amadey | 29a1b2044662e0dd7f3059854ed7d49d2511eca878ecf4aad8664292e62dd2d5

Analysis

max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Small Malwares/b9695770f1/Dctooux.exe
Size

493KB
MD5

b7a26c9dadcbae2e051249a60f140d13
SHA1

a182b26486812a906c2ffa378a80757ed80eee31
SHA256

962cca9204f7efb95be4e5527de264977482414640bb5e8b56113036fe280460
SHA512

b65e4187178031e705f2cf9a64a248331b4ad491549fd7ed82b521c9d4421eb9b7a85b486d633681a76f830db5a79177daee15efd59f0c0efe311337343781a2
SSDEEP

6144:if0tTd7LNEY+uVKBt2vZuRS+4nBDfKxc+rWC8+LtmImC8BG0qEjWYkH1WT/:iCTd/Nz+usBshu74lfH+yCrC97xkg

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Dctooux.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Dctooux.exe
Executes dropped EXE 2 IoCs

Processes:

Dctooux.exeDctooux.exe

pid process

1228 Dctooux.exe
3180 Dctooux.exe
Drops file in Windows directory 1 IoCs

Processes:

Dctooux.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job Dctooux.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Dctooux.exe

pid	process
1228	Dctooux.exe
3180	Dctooux.exe

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	Dctooux.exe

Program crash 30 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4816	1480	WerFault.exe	Dctooux.exe
3184	1480	WerFault.exe	Dctooux.exe
2468	1480	WerFault.exe	Dctooux.exe
4704	1480	WerFault.exe	Dctooux.exe
3816	1480	WerFault.exe	Dctooux.exe
1488	1480	WerFault.exe	Dctooux.exe
4868	1480	WerFault.exe	Dctooux.exe
3904	1480	WerFault.exe	Dctooux.exe
4484	1480	WerFault.exe	Dctooux.exe
4476	1480	WerFault.exe	Dctooux.exe
3344	1480	WerFault.exe	Dctooux.exe
888	1480	WerFault.exe	Dctooux.exe
1820	1480	WerFault.exe	Dctooux.exe
208	1228	WerFault.exe	Dctooux.exe
4808	1228	WerFault.exe	Dctooux.exe
3152	1228	WerFault.exe	Dctooux.exe
4836	1228	WerFault.exe	Dctooux.exe
3912	1228	WerFault.exe	Dctooux.exe
648	1228	WerFault.exe	Dctooux.exe
4664	1228	WerFault.exe	Dctooux.exe
2148	1228	WerFault.exe	Dctooux.exe
3956	1228	WerFault.exe	Dctooux.exe
5100	1228	WerFault.exe	Dctooux.exe
1404	1228	WerFault.exe	Dctooux.exe
2476	1228	WerFault.exe	Dctooux.exe
2364	1228	WerFault.exe	Dctooux.exe
448	1228	WerFault.exe	Dctooux.exe
5076	1228	WerFault.exe	Dctooux.exe
4420	1228	WerFault.exe	Dctooux.exe
3840	3180	WerFault.exe	Dctooux.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Dctooux.exe

pid process

1480 Dctooux.exe

pid	process
1480	Dctooux.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Dctooux.exe

description	pid	process	target process
PID 1480 wrote to memory of 1228	1480	Dctooux.exe	Dctooux.exe
PID 1480 wrote to memory of 1228	1480	Dctooux.exe	Dctooux.exe
PID 1480 wrote to memory of 1228	1480	Dctooux.exe	Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\Small Malwares\b9695770f1\Dctooux.exe
"C:\Users\Admin\AppData\Local\Temp\Small Malwares\b9695770f1\Dctooux.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 760
  2⤵
  - Program crash
  PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 808
  2⤵
  - Program crash
  PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 864
  2⤵
  - Program crash
  PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 872
  2⤵
  - Program crash
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 884
  2⤵
  - Program crash
  PID:3816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 936
  2⤵
  - Program crash
  PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1140
  2⤵
  - Program crash
  PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1200
  2⤵
  - Program crash
  PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1256
  2⤵
  - Program crash
  PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1076
  2⤵
  - Program crash
  PID:4476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 812
  2⤵
  - Program crash
  PID:3344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 880
  2⤵
  - Program crash
  PID:888
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 560
    3⤵
    - Program crash
    PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 600
    3⤵
    - Program crash
    PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 620
    3⤵
    - Program crash
    PID:3152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 592
    3⤵
    - Program crash
    PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 716
    3⤵
    - Program crash
    PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 748
    3⤵
    - Program crash
    PID:648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 748
    3⤵
    - Program crash
    PID:4664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 892
    3⤵
    - Program crash
    PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 952
    3⤵
    - Program crash
    PID:3956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 720
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1016
    3⤵
    - Program crash
    PID:1404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1020
    3⤵
    - Program crash
    PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1404
    3⤵
    - Program crash
    PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1420
    3⤵
    - Program crash
    PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1440
    3⤵
    - Program crash
    PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1456
    3⤵
    - Program crash
    PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1068
  2⤵
  - Program crash
  PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 1480
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1480 -ip 1480
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1480 -ip 1480
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1480 -ip 1480
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1480 -ip 1480
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1480 -ip 1480
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1480 -ip 1480
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1480 -ip 1480
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1480 -ip 1480
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1480 -ip 1480
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1480 -ip 1480
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1480 -ip 1480
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1480 -ip 1480
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1228 -ip 1228
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1228 -ip 1228
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1228 -ip 1228
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1228 -ip 1228
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1228 -ip 1228
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1228 -ip 1228
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1228 -ip 1228
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1228 -ip 1228
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1228 -ip 1228
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1228 -ip 1228
1⤵
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1228 -ip 1228
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1228 -ip 1228
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1228 -ip 1228
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1228 -ip 1228
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1228 -ip 1228
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1228 -ip 1228
1⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 452
  2⤵
  - Program crash
  PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3180 -ip 3180
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\804150937214

Filesize
75KB

MD5
b5fbb36d66e9d9446b9be304ce5508b8

SHA1
6b08db4d0c9c759d49cef7543d096e1309299e0f

SHA256
4bd84ad4da4cdf85ea6536f6bb4959c9b959b11ffb5dd1255b61cd1856bb4691

SHA512
364516d419a77092f3a4580490a0d1aa7dd256dd7d878046124de831c00263d5474c617b47d831c56be589b1e3e96c9f02cdd5605e55e04ca8d3c00202679e48

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Filesize
493KB

MD5
b7a26c9dadcbae2e051249a60f140d13

SHA1
a182b26486812a906c2ffa378a80757ed80eee31

SHA256
962cca9204f7efb95be4e5527de264977482414640bb5e8b56113036fe280460

SHA512
b65e4187178031e705f2cf9a64a248331b4ad491549fd7ed82b521c9d4421eb9b7a85b486d633681a76f830db5a79177daee15efd59f0c0efe311337343781a2

Download Submit
memory/1228-19-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1228-18-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1228-35-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1480-2-0x0000000000920000-0x000000000098B000-memory.dmp

Filesize
428KB

Download
memory/1480-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1480-1-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/1480-16-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1480-17-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3180-38-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/3180-39-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download