amadey | be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81

Analysis

max time kernel
291s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
21-03-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
Size

411KB
MD5

cb0abfec359d8dbf934857d9448c898a
SHA1

51a64cf93eee96dd1b885e51f363e86acd2ff98b
SHA256

be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81
SHA512

ea5dd2d297f5b98e1f73bbfc782421241ea1205c411f017841d64a9e60774c010187188e48481cbe2c37868cff033664f24f38371dd3ef9951b5a94ef35313a3
SSDEEP

6144:Pm6VY1xewHVboL706awaWqgIorlzanEcD2pStdHFIm09r8wuOXzbHszA:u6VY1xxK7X/aWIgzxvpSFm93/iA

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Drops file in Windows directory 1 IoCs

Processes:

be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2772	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
5000	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
2164	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
2448	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
4464	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
4788	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
3108	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
3760	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
4752	3836	WerFault.exe	be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe

C:\Users\Admin\AppData\Local\Temp\be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe
"C:\Users\Admin\AppData\Local\Temp\be331c725bb8691b4cdc441bff8dac6138ad5498f48177691ce311a08a3a1b81.exe"
1⤵
- Drops file in Windows directory
PID:3836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 688
  2⤵
  - Program crash
  PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 740
  2⤵
  - Program crash
  PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 812
  2⤵
  - Program crash
  PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 788
  2⤵
  - Program crash
  PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 848
  2⤵
  - Program crash
  PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 824
  2⤵
  - Program crash
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1064
  2⤵
  - Program crash
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1120
  2⤵
  - Program crash
  PID:3760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1036
  2⤵
  - Program crash
  PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-1-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download
memory/3836-2-0x0000000002150000-0x00000000021BF000-memory.dmp

Filesize
444KB

Download
memory/3836-3-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/3836-5-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/3836-6-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download
memory/3836-8-0x0000000002150000-0x00000000021BF000-memory.dmp

Filesize
444KB

Download