amadey | 339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99

Analysis

max time kernel
292s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
29-03-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
Size

442KB
MD5

34468074c946943518ab33be24c01ef9
SHA1

742cf7ff13dcab6a99b372dc99f362f45be3d69c
SHA256

339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99
SHA512

b13def10893e34d5efcb52d5b11b16c14881c27aca7f263d59a19fdad99e27681cd8cee85ba83762772ecbbf4e32eb373006627b932047eff00cbb725e9f942b
SSDEEP

6144:9qIH8p8GgMyYRhuPTMCGzlmJDZWgECsFjKdJtH3s5ZBjnA:9d8p8GgAWP4CYE4BCsmdJFij0

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Drops file in Windows directory 1 IoCs

Processes:

339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job 339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
408	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
1596	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
4564	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
1564	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
1324	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
3732	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
1464	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
3684	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
5068	4584	WerFault.exe	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe

pid process

4584 339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe

pid	process
4584	339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe

C:\Users\Admin\AppData\Local\Temp\339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe
"C:\Users\Admin\AppData\Local\Temp\339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 688
2⤵
- Program crash
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 736
2⤵
- Program crash
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 808
2⤵
- Program crash
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 784
2⤵
- Program crash
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 844
2⤵
- Program crash
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 804
2⤵
- Program crash
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1064
2⤵
- Program crash
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1100
2⤵
- Program crash
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1080
2⤵
- Program crash
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4584-1-0x0000000000D20000-0x0000000000E20000-memory.dmp

Filesize
1024KB

Download
memory/4584-2-0x0000000000CA0000-0x0000000000D0F000-memory.dmp

Filesize
444KB

Download
memory/4584-3-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4584-5-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4584-6-0x0000000000D20000-0x0000000000E20000-memory.dmp

Filesize
1024KB

Download
memory/4584-8-0x0000000000CA0000-0x0000000000D0F000-memory.dmp

Filesize
444KB

Download