amadey | 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348

General

Target

3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
Size

420KB
MD5

7b432411c12d3d0d31ecaf9011450e42
SHA1

968943d42ba1e8938989b6ed1884195c2285396f
SHA256

3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348
SHA512

6881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b
SSDEEP

6144:lfBwgfV+aXoGJR1xpppStlxu4qGilNZZDLxFLWj4+36o9:l3V+anFxZUq1NZJ9N8qu

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 5 IoCs

Processes:

Dctooux.exeDctooux.exeDctooux.exeDctooux.exeDctooux.exe

pid process

4832 Dctooux.exe
4044 Dctooux.exe
1908 Dctooux.exe
3972 Dctooux.exe
3288 Dctooux.exe
Drops file in Windows directory 1 IoCs

Processes:

3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4832	Dctooux.exe
4044	Dctooux.exe
1908	Dctooux.exe
3972	Dctooux.exe
3288	Dctooux.exe

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
60	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
4000	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
3696	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
3880	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
932	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
3368	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
964	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
4036	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
4112	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
4888	4380	WerFault.exe	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

pid process

4380 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

pid	process
4380	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
"C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:4380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 688
  2⤵
  - Program crash
  PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 740
  2⤵
  - Program crash
  PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 820
  2⤵
  - Program crash
  PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 800
  2⤵
  - Program crash
  PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 848
  2⤵
  - Program crash
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 756
  2⤵
  - Program crash
  PID:3368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1064
  2⤵
  - Program crash
  PID:964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1096
  2⤵
  - Program crash
  PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1168
  2⤵
  - Program crash
  PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1256
  2⤵
  - Program crash
  PID:4888

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1908

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe

Filesize
420KB

MD5
7b432411c12d3d0d31ecaf9011450e42

SHA1
968943d42ba1e8938989b6ed1884195c2285396f

SHA256
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348

SHA512
6881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b

Download Submit
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe

Filesize
22KB

MD5
04c7ab00f3f7eec2fb132afcfb753177

SHA1
5d6e4fb152039cdf0b94f654597e419722c9a884

SHA256
ad076862fe9e683ae0cf373811e65f9debd1e1349c166af165912f0585e187fb

SHA512
79afc683454c0ac5ca777d1b5f154352401c0ad85aabcfbcf9016c013f88104f2e9a675891ac8e1ccd962ac48becaf3dc9d6c5a646f88ab47cd0ac63acc3cbfc

Download Submit
memory/1908-41-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/1908-39-0x0000000000D60000-0x0000000000E60000-memory.dmp

Filesize
1024KB

Download
memory/1908-40-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3288-61-0x0000000000E20000-0x0000000000F20000-memory.dmp

Filesize
1024KB

Download
memory/3288-62-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3288-63-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3972-52-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3972-51-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3972-50-0x0000000000DC0000-0x0000000000EC0000-memory.dmp

Filesize
1024KB

Download
memory/4044-28-0x0000000000C60000-0x0000000000D60000-memory.dmp

Filesize
1024KB

Download
memory/4044-29-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4044-30-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4380-11-0x0000000002720000-0x000000000278F000-memory.dmp

Filesize
444KB

Download
memory/4380-1-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/4380-9-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/4380-8-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4380-3-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4380-2-0x0000000002720000-0x000000000278F000-memory.dmp

Filesize
444KB

Download
memory/4832-19-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4832-18-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4832-17-0x0000000000E90000-0x0000000000F90000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing