Analysis

  • max time kernel
    890s
  • max time network
    849s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/01/2025, 13:33

General

  • Target

    Malware-1-master/Amadey.exe

  • Size

    49KB

  • MD5

    871294e398217876017702c96d0e7854

  • SHA1

    35a22da1522bf86659576ed59235f8ed7029e79b

  • SHA256

    7fd898dde3a7ed047657e3dc81c3de50ed381857edc53744664332fd98476c54

  • SHA512

    047237e3a615839918fe32662524f2de5455734a01cbb2f66017c636f3d08207b3aead79cdff9a94729550ad7eddc2b5950d5e774fb25fba2d0d69e048ca7fe5

  • SSDEEP

    768:AN4a7os+Bd1CiSJfBFdiGOsSyS5/hhurlzdx:3a2xC5+YSyE/hgpzH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Amadey.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Amadey.exe"
    1⤵
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:888
    • \??\c:\programdata\1be588a5b7\gdsun.exe
      c:\programdata\1be588a5b7\gdsun.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\1be588a5b7
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\1be588a5b7\gdsun.exe

    Filesize

    49KB

    MD5

    871294e398217876017702c96d0e7854

    SHA1

    35a22da1522bf86659576ed59235f8ed7029e79b

    SHA256

    7fd898dde3a7ed047657e3dc81c3de50ed381857edc53744664332fd98476c54

    SHA512

    047237e3a615839918fe32662524f2de5455734a01cbb2f66017c636f3d08207b3aead79cdff9a94729550ad7eddc2b5950d5e774fb25fba2d0d69e048ca7fe5

  • memory/888-14-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1008-15-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1008-20-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB