Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/01/2024, 04:28
General
- Target ama.exe
- Size 6.1MB
- Sample240122-e3nqlagfg4
- SHA256 49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20
Malware Config
Extracted
-
amadey
-
4.15
-
http://185.172.128.63
-
install_dir
6187fcb526
-
install_file
Dctooux.exe
-
strings_key
cd3b2619c9009c441355ae581d53163e
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ama.exe"C:\Users\Admin\AppData\Local\Temp\ama.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Exquisite_furniture_for_modern_apartments';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Exquisite_furniture_for_modern_apartments' -Value '"C:\Users\Admin\AppData\Local\Exquisite_furniture_for_modern_apartments\Exquisite_furniture_for_modern_apartments.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sc.exe
Protect544cd51a.dll
__PSScriptPolicyTest_akiby4rk.2qa.ps1
memory/2796-74-0x0000000006050000-0x0000000006082000-memory.dmp
memory/2796-87-0x00000000073F0000-0x0000000007A6A000-memory.dmp
memory/2796-99-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2796-96-0x0000000007130000-0x0000000007152000-memory.dmp
memory/2796-95-0x00000000070F0000-0x00000000070F8000-memory.dmp
memory/2796-94-0x0000000007100000-0x000000000711A000-memory.dmp
memory/2796-93-0x0000000007010000-0x0000000007024000-memory.dmp
memory/2796-36-0x0000000004AB0000-0x0000000004AD2000-memory.dmp
memory/2796-91-0x0000000006FB0000-0x0000000006FC1000-memory.dmp
memory/2796-37-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/2796-90-0x0000000007030000-0x00000000070C6000-memory.dmp
memory/2796-89-0x0000000006E20000-0x0000000006E2A000-memory.dmp
memory/2796-88-0x0000000006DB0000-0x0000000006DCA000-memory.dmp
memory/2796-38-0x0000000005460000-0x00000000054C6000-memory.dmp
memory/2796-86-0x0000000006CA0000-0x0000000006D43000-memory.dmp
memory/2796-33-0x0000000002270000-0x0000000002280000-memory.dmp
memory/2796-85-0x0000000006030000-0x000000000604E000-memory.dmp
memory/2796-75-0x000000006F990000-0x000000006F9DC000-memory.dmp
memory/2796-73-0x000000007FB00000-0x000000007FB10000-memory.dmp
memory/2796-72-0x0000000002270000-0x0000000002280000-memory.dmp
memory/2796-53-0x0000000005E30000-0x0000000005E7C000-memory.dmp
memory/2796-30-0x0000000002180000-0x00000000021B6000-memory.dmp
memory/2796-32-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2796-52-0x0000000005AA0000-0x0000000005ABE000-memory.dmp
memory/2796-34-0x0000000004CA0000-0x00000000052C8000-memory.dmp
memory/2796-35-0x0000000002270000-0x0000000002280000-memory.dmp
memory/2796-48-0x00000000055D0000-0x0000000005924000-memory.dmp
memory/2796-92-0x0000000007000000-0x000000000700E000-memory.dmp
memory/4104-21-0x00000000071C0000-0x00000000072C0000-memory.dmp
memory/4104-6-0x0000000006D30000-0x0000000006EC2000-memory.dmp
memory/4104-2-0x00000000055C0000-0x000000000565C000-memory.dmp
memory/4104-4-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4104-31-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/4104-27-0x0000000007970000-0x0000000007F14000-memory.dmp
memory/4104-1-0x00000000005D0000-0x0000000000BEE000-memory.dmp
memory/4104-15-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4104-5-0x00000000059D0000-0x0000000005C00000-memory.dmp
memory/4104-16-0x0000000005060000-0x0000000005070000-memory.dmp
memory/4104-3-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/4104-0-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/4104-12-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4104-14-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4104-13-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4104-20-0x00000000071C0000-0x00000000072C0000-memory.dmp
memory/4104-19-0x00000000071C0000-0x00000000072C0000-memory.dmp
memory/4104-18-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4104-17-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4304-62-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4304-22-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4304-23-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4304-24-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4304-26-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4304-71-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4304-25-0x0000000000400000-0x000000000046D000-memory.dmp