amadey | 21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

1.8MB
MD5

97256cf11c9109c24fde65395fef1306
SHA1

e60278d8383912f03f25e3f92bf558e2a33f229d
SHA256

21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934
SHA512

41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e
SSDEEP

24576:rGpVQOAoqyDshVag6Vu4luUR/oF1av5H/BNMVMmFTMqITdpE4bTJ5/kOG01N74:rBoqyDBVZAoCyQzITdpBvJ5U01K

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://185.172.128.3

Attributes

install_dir
One_Dragon_Center
install_file
MSI.CentralServer.exe
strings_key
fd2f5851d3165c210396dcbe9930d294
url_paths
/QajE3OBS/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MSI.CentralServer.job	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-0-0x0000000000360000-0x00000000003CC000-memory.dmp

Filesize
432KB

Download
memory/1908-1-0x0000000000360000-0x00000000003CC000-memory.dmp

Filesize
432KB

Download
memory/1908-3-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1908-7-0x0000000000360000-0x00000000003CC000-memory.dmp

Filesize
432KB

Download