amadey | 86b1e6b0bc4305085793f8110d62411ce2880f3dc8501ccd35419db65dd854ef

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fortnite Accounts Checker BY X-SLAYER.exe
Size

1.8MB
MD5

88ad4c9d421e7048ed4f7599b2fb7204
SHA1

41c238b67e3d16ee866cf652680ded68d52c3815
SHA256

86b1e6b0bc4305085793f8110d62411ce2880f3dc8501ccd35419db65dd854ef
SHA512

5cee89157ef54aa43fa2861631db5d4d2e97134d96ffbae4c03092aa352b816ebdf86be97acc3958ffd0d8fb5fd4340dfa3276958dd090505be0b791f0d67b31
SSDEEP

24576:HJTZtuky+rjj9tL8ZMEiDfWbcp+2dnTLcb24EgU1oeImW3:pM+YMEbC+2Vsjn

Score

10^/10

amadey 0f3be6 discovery persistence trojan

Malware Config

Extracted

Family

amadey

Version

5.10

Botnet

0f3be6

http://185.81.68.147

http://185.81.68.148

Attributes

install_dir
ee29ea508b
install_file
Gxtuum.exe
strings_key
d3a5912ea69ad34a2387af70c8be9e21
url_paths
/7vhfjke3/index.php

/8Fvu5jh4DbS/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	systemaa.exe

Executes dropped EXE 6 IoCs

pid	Process
1612	systemcc.exe
3228	systemaa.exe
2292	Launcher.exe
1928	Gxtuum.exe
2860	Gxtuum.exe
3508	Gxtuum.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\584462C21EE62458504893\\584462C21EE62458504893.exe"	systemcc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\584462C21EE62458504893\\584462C21EE62458504893.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 1520	1612	systemcc.exe	86

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Gxtuum.job	systemaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systemaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe
1520	svchost.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1612	systemcc.exe
Token: SeSecurityPrivilege	1612	systemcc.exe
Token: SeTakeOwnershipPrivilege	1612	systemcc.exe
Token: SeLoadDriverPrivilege	1612	systemcc.exe
Token: SeSystemProfilePrivilege	1612	systemcc.exe
Token: SeSystemtimePrivilege	1612	systemcc.exe
Token: SeProfSingleProcessPrivilege	1612	systemcc.exe
Token: SeIncBasePriorityPrivilege	1612	systemcc.exe
Token: SeCreatePagefilePrivilege	1612	systemcc.exe
Token: SeBackupPrivilege	1612	systemcc.exe
Token: SeRestorePrivilege	1612	systemcc.exe
Token: SeShutdownPrivilege	1612	systemcc.exe
Token: SeDebugPrivilege	1612	systemcc.exe
Token: SeSystemEnvironmentPrivilege	1612	systemcc.exe
Token: SeRemoteShutdownPrivilege	1612	systemcc.exe
Token: SeUndockPrivilege	1612	systemcc.exe
Token: SeManageVolumePrivilege	1612	systemcc.exe
Token: 33	1612	systemcc.exe
Token: 34	1612	systemcc.exe
Token: 35	1612	systemcc.exe
Token: 36	1612	systemcc.exe
Token: SeIncreaseQuotaPrivilege	1520	svchost.exe
Token: SeSecurityPrivilege	1520	svchost.exe
Token: SeTakeOwnershipPrivilege	1520	svchost.exe
Token: SeLoadDriverPrivilege	1520	svchost.exe
Token: SeSystemProfilePrivilege	1520	svchost.exe
Token: SeSystemtimePrivilege	1520	svchost.exe
Token: SeProfSingleProcessPrivilege	1520	svchost.exe
Token: SeIncBasePriorityPrivilege	1520	svchost.exe
Token: SeCreatePagefilePrivilege	1520	svchost.exe
Token: SeBackupPrivilege	1520	svchost.exe
Token: SeRestorePrivilege	1520	svchost.exe
Token: SeShutdownPrivilege	1520	svchost.exe
Token: SeDebugPrivilege	1520	svchost.exe
Token: SeSystemEnvironmentPrivilege	1520	svchost.exe
Token: SeRemoteShutdownPrivilege	1520	svchost.exe
Token: SeUndockPrivilege	1520	svchost.exe
Token: SeManageVolumePrivilege	1520	svchost.exe
Token: 33	1520	svchost.exe
Token: 34	1520	svchost.exe
Token: 35	1520	svchost.exe
Token: 36	1520	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3228	systemaa.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1612	3492	Fortnite Accounts Checker BY X-SLAYER.exe	83
PID 3492 wrote to memory of 1612	3492	Fortnite Accounts Checker BY X-SLAYER.exe	83
PID 3492 wrote to memory of 3228	3492	Fortnite Accounts Checker BY X-SLAYER.exe	84
PID 3492 wrote to memory of 3228	3492	Fortnite Accounts Checker BY X-SLAYER.exe	84
PID 3492 wrote to memory of 3228	3492	Fortnite Accounts Checker BY X-SLAYER.exe	84
PID 3492 wrote to memory of 2292	3492	Fortnite Accounts Checker BY X-SLAYER.exe	85
PID 3492 wrote to memory of 2292	3492	Fortnite Accounts Checker BY X-SLAYER.exe	85
PID 1612 wrote to memory of 1520	1612	systemcc.exe	86
PID 1612 wrote to memory of 1520	1612	systemcc.exe	86
PID 1612 wrote to memory of 1520	1612	systemcc.exe	86
PID 3228 wrote to memory of 1928	3228	systemaa.exe	91
PID 3228 wrote to memory of 1928	3228	systemaa.exe	91
PID 3228 wrote to memory of 1928	3228	systemaa.exe	91

