amadey | 6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93

General

Target
jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
Size 285KB
Sample260911-3qcdssgg67
SHA256 6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93
MD5 25e8d65bda47d864282d4f7b17a12ac7
SHA1 bfa92d16bfd558ce6816673d1b3aafde8b3d2ae3
SHA512 2fa5ea5d21c93112fec16e297f24591e22e3e868e55cc50f7f6b079cc1d376b986cb88bd2cf18416574a2e9555afafde4dcd5d24c5bc4d8aefb47cf7c3721b3d
SSDEEP 6144:QD0eyA56WrZmsFQ1vt1JMZAn7XhCCs2H1tG3RXMMSzsTdU2xlO6y:QIPA5HLst1mAnrMTY+NLSwa2nC
TLSH
T100542222EAFDA637C90690FD4601506A47E6B231D225F69F7DD132676CC2FD60C2AA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fbf543 discovery execution amadey persistence trojan

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

C2

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral1/memory/4820-1-0x0000000004AE0000-0x0000000004B58000-memory.dmp	family_amadey_v2
behavioral1/files/0x002b00000001b679-7.dat	family_amadey_v2

Executes dropped EXE 2 IoCs

pid	Process
452	8Rg9O5Yv.K9v2k
4612	8Rg9O5Yv.K9v2k

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2076	icacls.exe
716	icacls.exe
2640	icacls.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3888	cmd.exe
1404	cmd.exe
1708	cmd.exe
1040	cmd.exe
4668	cmd.exe
2620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Rg9O5Yv.K9v2k
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1424	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
Token: SeRestorePrivilege	716	icacls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1404	4820	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	83
PID 1404 wrote to memory of 716	1404	cmd.exe	85
PID 4820 wrote to memory of 1708	4820	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	86
PID 1708 wrote to memory of 2640	1708	cmd.exe	88
PID 4820 wrote to memory of 1040	4820	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	89
PID 1040 wrote to memory of 2076	1040	cmd.exe	91
PID 4820 wrote to memory of 4668	4820	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	92
PID 4820 wrote to memory of 2620	4820	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	94
PID 4668 wrote to memory of 452	4668	cmd.exe	96
PID 2620 wrote to memory of 1424	2620	cmd.exe	97
PID 3888 wrote to memory of 4612	3888	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k
    "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "OKq1UsWj" /xml "C:\Users\Admin\AppData\Local\Temp\OKq1UsWj.xml" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "OKq1UsWj" /xml "C:\Users\Admin\AppData\Local\Temp\OKq1UsWj.xml" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1424

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4400

C:\Windows\system32\cmd.exe
cmd.exe /c start "" "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k
  "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
  2⤵
  - Executes dropped EXE
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OKq1UsWj.xml

Path C:\Users\Admin\AppData\Local\Temp\OKq1UsWj.xml
Size 2KB
SHA256 fa9f878a55060cc4c93cabf341481fe6e5bffc75e7cf746bcf3ed810adeb9ee0
MD5 edc2d61e267c9e91010ff8d51a51da6a
SHA1 91b0f2e3c3d0bcc79149f1ed68c9d42f2139f073
SHA512 b364c4350deccd11d592fb5e138c64ff73aef4563f93edca9abae223b5356132d39d2be805a2d4460dca2efd72a54255a7a287246bd9ed0361fa6f65cea1173b
TLSH
T1B151274367EE1119F1F76B6CAEB710614AA7BD855D39C46D00AC240DCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

8Rg9O5Yv.K9v2k

Path C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k
Size 416KB
SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
MD5 156f4a8f006779a3493d9d476f1e8dda
SHA1 c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
SHA512 da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200
SSDEEP 6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM
TLSH
T186944B217813C032D66191721F79FFF685ADA8259B7109DB7BC40F769E202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4820-0-0x0000000000140000-0x000000000018E000-memory.dmp

Download

memory/4820-1-0x0000000004AE0000-0x0000000004B58000-memory.dmp

Download

memory/4820-2-0x0000000000B10000-0x0000000000B16000-memory.dmp

Download

memory/4820-3-0x0000000007610000-0x0000000007BB4000-memory.dmp

Download

memory/4820-4-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads