amadey | 1bd25c91b40f8a04e270b281fa8ab00c53357ef3a36dda3cc6704cd54c29635c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
Size

420KB
MD5

7b432411c12d3d0d31ecaf9011450e42
SHA1

968943d42ba1e8938989b6ed1884195c2285396f
SHA256

3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348
SHA512

6881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b
SSDEEP

6144:lfBwgfV+aXoGJR1xpppStlxu4qGilNZZDLxFLWj4+36o9:l3V+anFxZUq1NZJ9N8qu

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Attributes

install_dir
154561dcbf
install_file
Dctooux.exe
strings_key
2cd47fa043c815e1a033c67832f3c6a5
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

Executes dropped EXE 4 IoCs

pid	Process
3292	Dctooux.exe
556	Dctooux.exe
4272	Dctooux.exe
2008	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
5056	432	WerFault.exe	84
2964	432	WerFault.exe	84
2620	432	WerFault.exe	84
2824	432	WerFault.exe	84
4328	432	WerFault.exe	84
3084	432	WerFault.exe	84
1992	432	WerFault.exe	84
1356	432	WerFault.exe	84
1464	432	WerFault.exe	84
1824	432	WerFault.exe	84
456	432	WerFault.exe	84
4136	432	WerFault.exe	84
4896	3292	WerFault.exe	111
4616	3292	WerFault.exe	111
2644	3292	WerFault.exe	111
2392	3292	WerFault.exe	111
4092	3292	WerFault.exe	111
2312	3292	WerFault.exe	111
3104	3292	WerFault.exe	111
2060	3292	WerFault.exe	111
5056	3292	WerFault.exe	111
3484	3292	WerFault.exe	111
4568	3292	WerFault.exe	111
4816	3292	WerFault.exe	111
4836	556	WerFault.exe	140
5012	4272	WerFault.exe	146
3028	3292	WerFault.exe	111
4268	2008	WerFault.exe	151

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
432	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3292	432	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe	111
PID 432 wrote to memory of 3292	432	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe	111
PID 432 wrote to memory of 3292	432	3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe	111

C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
"C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 744
  2⤵
  - Program crash
  PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 784
  2⤵
  - Program crash
  PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 856
  2⤵
  - Program crash
  PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 896
  2⤵
  - Program crash
  PID:2824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 932
  2⤵
  - Program crash
  PID:4328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 912
  2⤵
  - Program crash
  PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1132
  2⤵
  - Program crash
  PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1132
  2⤵
  - Program crash
  PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1236
  2⤵
  - Program crash
  PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 872
  2⤵
  - Program crash
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 552
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 572
    3⤵
    - Program crash
    PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 580
    3⤵
    - Program crash
    PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 724
    3⤵
    - Program crash
    PID:2392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 884
    3⤵
    - Program crash
    PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 848
    3⤵
    - Program crash
    PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 924
    3⤵
    - Program crash
    PID:3104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 924
    3⤵
    - Program crash
    PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 944
    3⤵
    - Program crash
    PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1012
    3⤵
    - Program crash
    PID:3484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1148
    3⤵
    - Program crash
    PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1328
    3⤵
    - Program crash
    PID:4816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 888
    3⤵
    - Program crash
    PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 848
  2⤵
  - Program crash
  PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 768
  2⤵
  - Program crash
  PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 432 -ip 432
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 432 -ip 432
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 432 -ip 432
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 432 -ip 432
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 432 -ip 432
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 432 -ip 432
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 432 -ip 432
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 432 -ip 432
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 432 -ip 432
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 432 -ip 432
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 432 -ip 432
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 432 -ip 432
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3292 -ip 3292
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3292 -ip 3292
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3292 -ip 3292
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3292 -ip 3292
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3292 -ip 3292
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3292 -ip 3292
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3292 -ip 3292
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3292 -ip 3292
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3292 -ip 3292
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3292 -ip 3292
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3292 -ip 3292
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3292 -ip 3292
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 448
  2⤵
  - Program crash
  PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 556 -ip 556
1⤵
PID:1356

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 448
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4272 -ip 4272
1⤵
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3292 -ip 3292
1⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 444
  2⤵
  - Program crash
  PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2008 -ip 2008
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\084619521222

Filesize
80KB

MD5
c2e3f8dffcfccd1deea6912360566f3c

SHA1
4056acf45c04d68f88d9c67634d6c3b6426ec1cd

SHA256
0f2975954caded3a0bd023d2e5a93fe451bf05ea2ac089ad802d381b31e001a7

SHA512
f6f4801c49d802932073972a0a8abb956fd9dea84d2b57e456f991dda3f1aacb383f8b36b257bc64706aa2423cde5f7c5c19e483e252118f40b08d618733c4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe

Filesize
420KB

MD5
7b432411c12d3d0d31ecaf9011450e42

SHA1
968943d42ba1e8938989b6ed1884195c2285396f

SHA256
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348

SHA512
6881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b

Download Submit
memory/432-2-0x0000000002860000-0x00000000028CF000-memory.dmp

Filesize
444KB

Download
memory/432-3-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/432-24-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/432-1-0x0000000000B40000-0x0000000000C40000-memory.dmp

Filesize
1024KB

Download
memory/556-35-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/556-32-0x0000000000B50000-0x0000000000C50000-memory.dmp

Filesize
1024KB

Download
memory/556-34-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2008-62-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2008-61-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/2008-60-0x0000000000C80000-0x0000000000D80000-memory.dmp

Filesize
1024KB

Download
memory/3292-33-0x0000000000B40000-0x0000000000C40000-memory.dmp

Filesize
1024KB

Download
memory/3292-29-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3292-41-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3292-23-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/3292-22-0x0000000002650000-0x00000000026BF000-memory.dmp

Filesize
444KB

Download
memory/3292-21-0x0000000000B40000-0x0000000000C40000-memory.dmp

Filesize
1024KB

Download
memory/4272-49-0x0000000000D10000-0x0000000000E10000-memory.dmp

Filesize
1024KB

Download
memory/4272-50-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4272-51-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download