Analysis
- max time kernel
141s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/01/2024, 18:13
General
- Target 2d420fee40182b4c6360bb05f801f9aa.exe
- Size 3.3MB
- Sample240129-wtq8sshdcm
- SHA256 ec78f97f5dee77537df9ef30f8d899da9f76ddbbb1aeee9fc7194bd7da631f7b
Malware Config
Extracted
-
amadey
-
4.15
-
http://185.172.128.63
-
install_dir
6187fcb526
-
install_file
Dctooux.exe
-
strings_key
cd3b2619c9009c441355ae581d53163e
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d420fee40182b4c6360bb05f801f9aa.exe"C:\Users\Admin\AppData\Local\Temp\2d420fee40182b4c6360bb05f801f9aa.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe"C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Launches sc.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exeC:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe5⤵
- Loads dropped DLL
- Launches sc.exe
-
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Tests_for_preparation_for_the_institute';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Tests_for_preparation_for_the_institute' -Value '"C:\Users\Admin\AppData\Local\Tests_for_preparation_for_the_institute\Tests_for_preparation_for_the_institute.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sc.exe
sc.exe
sc.exe
sc.exe
sc.exe
5ee1801e
Protect544cd51a.dll
__PSScriptPolicyTest_eebv440h.her.ps1
memory/2776-94-0x0000000007620000-0x000000000763A000-memory.dmp
memory/2776-42-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/2776-99-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/2776-96-0x0000000007660000-0x0000000007682000-memory.dmp
memory/2776-95-0x0000000007600000-0x0000000007608000-memory.dmp
memory/2776-93-0x0000000007520000-0x0000000007534000-memory.dmp
memory/2776-92-0x0000000007510000-0x000000000751E000-memory.dmp
memory/2776-53-0x000000007F030000-0x000000007F040000-memory.dmp
memory/2776-54-0x0000000007160000-0x0000000007192000-memory.dmp
memory/2776-91-0x00000000074E0000-0x00000000074F1000-memory.dmp
memory/2776-87-0x0000000007560000-0x00000000075F6000-memory.dmp
memory/2776-55-0x0000000070780000-0x00000000707CC000-memory.dmp
memory/2776-80-0x0000000007350000-0x000000000735A000-memory.dmp
memory/2776-31-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/2776-77-0x0000000007920000-0x0000000007F9A000-memory.dmp
memory/2776-33-0x00000000050E0000-0x0000000005708000-memory.dmp
memory/2776-36-0x0000000005900000-0x0000000005966000-memory.dmp
memory/2776-78-0x00000000072E0000-0x00000000072FA000-memory.dmp
memory/2776-47-0x0000000005B50000-0x0000000005EA4000-memory.dmp
memory/2776-65-0x0000000006580000-0x000000000659E000-memory.dmp
memory/2776-48-0x0000000005FB0000-0x0000000005FCE000-memory.dmp
memory/2776-35-0x0000000005010000-0x0000000005032000-memory.dmp
memory/2776-49-0x0000000005FE0000-0x000000000602C000-memory.dmp
memory/2776-34-0x0000000002740000-0x0000000002750000-memory.dmp
memory/2776-32-0x0000000002740000-0x0000000002750000-memory.dmp
memory/2776-29-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/2776-66-0x0000000002740000-0x0000000002750000-memory.dmp
memory/2776-67-0x0000000002740000-0x0000000002750000-memory.dmp
memory/2776-68-0x00000000071A0000-0x0000000007243000-memory.dmp
memory/3808-22-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-109-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-79-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-119-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-23-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-24-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-25-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3808-90-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3924-124-0x00007FF921090000-0x00007FF921202000-memory.dmp
memory/3924-120-0x00007FF7AD2E0000-0x00007FF7AD43F000-memory.dmp
memory/3924-122-0x00007FF921090000-0x00007FF921202000-memory.dmp
memory/3924-123-0x00007FF921090000-0x00007FF921202000-memory.dmp
memory/4472-133-0x00007FF7B06E0000-0x00007FF7B073A000-memory.dmp
memory/4472-135-0x00007FF7B06E0000-0x00007FF7B073A000-memory.dmp
memory/4472-136-0x00007FF7AD2E0000-0x00007FF7AD43F000-memory.dmp
memory/4592-127-0x00007FF93EFF0000-0x00007FF93F1E5000-memory.dmp
memory/4592-128-0x0000000075720000-0x000000007589B000-memory.dmp
memory/4592-129-0x0000000075720000-0x000000007589B000-memory.dmp
memory/4592-131-0x0000000075720000-0x000000007589B000-memory.dmp
memory/4876-17-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4876-5-0x0000000005560000-0x0000000005766000-memory.dmp
memory/4876-0-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/4876-15-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4876-4-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4876-19-0x0000000006DB0000-0x0000000006EB0000-memory.dmp
memory/4876-13-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4876-16-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4876-3-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/4876-2-0x0000000005180000-0x000000000521C000-memory.dmp
memory/4876-18-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4876-20-0x0000000006DB0000-0x0000000006EB0000-memory.dmp
memory/4876-21-0x0000000006DB0000-0x0000000006EB0000-memory.dmp
memory/4876-26-0x0000000007590000-0x0000000007B34000-memory.dmp
memory/4876-6-0x00000000068B0000-0x0000000006A42000-memory.dmp
memory/4876-1-0x00000000003E0000-0x0000000000736000-memory.dmp
memory/4876-30-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/4876-14-0x0000000006CE0000-0x0000000006CF0000-memory.dmp
memory/4876-12-0x0000000005080000-0x0000000005090000-memory.dmp