amadey | 21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

Analysis

max time kernel
224s
max time network
277s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
12/02/2024, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934.exe
Size

1.8MB
MD5

97256cf11c9109c24fde65395fef1306
SHA1

e60278d8383912f03f25e3f92bf558e2a33f229d
SHA256

21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934
SHA512

41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e
SSDEEP

24576:rGpVQOAoqyDshVag6Vu4luUR/oF1av5H/BNMVMmFTMqITdpE4bTJ5/kOG01N74:rBoqyDBVZAoCyQzITdpBvJ5U01K

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://185.172.128.3

Attributes

install_dir
One_Dragon_Center
install_file
MSI.CentralServer.exe
strings_key
fd2f5851d3165c210396dcbe9930d294
url_paths
/QajE3OBS/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 1 IoCs

pid	Process
4980	MSI.CentralServer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MSI.CentralServer.job	21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934.exe
"C:\Users\Admin\AppData\Local\Temp\21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934.exe"
1⤵
- Drops file in Windows directory
PID:1020

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
- Executes dropped EXE
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe

Filesize
1.8MB

MD5
97256cf11c9109c24fde65395fef1306

SHA1
e60278d8383912f03f25e3f92bf558e2a33f229d

SHA256
21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

SHA512
41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e

Download Submit
memory/1020-0-0x0000000000790000-0x00000000007FC000-memory.dmp

Filesize
432KB

Download
memory/1020-1-0x0000000000790000-0x00000000007FC000-memory.dmp

Filesize
432KB

Download
memory/1020-6-0x0000000000790000-0x00000000007FC000-memory.dmp

Filesize
432KB

Download
memory/4980-9-0x0000000002A80000-0x0000000002AEC000-memory.dmp

Filesize
432KB

Download
memory/4980-10-0x0000000002A80000-0x0000000002AEC000-memory.dmp

Filesize
432KB

Download
memory/4980-11-0x0000000002A80000-0x0000000002AEC000-memory.dmp

Filesize
432KB

Download