amadey | 9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7

Analysis

max time kernel
68s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a992de6.exe
Size

3.0MB
MD5

3eedb7ab4ab81081e6fe25b117d4698c
SHA1

20540442599ee9f254f3b7adfe116c2890cd227d
SHA256

9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7
SHA512

5e1426b420c647bed333235763517d91aa6f8b19e52b4d100bb2ad8f1024592e1e82b4c15ed2b4275258fca99b2a71b740c2551200973dbb31bbf7343fd2b58d
SSDEEP

49152:ehsWom5L52gTmt+XMnJO39/34+DCTeenrfQpGHu4HSZWYExaO3s45O7ZdyAbm5NQ:eyPi2gTmtyMJO9/o2CFnTQ2jyZWYExaq

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://5.42.66.29

Attributes

install_dir
f60f0ba310
install_file
Dctooux.exe
strings_key
f34f781563773d1d56ad6459936524d1
url_paths
/b9djjcaSed/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

Dctooux.exe

pid process

2512 Dctooux.exe
Drops file in Windows directory 1 IoCs

Processes:

9a992de6.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job 9a992de6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9a992de6.exe

pid process

3252 9a992de6.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

9a992de6.exeDctooux.exe

pid process

3252 9a992de6.exe
3252 9a992de6.exe
2512 Dctooux.exe
2512 Dctooux.exe

pid	process
2512	Dctooux.exe

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	9a992de6.exe

pid	process
3252	9a992de6.exe

pid	process
3252	9a992de6.exe
3252	9a992de6.exe
2512	Dctooux.exe
2512	Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\9a992de6.exe
"C:\Users\Admin\AppData\Local\Temp\9a992de6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3252

C:\Users\Admin\AppData\Local\Temp\f60f0ba310\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\f60f0ba310\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\e8aad92a75ada1\cred64.dll, Main
  2⤵
  PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\073191680435

Filesize
72KB

MD5
0117079e964159273da2b3a074944673

SHA1
d2fa605f04a0b69ad4f32d2570debf93bc5ad0ca

SHA256
4d57e302f33ac886b3db45e9e119a502316c1b438bed918ff9006040891db944

SHA512
af186bb9cd473381cf9699c334756b840c36dbeec35cb11675a3c0a8f8de91f713f62cfb54148e444a1980015b6fe8b649ba106c3499e6539110ce2dc2eb0e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\f60f0ba310\Dctooux.exe

Filesize
3.0MB

MD5
3eedb7ab4ab81081e6fe25b117d4698c

SHA1
20540442599ee9f254f3b7adfe116c2890cd227d

SHA256
9a992de6256ebd4206d07cc5916011ef631d9798161de0a05ff1c114bbf241d7

SHA512
5e1426b420c647bed333235763517d91aa6f8b19e52b4d100bb2ad8f1024592e1e82b4c15ed2b4275258fca99b2a71b740c2551200973dbb31bbf7343fd2b58d

Download Submit
C:\Users\Admin\AppData\Roaming\e8aad92a75ada1\cred64.dll

Filesize
1.2MB

MD5
f0f298f43957b3d142d6a38a61baaa90

SHA1
69f0d367654ce5e789b6822b425d77f88332d7ef

SHA256
cffe9550d9e114d12971691a577c134a6438aaaeebe82688c51776fd243a41ce

SHA512
e352155ac426a1c27c7eac379c7c12b8f48f4ae4696e759c9cc6a4f743b948ceced6fefa793dd70635b8a0ac7560a0c0f3bf4d9611ff85a55b23950066860a18

Download Submit
memory/2512-12-0x0000000000AC0000-0x0000000000FDC000-memory.dmp

Filesize
5.1MB

Download
memory/2512-11-0x0000000000AC0000-0x0000000000FDC000-memory.dmp

Filesize
5.1MB

Download
memory/2512-13-0x0000000004930000-0x000000000499F000-memory.dmp

Filesize
444KB

Download
memory/2512-14-0x0000000004930000-0x000000000499F000-memory.dmp

Filesize
444KB

Download
memory/3252-0-0x00000000002C0000-0x00000000007DC000-memory.dmp

Filesize
5.1MB

Download
memory/3252-1-0x00000000002C0000-0x00000000007DC000-memory.dmp

Filesize
5.1MB

Download
memory/3252-2-0x0000000004240000-0x00000000042AF000-memory.dmp

Filesize
444KB

Download
memory/3252-7-0x00000000002C0000-0x00000000007DC000-memory.dmp

Filesize
5.1MB

Download
memory/3252-8-0x0000000004240000-0x00000000042AF000-memory.dmp

Filesize
444KB

Download