amadey | 0cde29474f7cef1c16e564427b55c7493c38a52b5ff1eec708fc17824b5e6b43 | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:36

Sharing

Report Analysis Logs

General

Target

file.exe
Size

359KB
MD5

1ba0999c88bf205f41d97977318e56b9
SHA1

7ca2deba4e0bc2e40db9807d81b4a6ab6cddfa01
SHA256

0cde29474f7cef1c16e564427b55c7493c38a52b5ff1eec708fc17824b5e6b43
SHA512

fbff5eb1a33acb6686e38833f88035daf01b25b391862e28612b6226c0fb5fe2519a8b4d94c16ba652954fd89e6856cdf5832cebddf56cb8845c3b320403dbe7
SSDEEP

6144:opz6yi2LzkdBBe/Mt0SUUmIJJ9t1L+aNTo4UmTA5F:opGy5vkdBB5KVIVVpo445F

Score

10^/10

amadey trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	4860	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 236
  2⤵
  - Program crash
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4860 -ip 4860
1⤵
PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-132-0x0000000000673000-0x0000000000692000-memory.dmp

Filesize
124KB

Download
memory/4860-133-0x00000000001C0000-0x00000000001FE000-memory.dmp

Filesize
248KB

Download
memory/4860-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download