Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 01:56

General

  • Target

    c92ec1cea5a09af2f334a2e0d127f41827855c21c5e725afb702ec29e705d1f3.exe

  • Size

    436KB

  • MD5

    f6ee2a295cd2ba584f9a363ade3d55b3

  • SHA1

    c6966445c9adf9a0afe1a62b91d1e4f75c5ac55c

  • SHA256

    c92ec1cea5a09af2f334a2e0d127f41827855c21c5e725afb702ec29e705d1f3

  • SHA512

    7db8c37f43efc0414e394dfe3c335e8073dcc53f11093dd9452a750c34b2e16fc058f83fdddbb17b430ac501aabc6af6b03b23afa7826ccac1678f86546b025b

  • SSDEEP

    6144:vZLBvj27DEXhnzCaknvrhHq6p5Km/OZ2iqzUhYA0FvYgtv3EagG64/dAdUcgf:hd72YmQ/mWZUzGUvYgt8FGBxcg

Malware Config

Extracted

Family

amadey

Version

4.19

Attributes
  • install_dir

    cbb1d94791

  • install_file

    Dctooux.exe

  • strings_key

    fcebaf717c71f51f8908b537784e2bee

  • url_paths

    /8bjndDcoA3/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c92ec1cea5a09af2f334a2e0d127f41827855c21c5e725afb702ec29e705d1f3.exe
    "C:\Users\Admin\AppData\Local\Temp\c92ec1cea5a09af2f334a2e0d127f41827855c21c5e725afb702ec29e705d1f3.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 752
      2⤵
      • Program crash
      PID:2520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 776
      2⤵
      • Program crash
      PID:2596
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 860
      2⤵
      • Program crash
      PID:4852
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 920
      2⤵
      • Program crash
      PID:2548
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 860
      2⤵
      • Program crash
      PID:2248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 872
      2⤵
      • Program crash
      PID:4880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1128
      2⤵
      • Program crash
      PID:2592
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1180
      2⤵
      • Program crash
      PID:116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1240
      2⤵
      • Program crash
      PID:4560
    • C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 552
        3⤵
        • Program crash
        PID:2004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 560
        3⤵
        • Program crash
        PID:4072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 572
        3⤵
        • Program crash
        PID:5064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 632
        3⤵
        • Program crash
        PID:4384
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 880
        3⤵
        • Program crash
        PID:3504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 916
        3⤵
        • Program crash
        PID:1244
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 932
        3⤵
        • Program crash
        PID:3408
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 628
        3⤵
        • Program crash
        PID:916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 912
        3⤵
        • Program crash
        PID:1824
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1012
        3⤵
        • Program crash
        PID:1932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1128
        3⤵
        • Program crash
        PID:872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1320
        3⤵
        • Program crash
        PID:2576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1572
        3⤵
        • Program crash
        PID:2928
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            5⤵
              PID:4648
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\288054676187_Desktop.zip' -CompressionLevel Optimal
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:908
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:3116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1100
          3⤵
          • Program crash
          PID:5024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1624
          3⤵
          • Program crash
          PID:1504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1028
          3⤵
          • Program crash
          PID:4980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1288
        2⤵
        • Program crash
        PID:3364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 348 -ip 348
      1⤵
        PID:2480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 348 -ip 348
        1⤵
          PID:1820
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 348 -ip 348
          1⤵
            PID:2928
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 348 -ip 348
            1⤵
              PID:3932
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 348 -ip 348
              1⤵
                PID:1604
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 348 -ip 348
                1⤵
                  PID:5040
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 348 -ip 348
                  1⤵
                    PID:3148
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 348 -ip 348
                    1⤵
                      PID:740
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 348 -ip 348
                      1⤵
                        PID:1720
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 348 -ip 348
                        1⤵
                          PID:4916
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1392 -ip 1392
                          1⤵
                            PID:3780
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1392 -ip 1392
                            1⤵
                              PID:2348
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1392 -ip 1392
                              1⤵
                                PID:4796
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1392 -ip 1392
                                1⤵
                                  PID:3096
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1392 -ip 1392
                                  1⤵
                                    PID:1984
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1392 -ip 1392
                                    1⤵
                                      PID:4740
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1392 -ip 1392
                                      1⤵
                                        PID:1968
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1392 -ip 1392
                                        1⤵
                                          PID:4488
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1392 -ip 1392
                                          1⤵
                                            PID:4512
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1392 -ip 1392
                                            1⤵
                                              PID:2340
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1392 -ip 1392
                                              1⤵
                                                PID:1344
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1392 -ip 1392
                                                1⤵
                                                  PID:1336
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1392 -ip 1392
                                                  1⤵
                                                    PID:4736
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1392 -ip 1392
                                                    1⤵
                                                      PID:1684
                                                    • C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe
                                                      C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:3040
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 440
                                                        2⤵
                                                        • Program crash
                                                        PID:2640
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3040 -ip 3040
                                                      1⤵
                                                        PID:2500
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1392 -ip 1392
                                                        1⤵
                                                          PID:4968
                                                        • C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe
                                                          C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:2656
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 444
                                                            2⤵
                                                            • Program crash
                                                            PID:3688
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2656 -ip 2656
                                                          1⤵
                                                            PID:4584
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1392 -ip 1392
                                                            1⤵
                                                              PID:1836

