Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
06/02/2024, 17:55
General
- Target file.exe
- Size 5.3MB
- Sample240206-whe2dsebej
- SHA256 36a30e606017f573e19072778619ee90c3f20a58d3a428beca5d5da742936e28
Malware Config
Extracted
-
amadey
-
4.15
-
http://185.172.128.63
-
install_dir
6187fcb526
-
install_file
Dctooux.exe
-
strings_key
cd3b2619c9009c441355ae581d53163e
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 7322⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/2600-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2600-28-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-34-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-35-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-36-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-25-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-27-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-29-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-23-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-21-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2600-32-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2948-1-0x00000000746D0000-0x0000000074DBE000-memory.dmp
memory/2948-12-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-19-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-2-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-14-0x0000000000470000-0x0000000000480000-memory.dmp
memory/2948-17-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-13-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-15-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-16-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-11-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-18-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-20-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-0-0x00000000009F0000-0x0000000000F24000-memory.dmp
memory/2948-6-0x0000000006EE0000-0x0000000007072000-memory.dmp
memory/2948-5-0x0000000005B90000-0x0000000005D96000-memory.dmp
memory/2948-4-0x0000000002680000-0x00000000026C0000-memory.dmp
memory/2948-3-0x00000000746D0000-0x0000000074DBE000-memory.dmp
memory/2948-37-0x00000000746D0000-0x0000000074DBE000-memory.dmp