amadey | 21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

1.8MB
MD5

97256cf11c9109c24fde65395fef1306
SHA1

e60278d8383912f03f25e3f92bf558e2a33f229d
SHA256

21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934
SHA512

41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e
SSDEEP

24576:rGpVQOAoqyDshVag6Vu4luUR/oF1av5H/BNMVMmFTMqITdpE4bTJ5/kOG01N74:rBoqyDBVZAoCyQzITdpBvJ5U01K

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://185.172.128.3

Attributes

install_dir
One_Dragon_Center
install_file
MSI.CentralServer.exe
strings_key
fd2f5851d3165c210396dcbe9930d294
url_paths
/QajE3OBS/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

MSI.CentralServer.exe

pid process

632 MSI.CentralServer.exe
Drops file in Windows directory 1 IoCs

Processes:

tmp.exe

description ioc process

File created C:\Windows\Tasks\MSI.CentralServer.job tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
632	MSI.CentralServer.exe

description	ioc	process
File created	C:\Windows\Tasks\MSI.CentralServer.job	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Windows directory
PID:4400

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
- Executes dropped EXE
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe

Filesize
1.8MB

MD5
97256cf11c9109c24fde65395fef1306

SHA1
e60278d8383912f03f25e3f92bf558e2a33f229d

SHA256
21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

SHA512
41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e

Download Submit
memory/632-9-0x0000000002590000-0x00000000025FC000-memory.dmp

Filesize
432KB

Download
memory/632-10-0x0000000002590000-0x00000000025FC000-memory.dmp

Filesize
432KB

Download
memory/632-11-0x0000000002590000-0x00000000025FC000-memory.dmp

Filesize
432KB

Download
memory/4400-0-0x0000000002EE0000-0x0000000002F4C000-memory.dmp

Filesize
432KB

Download
memory/4400-1-0x0000000002EE0000-0x0000000002F4C000-memory.dmp

Filesize
432KB

Download
memory/4400-6-0x0000000002EE0000-0x0000000002F4C000-memory.dmp

Filesize
432KB

Download