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\288054676187

                                                              Filesize

                                                              82KB

                                                              MD5

                                                              ffb161bc9496f7752f90276f38c1023d

                                                              SHA1

                                                              b9c63dd0e04d40ea8825d36f91fe13441c465e5a

                                                              SHA256

                                                              71520ba8b5c81f320b57e88e3c98591f2b2229cd41409382d6cb1d79aa5e81b5

                                                              SHA512

                                                              caae8a5eda40e8cea421941cfaa00d59ba0bc9758541c2322e44ce2412d42b296a7e5b06c311158c832b521c26fa1e40957a9a754255d623ead704f596305e08

                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s4zd3j5i.hdi.ps1

                                                              Filesize

                                                              60B

                                                              MD5

                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                              SHA1

                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                              SHA256

                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                              SHA512

                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                            • C:\Users\Admin\AppData\Local\Temp\cbb1d94791\Dctooux.exe

                                                              Filesize

                                                              436KB

                                                              MD5

                                                              f6ee2a295cd2ba584f9a363ade3d55b3

                                                              SHA1

                                                              c6966445c9adf9a0afe1a62b91d1e4f75c5ac55c

                                                              SHA256

                                                              c92ec1cea5a09af2f334a2e0d127f41827855c21c5e725afb702ec29e705d1f3

                                                              SHA512

                                                              7db8c37f43efc0414e394dfe3c335e8073dcc53f11093dd9452a750c34b2e16fc058f83fdddbb17b430ac501aabc6af6b03b23afa7826ccac1678f86546b025b

                                                            • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll

                                                              Filesize

                                                              109KB

                                                              MD5

                                                              647ac550e51ad6d7e47a6f1e94e11fd2

                                                              SHA1

                                                              433991b760cbfd265d45240891300c3652aefe6f

                                                              SHA256

                                                              4d743335ff8cdf1e505f4bd82b0efafde077b9bf0f88a615db99feada880e3ba

                                                              SHA512

                                                              5a2905133e53490dcfdad84b65525f2925d1e82a609ad0ff551d8d90a3c61a3a58b370056b84aa5c33db71f49fffb86e58284dc317a3541d6f5572438e428bfb

                                                            • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll

                                                              Filesize

                                                              1.2MB

                                                              MD5

                                                              877cb2f10c78a046d81f678f88d7a6a1

                                                              SHA1

                                                              0ecc4a6282a412802756dc5bfd1e60cf789f2687

                                                              SHA256

                                                              2caf66964f582a9a1add1f13205f8797f2f4e791d980000ea6b55c719c174ed2

                                                              SHA512

                                                              9a8ea29fcfcf2a4e274095819ba27261bf551c976b697ccc6fe0598d13c309042e317ec8a32d2a9dec38ebd8223fc6c9e08daf5c611cdc72c11c8fe91baf3399

                                                            • memory/348-20-0x00000000049F0000-0x0000000004A5F000-memory.dmp

                                                              Filesize

                                                              444KB

                                                            • memory/348-19-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/348-1-0x0000000002DF0000-0x0000000002EF0000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/348-2-0x00000000049F0000-0x0000000004A5F000-memory.dmp

                                                              Filesize

                                                              444KB

                                                            • memory/348-3-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/908-65-0x00007FFA324B0000-0x00007FFA32F71000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                            • memory/908-49-0x00000196EA140000-0x00000196EA162000-memory.dmp

                                                              Filesize

                                                              136KB

                                                            • memory/908-59-0x00000196EC460000-0x00000196EC46A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                            • memory/908-54-0x00007FFA324B0000-0x00007FFA32F71000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                            • memory/908-56-0x00000196EA020000-0x00000196EA030000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/908-55-0x00000196EA020000-0x00000196EA030000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/908-57-0x00000196EA020000-0x00000196EA030000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/908-58-0x00000196EC470000-0x00000196EC482000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/1392-22-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/1392-32-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/1392-66-0x0000000002C90000-0x0000000002D90000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/1392-67-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/1392-21-0x0000000002C90000-0x0000000002D90000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/1392-78-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/2656-92-0x0000000002D80000-0x0000000002E80000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/2656-93-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/2656-94-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/3040-81-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/3040-82-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB

                                                            • memory/3040-83-0x0000000000400000-0x0000000002C4F000-memory.dmp

                                                              Filesize

                                                              40.3MB