amadey | b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

595KB
MD5

2060ab69656588e8acefcde9c7cc0a5f
SHA1

f4501b82e348b38cf4f877bff1c1447828585c6a
SHA256

b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3
SHA512

10f3447e6cd5a065184395368825030951c62e6c59f980399f832b0862ae09d8db20b7557c4b25917ca78c92750dfb9654e5064fc860a5a6abff198574fa6573
SSDEEP

12288:ih1Fk70TnvjcWYbRQsBTNcHG2k+Nfw3HtUZwi+rRvoR9yrc4+GX:Mk70TrcWYbmsBxN2otUf+Yyrc0X

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/216-0-0x0000000002830000-0x00000000028AE000-memory.dmp	net_reactor
behavioral2/memory/216-5-0x0000000004D90000-0x0000000004E0C000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 4308	216	file.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5048	4308	WerFault.exe	87

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87
PID 216 wrote to memory of 4308	216	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 596
    3⤵
    - Program crash
    PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 4308
1⤵
PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-0-0x0000000002830000-0x00000000028AE000-memory.dmp

Filesize
504KB

Download
memory/216-1-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/216-2-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/216-3-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/216-5-0x0000000004D90000-0x0000000004E0C000-memory.dmp

Filesize
496KB

Download
memory/216-4-0x0000000004E60000-0x0000000005404000-memory.dmp

Filesize
5.6MB

Download
memory/216-11-0x00000000028D0000-0x00000000048D0000-memory.dmp

Filesize
32.0MB

Download
memory/216-15-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/4308-8-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4308-10-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4308-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4308-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download