amadey | 138b791bb04c3073e3e752fdcf5bc5490c4169e9f553954b025aab8414c4589a

General

Target

SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
Size

531KB
MD5

a544d2c23c55904dbf0f0190f42eaac6
SHA1

e9d920e5400b36562dfe81b900b99d35b70576b9
SHA256

138b791bb04c3073e3e752fdcf5bc5490c4169e9f553954b025aab8414c4589a
SHA512

21d50d0239326ced64c8c294f53fd58fe715c3f38550b151117786b1201997e899414fefc3734fc139502d27b81c36c64d07dc64305ead24b80ac9646f114ac5
SSDEEP

12288:fz9JHhp3l7Nt0P78PyCp3qkxD+XYaVikoSG6s7XuwMefn:fzXtNeP7v6XZMYackkX/

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.12

C2

http://brodoyouevenlift.co.za

Attributes

install_dir
ce3eb8f6b2
install_file
Utsysc.exe
strings_key
c5b804d7b4c8a99f5afb89e5203cf3ba
url_paths
/g9sdjScV2/index.php

/vdhe8ejs3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

description	pid	process	target process
PID 2284 set thread context of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2628 2664 WerFault.exe SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

description pid process

Token: SeDebugPrivilege 2284 SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

pid	pid_target	process	target process
2628	2664	WerFault.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

description	pid	process
Token: SeDebugPrivilege	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exeSecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 160
3⤵
- Program crash
PID:2628

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-8-0x0000000000570000-0x00000000005BC000-memory.dmp

Filesize
304KB

Download
memory/2284-23-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2284-0-0x0000000001150000-0x00000000011DC000-memory.dmp

Filesize
560KB

Download
memory/2284-3-0x0000000000AA0000-0x0000000000B18000-memory.dmp

Filesize
480KB

Download
memory/2284-4-0x0000000000C30000-0x0000000000CA8000-memory.dmp

Filesize
480KB

Download
memory/2284-5-0x0000000000DF0000-0x0000000000E6A000-memory.dmp

Filesize
488KB

Download
memory/2284-6-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/2284-7-0x0000000001090000-0x00000000010F0000-memory.dmp

Filesize
384KB

Download
memory/2284-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2284-1-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-24-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-11-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-15-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-10-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-17-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-21-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-13-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2664-9-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

description	pid	process	target process
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2284 wrote to memory of 2664	2284	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe
PID 2664 wrote to memory of 2628	2664	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	WerFault.exe
PID 2664 wrote to memory of 2628	2664	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	WerFault.exe
PID 2664 wrote to memory of 2628	2664	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	WerFault.exe
PID 2664 wrote to memory of 2628	2664	SecuriteInfo.com.Win32.CrypterX-gen.2313.4774.exe	WerFault.exe

Analysis

Sharing