amadey | 04ef642ea5f51c774c5f879827f989c5070efd2767c4d7d4022b1111ac6f7a94

General

Target
10a320ba7543dcad47f4fef1c330f8c6.exe
Size 440KB
Sample261024-189e5sev7m
SHA256 04ef642ea5f51c774c5f879827f989c5070efd2767c4d7d4022b1111ac6f7a94
MD5 10a320ba7543dcad47f4fef1c330f8c6
SHA1 f9dcd5060a7d57b2b10e54f753af69c649e07bcf
SHA512 66a6c6d671d01e1c1fe4cf1a50518afa675b6b1029534fbacb0ddbc0f5da82fe1474a14ea66ecae3bb4881ed37927969044924af2965306a0b95410ead5358cd
SSDEEP 6144:EWgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:EWgDaADwKH971PerixehRkFh3pg
TLSH
T1A3A45B203857C032D66191B10E7AFFF695ADA8259B3109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery amadey trojan

Malware Config

Extracted

Family

amadey

Version

5.92

C2

http://193.178.158.107
http://196.251.107.186

Attributes

install_dir
17082f4eef
install_file
Wfeuilcmo.exe
strings_key
51ac028ab14af136529d7c2c3cc0f1b4
url_paths
/Bjsw3DlG1/index.php

/8jdjZhdf7/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b84f-3.dat	family_amadey_v2

Downloads MZ/PE file 3 IoCs

flow	pid	Process
10	4184	synchost.exe
12	4184	synchost.exe
15	4184	synchost.exe

Executes dropped EXE 3 IoCs

pid	Process
4184	synchost.exe
2604	synchost.exe
2840	synchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\synchost.job	synchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	synchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	synchost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	synchost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4184	4204	10a320ba7543dcad47f4fef1c330f8c6.exe	89

C:\Users\Admin\AppData\Local\Temp\10a320ba7543dcad47f4fef1c330f8c6.exe
"C:\Users\Admin\AppData\Local\Temp\10a320ba7543dcad47f4fef1c330f8c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Roaming\synchost.exe
  "C:\Users\Admin\AppData\Roaming\synchost.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4184

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
- Executes dropped EXE
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7e2e3164f26a442a_syshost_loader.exe

Path C:\Users\Admin\AppData\Local\Temp\10000210101\7e2e3164f26a442a_syshost_loader.exe
Size 32KB
SHA256 d7de301c53d8ccdd02116fef9f2bca0b934ab1ea58eea529368016088704db07
MD5 8a173b669674bf4b0f040519faf139cd
SHA1 2eea6b0d5e28216ac47c638045ee537bf640e389
SHA512 4c24172eeb2664d93916f9e829e702a620fd2bbe5549aab71e7af19a1158b4c813191c223788842029a3f4966d1358f1579fbd66a30e9d458f79447be6cffb2f
SSDEEP 768:8xW6V+7Vwu+mtYzYaBuE7MqeqUbhXh/8VysOxG+d:SBu+msqqXKl1fS+d
TLSH
T1A2E26D2D27A510F9E62B91B9CA818906D37230124735E78F077487FB2F73AB2657E352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

054b66d3943934ef_CryptoClipper.exe

Path C:\Users\Admin\AppData\Local\Temp\10000220101\054b66d3943934ef_CryptoClipper.exe
Size 32KB
SHA256 b281badae40bc3d6b0ba21f0cf44e8e3e66389d36b638799bfb0eef97a2eac23
MD5 c5e35b0ca32bd831f5db2e1b4713e6ae
SHA1 c02709ef2ebc55a3811aa0cc06b2fad8428a9a8d
SHA512 004fbc49565d40474c8fd2171dcc641c5ea0418397e37d136de7d9cfb32fbf2d53bc91f051161a5b628208d7b2ab08b42dca291ce012615c781bd8919bda3e06
SSDEEP 768:eXEJ61DNJtKhZckMWf4gMSbD4SAblnRJU:XSNXKhZzMWfHMnSApk
TLSH
T103E22A0E52D510FDE22F917DE64A2542E2B678170302ABEB47B14B771F336E2393E681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0573101cdb434fe_build_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\10000230101\a0573101cdb434fe_build_x64.exe
Size 32KB
SHA256 bf3d611d135764aa42e371df3cd19a59850e75d233402187c5542756bca2aeef
MD5 de0f64e3d99308c41c481875172893e6
SHA1 984a22813b76a36556c8e0bb87e7a73309315d46
SHA512 e039215f1a4539c70da94bb301435f8b952c6a919fb535a806e177cfacff237e0108072985d1e535754140f7f528c75b882c8d8331491b9b86b165b699c1a879
SSDEEP 768:RqRavh9V37o7t8jJLyFaKPjIr3HTq5XpK:RfvPV37o7SlLMb4UX4
TLSH
T197E2069AAFD60FE7C44604B8D286EDDAC83F76093234909A976B1431DF3D865763CD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54b1d5157895e316_Visionary_7030.exe

Path C:\Users\Admin\AppData\Local\Temp\10000240101\54b1d5157895e316_Visionary_7030.exe
Size 16KB
SHA256 8f288b06a0af62961ed325c3aab91f6eefbd970b499848a54884e1926f26fcf6
MD5 d8c71b16d48ebac2220d16f2562f9f89
SHA1 28423f0e405aa15131ccf4eb393cdc938bdbb4ce
SHA512 a7c47fc9d227526a948bc309d0eae7f1eba8bf6040942b43491fa7029c30ccf7680825f0711f8b7170aa338c7c336f46059ca0e63e5f579472e9422599efc94e
SSDEEP 384:F40+BGDP/Rg4wsx99Pt7UNxyGarY4pP1Rl/+:F4lEO4nD74G3pPY
TLSH
T185720A53534AE9BBC42D833200FAD52AB577157031130D72DEE8947A4B8D090BD3BACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 422KB
SHA256 88364b809237dd0f6698322c7361eeff373fff410c46bd55300e2b1047778b4a
MD5 60c0b2c5f67d19ee1929ed2734294678
SHA1 2e7a5a360c5b93b6edf055acc70b276fd7bbdc28
SHA512 706081aefb92017b2b7a0f518d82796e09072b4b1d2b451f120d8c252267a0e112a3caf37681a9c122ce37de6d392afa9922edf83de221f89c1807250a162388
SSDEEP 6144:1WgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:1WgDaADwKH971PerixehRkFh3pg
TLSH
T124945B203857C032D66191B10E7AFFF685ADA8259B7109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads