amadey | 5fa605bf9666dc9486a83737d1f77e241bb27a033e609625499f17dbf608e840

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
am.exe
Size 8.1MB
Sample240403-he7qcaab9t
SHA256 5fa605bf9666dc9486a83737d1f77e241bb27a033e609625499f17dbf608e840
MD5 31fd3d2bdee0fd45c35273bebe4907fa
SHA1 e464d8d3e5a16c0484ecb40e0599a3b4ad1e3f21
SHA512 5a5558811d5a167db43a0a96679f253c3692921e59bc61708a66f6f55458441bb3c3bdc24896eefabd5f2edfb6c87b87be520bd8abd29b0428d831d24ae947b9
SSDEEP 196608:Z0SPWFEHfuhw52hhflik2kYrq/d/wNHP7as4v:Zgqfuhw0hmZry4NesG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.19

http://bestofthebesttraining.com

Attributes

install_dir
763b1308d2
install_file
Dctooux.exe
strings_key
039c1d21f5b79a4ad9168019f3454a0c
url_paths
/8BvxwQdec3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2352 set thread context of 3404	2352	am.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2352	am.exe
2352	am.exe
3404	cmd.exe
3404	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2352	am.exe
3404	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3404	2352	am.exe	90
PID 2352 wrote to memory of 3404	2352	am.exe	90
PID 2352 wrote to memory of 3404	2352	am.exe	90
PID 2352 wrote to memory of 3404	2352	am.exe	90
PID 3404 wrote to memory of 1312	3404	cmd.exe	100
PID 3404 wrote to memory of 1312	3404	cmd.exe	100
PID 3404 wrote to memory of 1312	3404	cmd.exe	100
PID 3404 wrote to memory of 1312	3404	cmd.exe	100
PID 3404 wrote to memory of 1312	3404	cmd.exe	100
PID 3404 wrote to memory of 1312	3404	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\am.exe
"C:\Users\Admin\AppData\Local\Temp\am.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8f033950

Path C:\Users\Admin\AppData\Local\Temp\8f033950
Size 1.2MB
SHA256 d36db54ce9a87b04c1f60954f43c5adb5c88e52241e20e33460471567618bff1
MD5 c47b3e59f451975dd277c637e1636f43
SHA1 a86a805c219806a82352d76a6a89dbc61334e3b4
SHA512 65aac733d4528de6fc55b725680b7cea3b3382e811552d12054b557c624d3c75612960fcf6e135fede47149e628c1ddb2b3c65ff1ce38cfc742c2d1f065c4742
SSDEEP 24576:BU+0Uern1NysUUXWnIxZTf9uOX08UZZcifIII1lZ+1kxywJlAc:BUSer1Nys/XfirlIkfYAc
MD5 SHA1 SHA512 SSDEEP

Submit Download

93842f12

Path C:\Users\Admin\AppData\Local\Temp\93842f12
Size 1.1MB
SHA256 33ff6cdb1602d7694e0f4e80e518fd1f708f6f9b3bf40334894191c6a961da12
MD5 ced3fadfa2b86b0f156cfbd47d186805
SHA1 ff321a5fa6e064f56d6f4302ea084780a47e043f
SHA512 eed59c81324e3e0aeeb99d5cb120389e1585a1e717df954b1556997419ba3a85839c6350478e068123ba2b3fa1ba62a2c2f1827bd53800a76d11fed1aff396e9
SSDEEP 24576:DlARFge5MGL5C8yuYDrhNCD9sW2b2FQfKEM9XjBn:DlAT5KGLRyuIrhNCD9BG2BEM9Xtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1312-26-0x00000000012C0000-0x000000000132E000-memory.dmp

Download

memory/1312-24-0x00000000012C0000-0x000000000132E000-memory.dmp

Download

memory/1312-23-0x00007FFDAC4D0000-0x00007FFDAC6C5000-memory.dmp

Download

memory/1312-21-0x00000000012C0000-0x000000000132E000-memory.dmp

Download

memory/2352-8-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download

memory/2352-9-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download

memory/2352-0-0x0000000000080000-0x0000000000418000-memory.dmp

Download

memory/2352-7-0x00007FFDAC4D0000-0x00007FFDAC6C5000-memory.dmp

Download

memory/2352-6-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download

memory/3404-11-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download

memory/3404-13-0x00007FFDAC4D0000-0x00007FFDAC6C5000-memory.dmp

Download

memory/3404-15-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download

memory/3404-16-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download

memory/3404-20-0x0000000074D40000-0x0000000074EBB000-memory.dmp

Download