amadey | b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3

Analysis

max time kernel
95s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 09:51

Target

tmp.exe
Size

595KB
MD5

2060ab69656588e8acefcde9c7cc0a5f
SHA1

f4501b82e348b38cf4f877bff1c1447828585c6a
SHA256

b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3
SHA512

10f3447e6cd5a065184395368825030951c62e6c59f980399f832b0862ae09d8db20b7557c4b25917ca78c92750dfb9654e5064fc860a5a6abff198574fa6573
SSDEEP

12288:ih1Fk70TnvjcWYbRQsBTNcHG2k+Nfw3HtUZwi+rRvoR9yrc4+GX:Mk70TrcWYbmsBxN2otUf+Yyrc0X

Score

10^/10

amadey trojan

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

rc4.plain

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/2804-0-0x0000000002840000-0x00000000028BE000-memory.dmp	net_reactor
behavioral2/memory/2804-6-0x00000000053F0000-0x000000000546C000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 2804 set thread context of 2892 2804 tmp.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4768 2892 WerFault.exe RegAsm.exe

description	pid	process	target process
PID 2804 set thread context of 2892	2804	tmp.exe	RegAsm.exe

pid	pid_target	process	target process
4768	2892	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe
PID 2804 wrote to memory of 2892	2804	tmp.exe	RegAsm.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2892 -ip 2892
1⤵
PID:3968

memory/2804-6-0x00000000053F0000-0x000000000546C000-memory.dmp

Filesize
496KB

Download
memory/2804-1-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2804-2-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/2804-3-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/2804-4-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/2804-5-0x0000000004E40000-0x00000000053E4000-memory.dmp

Filesize
5.6MB

Download
memory/2804-0-0x0000000002840000-0x00000000028BE000-memory.dmp

Filesize
504KB

Download
memory/2804-7-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/2804-14-0x0000000002900000-0x0000000004900000-memory.dmp

Filesize
32.0MB

Download
memory/2804-18-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2892-10-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2892-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2892-17-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2892-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download