| File name: | file |
| Full analysis: | https://app.any.run/tasks/53f477bd-eff2-4702-8065-2d3f51c9a5e5 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | October 19, 2023, 17:31:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | DFD00CEBFA70EA1470514E2C03770FD4 |
| SHA1: | 4BAE1D2A05C1817C61042728B17475F8C9EA9D25 |
| SHA256: | 93B1FC8696846EC264DAEF2EF4DED9C4803338679EBA5A5F7DB013D4F1EC367B |
| SSDEEP: | 6144:XXlrIUWEfs1TWP8s5DvatwvcqD8iNbW9cat6UDZ:XXlrIU6WP8s5Dvat0cqHbocoZ |
MALICIOUS
Changes the autorun value in the registry
- Utsysc.exe (PID: 944)
Uses Task Scheduler to run other applications
- Utsysc.exe (PID: 944)
Drops the executable file immediately after the start
- file.exe (PID: 2220)
Application was dropped or rewritten from another process
- Utsysc.exe (PID: 1848)
- Utsysc.exe (PID: 2540)
- file.exe (PID: 2220)
- Utsysc.exe (PID: 944)
AMADEY was detected
- Utsysc.exe (PID: 944)
AMADEY has been detected (YARA)
- Utsysc.exe (PID: 944)
SUSPICIOUS
Reads the Internet Settings
- file.exe (PID: 2220)
- Utsysc.exe (PID: 944)
Starts CMD.EXE for commands execution
- Utsysc.exe (PID: 944)
- cmd.exe (PID: 364)
Application launched itself
- cmd.exe (PID: 364)
Starts itself from another location
- file.exe (PID: 2220)
Uses ICACLS.EXE to modify access control lists
- cmd.exe (PID: 364)
Connects to the server without a host name
- Utsysc.exe (PID: 944)
The process executes via Task Scheduler
- Utsysc.exe (PID: 1848)
- Utsysc.exe (PID: 2540)
INFO
Checks supported languages
- file.exe (PID: 2220)
- Utsysc.exe (PID: 944)
- Utsysc.exe (PID: 2540)
- Utsysc.exe (PID: 1848)
Reads the computer name
- file.exe (PID: 2220)
- Utsysc.exe (PID: 944)
Reads the machine GUID from the registry
- file.exe (PID: 2220)
- Utsysc.exe (PID: 944)
Create files in a temporary directory
- file.exe (PID: 2220)
Checks proxy server information
- Utsysc.exe (PID: 944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Amadey
(PID) Process(944) Utsysc.exe
C2 (1)http://193.42.33.7
Version4.02
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (122)-%lu
b24b726a24
Utsysc.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id:
vs:
sd:
os:
bi:
ar:
pc:
un:
dm:
av:
lv:
og:
r=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
"
Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
shutdown -s -t 0
st=s
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:10:19 15:15:00+02:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.24 |
| CodeSize: | 215040 |
| InitializedDataSize: | 89088 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x15e70 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
44
Monitored processes
12
Malicious processes
2
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 364 | "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "admin:N"&&CACLS "Utsysc.exe" /P "admin:R" /E&&echo Y|CACLS "..\b24b726a24" /P "admin:N"&&CACLS "..\b24b726a24" /P "admin:R" /E&&Exit | C:\Windows\SysWOW64\cmd.exe | — | Utsysc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 568 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 584 | CACLS "..\b24b726a24" /P "admin:R" /E | C:\Windows\SysWOW64\cacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Control ACLs Program Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 712 | "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe" /F | C:\Windows\SysWOW64\schtasks.exe | — | Utsysc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 944 | "C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe" | C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe | file.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
Amadey(PID) Process(944) Utsysc.exe C2 (1)http://193.42.33.7 Version4.02 Options Drop directoryS-%lu- Drop name%-lu Strings (122)-%lu b24b726a24 Utsysc.exe SCHTASKS /Create /SC MINUTE /MO 1 /TN /TR " " /F SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup Rem cmd /C RMDIR /s/q SOFTWARE\Microsoft\Windows\CurrentVersion\Run rundll32 /Delete /TN " Programs SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders %USERPROFILE% \App POST GET id: vs: sd: os: bi: ar: pc: un: dm: av: lv: og: r= cred.dll|clip.dll| d1 e1 e0 Main http:// https:// exe dll cmd ps1 <c> <d> Plugins/ +++ # | &unit= = shell32.dll kernel32.dll GetNativeSystemInfo ProgramData\ AVAST Software Avira Kaspersky Lab ESET Panda Security Doctor Web AVG 360TotalSecurity Bitdefender Norton Sophos Comodo WinDefender 0123456789 rb wb Content-Type: multipart/form-data; boundary=---- ------ Content-Disposition: form-data; name="data"; filename=" "
Content-Type: application/octet-stream ------ -- ?scr=1 .jpg Content-Type: application/x-www-form-urlencoded SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName ComputerName abcdefghijklmnopqrstuvwxyz0123456789-_ -unicode- SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\ SYSTEM\ControlSet001\Services\BasicDisplay\Video VideoID \0000 DefaultSettings.XResolution DefaultSettings.YResolution SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductName 2019 2022 2016 CurrentBuild && echo Y|CACLS " " /P " :N" CACLS " " /P " :R" /E :F" /E &&Exit ..\ \ ::: rundll32.exe /k "taskkill /f /im " " && timeout 1 && del && Exit" " && ren && Powershell.exe -executionpolicy remotesigned -File " " shutdown -s -t 0 st=s | |||||||||||||||
| 1848 | C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe | C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe | — | taskeng.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2040 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2084 | CACLS "..\b24b726a24" /P "admin:N" | C:\Windows\SysWOW64\cacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Control ACLs Program Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2220 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2540 | C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe | C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe | — | taskeng.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
1 222
Read events
1 185
Write events
37
Delete events
0
Modification events
| (PID) Process: | (2220) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2220) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2220) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2220) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (944) Utsysc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| Operation: | write | Name: | Startup |
Value: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup | |||
| (PID) Process: | (944) Utsysc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (944) Utsysc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (944) Utsysc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (944) Utsysc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (944) Utsysc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2220 | file.exe | C:\Users\admin\AppData\Local\Temp\b24b726a24\Utsysc.exe | executable | |
MD5:DFD00CEBFA70EA1470514E2C03770FD4 | SHA256:93B1FC8696846EC264DAEF2EF4DED9C4803338679EBA5A5F7DB013D4F1EC367B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
0
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
944 | Utsysc.exe | POST | 200 | 193.42.33.7:80 | http://193.42.33.7/mbSDvj3/index.php | unknown | binary | 1 b | unknown |
944 | Utsysc.exe | POST | 200 | 193.42.33.7:80 | http://193.42.33.7/mbSDvj3/index.php | unknown | text | 6 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
944 | Utsysc.exe | 193.42.33.7:80 | — | ASN-QUADRANET-GLOBAL | US | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
944 | Utsysc.exe | Misc Attack | ET DROP Dshield Block Listed Source group 1 |
944 | Utsysc.exe | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Amadey |