amadey | b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:08

Target

tmp.exe
Size

595KB
MD5

2060ab69656588e8acefcde9c7cc0a5f
SHA1

f4501b82e348b38cf4f877bff1c1447828585c6a
SHA256

b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3
SHA512

10f3447e6cd5a065184395368825030951c62e6c59f980399f832b0862ae09d8db20b7557c4b25917ca78c92750dfb9654e5064fc860a5a6abff198574fa6573
SSDEEP

12288:ih1Fk70TnvjcWYbRQsBTNcHG2k+Nfw3HtUZwi+rRvoR9yrc4+GX:Mk70TrcWYbmsBxN2otUf+Yyrc0X

Score

10^/10

amadey trojan

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

rc4.plain

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/2440-0-0x0000000002730000-0x00000000027AE000-memory.dmp	net_reactor
behavioral2/memory/2440-6-0x0000000004DE0000-0x0000000004E5C000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description	pid	Process	procid_target
PID 2440 set thread context of 1864	2440	tmp.exe	88

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4460	1864	WerFault.exe	88

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

tmp.exe

description	pid	Process	procid_target
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88
PID 2440 wrote to memory of 1864	2440	tmp.exe	88

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1864 -ip 1864
1⤵
PID:2772

memory/1864-10-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-18-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2440-2-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/2440-5-0x0000000004F50000-0x00000000054F4000-memory.dmp

Filesize
5.6MB

Download
memory/2440-7-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/2440-6-0x0000000004DE0000-0x0000000004E5C000-memory.dmp

Filesize
496KB

Download
memory/2440-4-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/2440-1-0x0000000075060000-0x0000000075810000-memory.dmp

Filesize
7.7MB

Download
memory/2440-15-0x00000000028C0000-0x00000000048C0000-memory.dmp

Filesize
32.0MB

Download
memory/2440-3-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/2440-0-0x0000000002730000-0x00000000027AE000-memory.dmp

Filesize
504KB

Download
memory/2440-17-0x0000000075060000-0x0000000075810000-memory.dmp

Filesize
7.7MB

Download