C:\Users\Admin\AppData\Local\Temp\Fortnite Accounts Checker BY X-SLAYER.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite Accounts Checker BY X-SLAYER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Roaming\systemcc.exe
  "C:\Users\Admin\AppData\Roaming\systemcc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\Users\Admin\AppData\Roaming\systemaa.exe
  "C:\Users\Admin\AppData\Roaming\systemaa.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
    "C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1928
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "Launcher.exe"
  2⤵
  - Executes dropped EXE
  PID:2292

C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:2860

C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

Filesize
997KB

MD5
fd1f797282a1ae9e8460c1847d52612f

SHA1
8a21e43542e33648065ca0277197de84bb5521db

SHA256
768e5ab33e6b7acabe738f5e3d30e51e8f2bd656ecdc089da388e128b80eb337

SHA512
95f130671966f4dd4ea579d08aaa182a51b5de1c31b59148909c05e7d3103a19b511d7a9bef6451a921fcea2382aa9b8c3a560027882dc29a39f28c7d3a0572d

Download Submit
C:\Users\Admin\AppData\Roaming\systemaa.exe

Filesize
431KB

MD5
4962575a2378d5c72e7a836ea766e2ad

SHA1
549964178b12017622d3cbdda6dbfdef0904e7e2

SHA256
eff5fad47b9c739b09e760813b2bcbb0788eb35598f72e64ff95c794e72e6676

SHA512
911a59f7a6785dd09a57dcd6d977b8abd5e160bd613786e871a1e92377c9e6f3b85fe3037431754bbdb1212e153776efca5fadac1de6b2ad474253da176e8e53

Download Submit
C:\Users\Admin\AppData\Roaming\systemcc.exe

Filesize
299KB

MD5
357726e357f783847a5d3c1c21873ed1

SHA1
f344bc21a0ab3e37a6fc7587fd761a5c0667dd60

SHA256
dfd562f0737ac0a4e3cc10610a4746ad69091f735e485b668c8bf9526ac0bf46

SHA512
5fc36c7b3883384f3e242c102be66ddbd68cd069ea1570f878f56a3e6cf03198ea3e1a791bca9091f2dbe3c394f47b18ff5b92e14a1d56b1f4654ada186a39dc

Download Submit
memory/1520-34-0x00007FF64ABA0000-0x00007FF64ABF2000-memory.dmp

Filesize
328KB

Download
memory/1520-36-0x00007FF64ABA0000-0x00007FF64ABF2000-memory.dmp

Filesize
328KB

Download
memory/2292-17-0x00007FFC6E593000-0x00007FFC6E595000-memory.dmp

Filesize
8KB

Download
memory/2292-18-0x0000000000950000-0x0000000000A54000-memory.dmp

Filesize
1.0MB

Download
memory/2292-22-0x00007FFC6E590000-0x00007FFC6F051000-memory.dmp

Filesize
10.8MB

Download
memory/2292-26-0x00007FFC6E590000-0x00007FFC6F051000-memory.dmp

Filesize
10.8MB

Download