Analysis
- max time kernel
290s - max time network
304s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
28/03/2024, 22:27
General
- Target 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
- Size 420KB
- Sample240328-2c3hdsac21
- SHA256 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348
Malware Config
Extracted
-
amadey
-
4.18
-
install_dir
154561dcbf
-
install_file
Dctooux.exe
-
strings_key
2cd47fa043c815e1a033c67832f3c6a5
-
url_paths
/j4Fvskd3/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Executes dropped EXE 5 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 10 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe"C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 6922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 7402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 8122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 8202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 8482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 8602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 10642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 10922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 11682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 12242⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Dctooux.exe
memory/1356-41-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/1356-40-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/1356-39-0x0000000000CB0000-0x0000000000DB0000-memory.dmp
memory/3132-11-0x0000000000CF0000-0x0000000000DF0000-memory.dmp
memory/3132-8-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/3132-9-0x0000000000C60000-0x0000000000CCF000-memory.dmp
memory/3132-1-0x0000000000CF0000-0x0000000000DF0000-memory.dmp
memory/3132-2-0x0000000000C60000-0x0000000000CCF000-memory.dmp
memory/3132-3-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4504-51-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4504-50-0x0000000000E50000-0x0000000000F50000-memory.dmp
memory/4504-52-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4728-29-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4728-30-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4728-28-0x0000000000DC0000-0x0000000000EC0000-memory.dmp
memory/4944-19-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4944-18-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/4944-17-0x0000000000D50000-0x0000000000E50000-memory.dmp
memory/5100-61-0x0000000000BE0000-0x0000000000CE0000-memory.dmp
memory/5100-62-0x0000000000400000-0x0000000000B12000-memory.dmp
memory/5100-63-0x0000000000400000-0x0000000000B12000-memory.dmp