amadey | 24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b

General

Target
x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe
Size 219KB
Sample260603-b6eejsf19t
SHA256 24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b
MD5 6d2986b35b956934c2594c6f543ef21e
SHA1 22cfc60a3799a183c4129458db649311887db98d
SHA512 e31783e02fa8462b7c8d4104cdde17572e350b7679ad0793fb22debf415688b3ad6f6a95346f6f57ca7e0bb88f137242c07035a3e426087c65bcb464036c0740
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
TLSH
T1FE24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution amadey persistence trojan

Malware Config

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b632-4.dat	family_amadey_v2

Executes dropped EXE 4 IoCs

pid	Process
2300	explonde.exe
1800	explonde.exe
5300	explonde.exe
3432	explonde.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explonde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3288	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 2300	5732	x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe	82
PID 2300 wrote to memory of 3288	2300	explonde.exe	83
PID 2300 wrote to memory of 1384	2300	explonde.exe	85
PID 1384 wrote to memory of 2592	1384	cmd.exe	87
PID 1384 wrote to memory of 1340	1384	cmd.exe	88
PID 1384 wrote to memory of 6084	1384	cmd.exe	89
PID 1384 wrote to memory of 1388	1384	cmd.exe	90
PID 1384 wrote to memory of 2256	1384	cmd.exe	91
PID 1384 wrote to memory of 5672	1384	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe
"C:\Users\Admin\AppData\Local\Temp\x24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2592
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explonde.exe" /P "Admin:N"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explonde.exe" /P "Admin:R" /E
      4⤵
      System Location Discovery: System Language Discovery
      PID:6084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2256
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      System Location Discovery: System Language Discovery
      PID:5672

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:5300

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explonde.exe

Path C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Size 219KB
SHA256 24f0a537ad0c6deb507e6108119ef894c6beb592691e010b0d96625e233d380b
MD5 6d2986b35b956934c2594c6f543ef21e
SHA1 22cfc60a3799a183c4129458db649311887db98d
SHA512 e31783e02fa8462b7c8d4104cdde17572e350b7679ad0793fb22debf415688b3ad6f6a95346f6f57ca7e0bb88f137242c07035a3e426087c65bcb464036c0740
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
TLSH
T1FE24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads