analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9abed1a0728825c185c1b74010898654227fd11bfd77cd2b3c0eea491fa6439e.zip

Full analysis: https://app.any.run/tasks/a3fe861e-8eb0-43a0-97cc-a0579efc9cfd
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: August 13, 2019, 16:20:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
amadey
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

06C4E39974026233C99910C1A1E2FD14

SHA1:

AC767F4535D7F5F78ED83BAE7687A672A0FB7F70

SHA256:

9ABED1A0728825C185C1B74010898654227FD11BFD77CD2B3C0EEA491FA6439E

SSDEEP:

1536:vadz1rbZMNTh/JBmoL9fbK96x9fVSXt9rLNuAPpOvpPLXge5o+Pwn9Gm/+0:vcZMNpmoBfbKxf4Q8hPLXgeVwACt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • bMUBBdqCz.txt (PID: 2348)
      • kntd.exe (PID: 3984)
    • AMADEY was detected

      • bMUBBdqCz.txt (PID: 2348)
      • kntd.exe (PID: 3984)
    • Changes the Startup folder

      • REG.exe (PID: 1568)
    • Connects to CnC server

      • kntd.exe (PID: 3984)
  • SUSPICIOUS

    • Uses REG.EXE to modify Windows registry

      • kntd.exe (PID: 3984)
    • Executed via WMI

      • bMUBBdqCz.txt (PID: 2348)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3508)
      • bMUBBdqCz.txt (PID: 2348)
    • Creates files in the program directory

      • bMUBBdqCz.txt (PID: 2348)
    • Creates files in the user directory

      • notepad++.exe (PID: 3268)
  • INFO

    • Manual execution by user

      • WScript.exe (PID: 3508)
      • WScript.exe (PID: 2160)
      • notepad++.exe (PID: 3268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 410044450_64504154.vbs
ZipUncompressedSize: 218735
ZipCompressedSize: 72753
ZipCRC: 0x67d04141
ZipModifyDate: 2019:08:05 20:56:04
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs wscript.exe #AMADEY bmubbdqcz.txt #AMADEY kntd.exe reg.exe wscript.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
2468"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\9abed1a0728825c185c1b74010898654227fd11bfd77cd2b3c0eea491fa6439e.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3508"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\410044450_64504154.vbs" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2348C:\Users\admin\AppData\Local\Temp\bMUBBdqCz.txtC:\Users\admin\AppData\Local\Temp\bMUBBdqCz.txt
WmiPrvSE.exe
User:
admin
Company:
Creative Technology Limited
Integrity Level:
MEDIUM
Description:
ReadReg MFC Application
Exit code:
0
Version:
2, 0, 0, 2
3984c:\programdata\a9222bbf56\kntd.exec:\programdata\a9222bbf56\kntd.exe
bMUBBdqCz.txt
User:
admin
Company:
Creative Technology Limited
Integrity Level:
MEDIUM
Description:
ReadReg MFC Application
Version:
2, 0, 0, 2
1568REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a9222bbf56C:\Windows\system32\REG.exe
kntd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2160"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\410044450_64504154.vbs" C:\Windows\System32\WScript.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3268"C:\Program Files\Notepad++\notepad++.exe" C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
2060"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
Total events
1 140
Read events
1 042
Write events
97
Delete events
1

Modification events

(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2468) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\9abed1a0728825c185c1b74010898654227fd11bfd77cd2b3c0eea491fa6439e.zip
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2468) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4802
Value:
VBScript Script File
(PID) Process:(2468) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
2
Suspicious files
0
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2348bMUBBdqCz.txtC:\ProgramData\0
MD5:
SHA256:
2348bMUBBdqCz.txtC:\programdata\a9222bbf56\kntd.exe:Zone.Identifier
MD5:
SHA256:
3984kntd.exeC:\ProgramData\0
MD5:
SHA256:
3268notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:81030789A06B407734F8FF693DE6B1FC
SHA256:60F8C82B532E48DFF562F6BEA35A10CE9C7C4DE3C96ADA8E0481CA455DD6C1C8
3508WScript.exeC:\Users\admin\AppData\Local\Temp\bMUBBdqCz.txtexecutable
MD5:F1275A2195EEB5A2FF393C6FDBDC8226
SHA256:5CD3703B82AD47EDEE1FCD274DD54DDC57E0AE9D63985D22A4A8246ACA8CC6A6
2348bMUBBdqCz.txtC:\programdata\a9222bbf56\kntd.exeexecutable
MD5:F1275A2195EEB5A2FF393C6FDBDC8226
SHA256:5CD3703B82AD47EDEE1FCD274DD54DDC57E0AE9D63985D22A4A8246ACA8CC6A6
2468WinRAR.exeC:\Users\admin\Desktop\410044450_64504154.vbstext
MD5:3A2E7BC349B6B1A0A2A861CA09952CCC
SHA256:5B3F2E85428D19C783F9320B34E2FF98F766867EED46ABCEF7196F4C82B715E7
3268notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\config.xmlxml
MD5:1AFC485C46B5BAE37B263DE4F6C7F146
SHA256:6534290377346545421D9008D27CA3CFBA974A1351FC4E1C820AD92A586D4350
3268notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\stylers.xmlxml
MD5:44982E1D48434C0AB3E8277E322DD1E4
SHA256:3E661D3F1FF3977B022A0ACC26B840B5E57D600BC03DCFC6BEFDB408C665904C
3268notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:E792264BEC29005B9044A435FBA185AB
SHA256:5298FD2F119C43D04F6CF831F379EC25B4156192278E40E458EC356F9B49D624
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
2.16.186.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
3984
kntd.exe
POST
77.120.115.221:80
http://toldhisranspar.ru/f5lkB/index.php
UA
malicious
3984
kntd.exe
POST
77.120.115.221:80
http://undwomime.ru/f5lkB/index.php
UA
malicious
3984
kntd.exe
POST
77.120.115.221:80
http://undwomime.ru/f5lkB/index.php
UA
malicious
3984
kntd.exe
POST
77.120.115.221:80
http://totansinone.com/f5lkB/index.php
UA
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2060
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
whitelisted
3984
kntd.exe
77.120.115.221:80
totansinone.com
Volia
UA
malicious

DNS requests

Domain
IP
Reputation
totansinone.com
  • 77.120.115.221
malicious
undwomime.ru
malicious
toldhisranspar.ru
malicious
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.16.186.11
  • 2.16.186.35
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3984
kntd.exe
A Network Trojan was detected
ET TROJAN Amadey CnC Check-In
3984
kntd.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
3984
kntd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3984
kntd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3984
kntd.exe
A Network Trojan was detected
ET TROJAN Amadey CnC Check-In
3984
kntd.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
3984
kntd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3984
kntd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
Process
Message
bMUBBdqCz.txt
TRX6I
kntd.exe
TRX6I
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093