amadey | 9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3

Analysis

max time kernel
290s
max time network
306s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
29-03-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
Size

441KB
MD5

258e294a16170fba05529bcce0263608
SHA1

50cc521dd5b5a9aa0e47870bc6dffa651ea7ae34
SHA256

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3
SHA512

7f015af852be227e970e27ad2733fd8eaa076795faad34f01f3615656dcc62b3eae72d63fb2930cac8330917ceb843b30fad2e7e9bb34352681691c6e7c8fe3f
SSDEEP

6144:h0h+V80D4cOyLE6lE/AW2BhkFvKwkZ+eXH+wVM21+rmqmvGIF:h++V80DXOn6luAjh+bwVMMd

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Drops file in Windows directory 1 IoCs

Processes:

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job 9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5016	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
1156	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
524	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
2484	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
3052	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
3528	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
4568	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
2080	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
2248	4176	WerFault.exe	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

pid process

4176 9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

pid	process
4176	9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe

C:\Users\Admin\AppData\Local\Temp\9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe
"C:\Users\Admin\AppData\Local\Temp\9f30da97a5d57aaed356a17e8346988c899f4882e2e3f0156cb5c78951ee4ef3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 692
2⤵
- Program crash
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 740
2⤵
- Program crash
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 812
2⤵
- Program crash
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 820
2⤵
- Program crash
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 860
2⤵
- Program crash
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 836
2⤵
- Program crash
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1064
2⤵
- Program crash
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1104
2⤵
- Program crash
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1080
2⤵
- Program crash
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4176-1-0x0000000000E10000-0x0000000000F10000-memory.dmp

Filesize
1024KB

Download
memory/4176-2-0x00000000027B0000-0x000000000281F000-memory.dmp

Filesize
444KB

Download
memory/4176-3-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4176-5-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4176-6-0x00000000027B0000-0x000000000281F000-memory.dmp

Filesize
444KB

Download
memory/4176-8-0x0000000000E10000-0x0000000000F10000-memory.dmp

Filesize
1024KB

Download