amadey | 9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3

Analysis

max time kernel
291s
max time network
293s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
28-03-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
Size

441KB
MD5

258e294a16170fba05529bcce0263608
SHA1

50cc521dd5b5a9aa0e47870bc6dffa651ea7ae34
SHA256

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3
SHA512

7f015af852be227e970e27ad2733fd8eaa076795faad34f01f3615656dcc62b3eae72d63fb2930cac8330917ceb843b30fad2e7e9bb34352681691c6e7c8fe3f
SSDEEP

6144:h0h+V80D4cOyLE6lE/AW2BhkFvKwkZ+eXH+wVM21+rmqmvGIF:h++V80DXOn6luAjh+bwVMMd

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Drops file in Windows directory 1 IoCs

Processes:

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job 9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3728	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
3592	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
4108	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
3432	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
4412	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
2032	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
520	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
4292	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
3008	2520	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

C:\Users\Admin\AppData\Local\Temp\9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
"C:\Users\Admin\AppData\Local\Temp\9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe"
1⤵
- Drops file in Windows directory
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 700
2⤵
- Program crash
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 740
2⤵
- Program crash
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 816
2⤵
- Program crash
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 824
2⤵
- Program crash
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 860
2⤵
- Program crash
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 836
2⤵
- Program crash
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1060
2⤵
- Program crash
PID:520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1088
2⤵
- Program crash
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1132
2⤵
- Program crash
PID:3008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-1-0x0000000000D30000-0x0000000000E30000-memory.dmp

Filesize
1024KB

Download
memory/2520-2-0x0000000000C80000-0x0000000000CEF000-memory.dmp

Filesize
444KB

Download
memory/2520-3-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/2520-5-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/2520-6-0x0000000000C80000-0x0000000000CEF000-memory.dmp

Filesize
444KB

Download
memory/2520-8-0x0000000000D30000-0x0000000000E30000-memory.dmp

Filesize
1024KB

Download