Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	764029
MD5:	2396925cc38be4f07bd426cf080256ce
SHA1:	8884e5383b3601e59089f0d287acad1eff20c676
SHA256:	e91bb1f7c2b2ffd094d3915f1fffbfe929efd49e1d732b51d60e8a378a8a066b
Tags:	exe
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Amadeys stealer DLL

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Yara detected Amadey bot

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Drops PE files

Contains functionality to read the PEB

Contains functionality to launch a program with higher privileges

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

file.exe (PID: 3520 cmdline: C:\Users\user\Desktop\file.exe MD5: 2396925CC38BE4F07BD426CF080256CE)

gntuud.exe (PID: 2016 cmdline: "C:\Users\user\AppData\Local\Temp\ecaac49691\gntuud.exe" MD5: 2396925CC38BE4F07BD426CF080256CE)

schtasks.exe (PID: 5144 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\user\AppData\Local\Temp\ecaac49691\gntuud.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

gntuud.exe (PID: 5292 cmdline: C:\Users\user\AppData\Local\Temp\ecaac49691\gntuud.exe MD5: 2396925CC38BE4F07BD426CF080256CE)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "77.73.133.72/hfk3vK9/index.php", "Version": "3.50"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\cred64[1].dll	INDICATOR_TOOL_PWS_Amady	Detects password stealer DLL. Dropped by Amadey	ditekSHen	0xd868:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x15604:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x16074:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x15158:$s2: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0x151bc:$s2: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0xdd0c:$s3: \Mikrotik\Winbox\Addresses.cdb 0x190d8:$s4: \HostName 0x19100:$s5: \Password 0x17c04:$s6: SOFTWARE\RealVNC\ 0x17c30:$s6: SOFTWARE\RealVNC\ 0x17c5c:$s6: SOFTWARE\RealVNC\ 0x17ca4:$s6: SOFTWARE\RealVNC\ 0x17cd0:$s6: SOFTWARE\RealVNC\ 0x18008:$s7: SOFTWARE\TightVNC\ 0x18034:$s7: SOFTWARE\TightVNC\ 0x18060:$s7: SOFTWARE\TightVNC\ 0x180ac:$s7: SOFTWARE\TightVNC\ 0x1c43c:$s8: cred.dll

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.259666135.00000000005D3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1640:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000003.293480849.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.271178795.0000000000680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.259530025.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000003.312159954.0000000000940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.293433328.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000000.00000003.256458471.0000000000940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.312844293.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.259872011.0000000000900000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.259872011.0000000000900000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.313317695.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.313317695.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.313412358.0000000000745000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1328:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: gntuud.exe PID: 2016	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: gntuud.exe PID: 2016	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.gntuud.exe.400000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.gntuud.exe.6e0e67.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.3.gntuud.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.900e67.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.gntuud.exe.6e0e67.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.gntuud.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.940000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.gntuud.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.gntuud.exe.680000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.400000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.3.gntuud.exe.940000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.900e67.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 9 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll_	Avira URL Cloud: Label: malware
Source: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll=	Avira URL Cloud: Label: malware
Source: http://77.73.133.72/hfk3vK9/index.php	Avira URL Cloud: Label: malware
Source: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll	Avira URL Cloud: Label: malware
Source: http://77.73.133.72/hfk3vK9/index.php8	Avira URL Cloud: Label: malware
Source: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll)	Avira URL Cloud: Label: malware
Source: http://77.73.133.72/hfk3vK9/index.phpplay	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll	Virustotal: Detection: 18%			Perma Link
Source: http://77.73.133.72/hfk3vK9/index.php	Virustotal: Detection: 9%			Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\cred64[1].dll

Avira: detection malicious, Label: HEUR/AGEN.1233121

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\cred64[1].dll

ReversingLabs: Detection: 88%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ecaac49691\gntuud.exe

Joe Sandbox ML: detected

Source: 0.2.file.exe.900e67.1.unpack

Malware Configuration Extractor: Amadey {"C2 url": "77.73.133.72/hfk3vK9/index.php", "Version": "3.50"}

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\ecaac49691\gntuud.exe	Unpacked PE file: 4.2.gntuud.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: file.exe, file.exe, 00000000.00000002.259530025.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.256458471.0000000000940000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.259872011.0000000000900000.00000040.00001000.00020000.00000000.sdmp, gntuud.exe, gntuud.exe, 00000004.00000003.312159954.0000000000940000.00000004.00001000.00020000.00000000.sdmp, gntuud.exe, 00000004.00000002.312844293.0000000000400000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\wabuj\8-vuca\fomehibarayar-zejegogotu94\guyo\veceradaro\fev.pdb source: file.exe, gntuud.exe.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00420BA6 FindFirstFileExW,	0_2_00420BA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00920E0D FindFirstFileExW,	0_2_00920E0D
Source: C:\Users\user\AppData\Local\Temp\ecaac49691\gntuud.exe	Code function: 4_2_00420BA6 FindFirstFileExW,	4_2_00420BA6

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 77.73.133.72/hfk3vK9/index.php

Source: Joe Sandbox View

ASN Name: AS43260TR AS43260TR

Source: Joe Sandbox View

IP Address: 77.73.133.72 77.73.133.72

Source: gntuud.exe, 00000001.00000003.293294453.000000000079B000.00000004.00000020.00020000.00000000.sdmp, gntuud.exe, 00000001.00000003.293433328.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll
Source: gntuud.exe, 00000001.00000003.293433328.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll)
Source: gntuud.exe, 00000001.00000003.293294453.000000000079B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll=
Source: gntuud.exe, 00000001.00000003.293433328.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/Plugins/cred64.dll_
Source: gntuud.exe, 00000001.00000003.293349447.00000000007A7000.00000004.00000020.00020000.00000000.sdmp, gntuud.exe, 00000001.00000003.293294453.000000000079B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/index.php
Source: gntuud.exe, 00000001.00000003.293294453.000000000079B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/index.php8
Source: gntuud.exe, 00000001.00000003.293294453.000000000079B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.73.133.72/hfk3vK9/index.phpplay

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404180 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00404180

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Windows Analysis Report
file.exe