amadey | bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458

General

Target

bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
Size

419KB
MD5

27499cf0e73817392b9f50cc9e82c2b3
SHA1

a0efab9cdb4b2a4a920f4ab76095d24806d7812f
SHA256

bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
SHA512

94b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
SSDEEP

6144:dOpt5U2F/o+89gzpGzlpKmu9HiFqVOmZce8dsGlEpD:Q5U2FQ+8+cpKmu9HikghdsG2h

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 5 IoCs

pid	Process
312	Dctooux.exe
2336	Dctooux.exe
1912	Dctooux.exe
4024	Dctooux.exe
2016	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
1800	2580	WerFault.exe	71
4960	2580	WerFault.exe	71
1036	2580	WerFault.exe	71
8	2580	WerFault.exe	71
4440	2580	WerFault.exe	71
4844	2580	WerFault.exe	71
4164	2580	WerFault.exe	71
3584	2580	WerFault.exe	71
4196	2580	WerFault.exe	71
4208	2580	WerFault.exe	71

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe

C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
"C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 688
  2⤵
  - Program crash
  PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 736
  2⤵
  - Program crash
  PID:4960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 808
  2⤵
  - Program crash
  PID:1036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 848
  2⤵
  - Program crash
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 852
  2⤵
  - Program crash
  PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 828
  2⤵
  - Program crash
  PID:4844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1060
  2⤵
  - Program crash
  PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1120
  2⤵
  - Program crash
  PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1188
  2⤵
  - Program crash
  PID:4196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1216
  2⤵
  - Program crash
  PID:4208

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:312

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1912

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4024

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe

Filesize
419KB

MD5
27499cf0e73817392b9f50cc9e82c2b3

SHA1
a0efab9cdb4b2a4a920f4ab76095d24806d7812f

SHA256
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458

SHA512
94b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414

Download Submit
memory/312-17-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

Filesize
1024KB

Download
memory/312-18-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/312-19-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/1912-39-0x0000000000C00000-0x0000000000D00000-memory.dmp

Filesize
1024KB

Download
memory/1912-41-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/1912-40-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2016-63-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2016-62-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2016-61-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Filesize
1024KB

Download
memory/2336-28-0x0000000000BD0000-0x0000000000CD0000-memory.dmp

Filesize
1024KB

Download
memory/2336-29-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2336-30-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2580-1-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

Filesize
1024KB

Download
memory/2580-11-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

Filesize
1024KB

Download
memory/2580-9-0x0000000002770000-0x00000000027DF000-memory.dmp

Filesize
444KB

Download
memory/2580-8-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2580-3-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2580-2-0x0000000002770000-0x00000000027DF000-memory.dmp

Filesize
444KB

Download
memory/4024-50-0x0000000000D60000-0x0000000000E60000-memory.dmp

Filesize
1024KB

Download
memory/4024-51-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4024-52-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download

Analysis

Sharing