944
    3⤵
    - Program crash
    PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1000
    3⤵
    - Program crash
    PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1008
    3⤵
    - Program crash
    PID:4260
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 888
    3⤵
    - Program crash
    PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 668
    3⤵
    - Program crash
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\23e20ad4db" /P "Admin:N"&&CACLS "..\23e20ad4db" /P "Admin:R" /E&&Exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1712
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1800
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\23e20ad4db" /P "Admin:N"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1616
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\23e20ad4db" /P "Admin:R" /E
      4⤵
      System Location Discovery: System Language Discovery
      PID:2904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 608
    3⤵
    - Program crash
    PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 616
    3⤵
    - Program crash
    PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1248
    3⤵
    - Program crash
    PID:3620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 720
    3⤵
    - Program crash
    PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1020
    3⤵
    - Program crash
    PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1308
    3⤵
    - Program crash
    PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1164
  2⤵
  - Program crash
  PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 852
  2⤵
  - Program crash
  PID:472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 920
  2⤵
  - Program crash
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1596
  2⤵
  - Program crash
  PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4828 -ip 4828
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4828 -ip 4828
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4828 -ip 4828
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4828 -ip 4828
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4828 -ip 4828
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4828 -ip 4828
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4828 -ip 4828
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4828 -ip 4828
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4828 -ip 4828
1⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4828 -ip 4828
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4828 -ip 4828
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4828 -ip 4828
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4828 -ip 4828
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4600 -ip 4600
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4600 -ip 4600
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4600 -ip 4600
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4600 -ip 4600
1⤵
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4600 -ip 4600
1⤵
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4600 -ip 4600
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4600 -ip 4600
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4600 -ip 4600
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4600 -ip 4600
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4600 -ip 4600
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4600 -ip 4600
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4600 -ip 4600
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4600 -ip 4600
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4600 -ip 4600
1⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
1⤵
- Executes dropped EXE
PID:1608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 312
  2⤵
  - Program crash
  PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1608 -ip 1608
1⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
1⤵
- Executes dropped EXE
PID:1520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 332
  2⤵
  - Program crash
  PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1520 -ip 1520
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4600 -ip 4600
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-34-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/1608-25-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/4600-20-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/4828-1-0x0000000002C20000-0x0000000002D20000-memory.dmp

Filesize
1024KB

Download
memory/4828-2-0x0000000002BB0000-0x0000000002BE3000-memory.dmp

Filesize
204KB

Download
memory/4828-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4828-12-0x0000000002C20000-0x0000000002D20000-memory.dmp

Filesize
1024KB

Download
memory/4828-11-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/4828-16-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/4828-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4828-18-0x0000000002BB0000-0x0000000002BE3000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads