amadey | 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe
Size

442KB
MD5

0172a14cc31c07e8297ea92083c94551
SHA1

457abd00a63729c1a5ed3f259e9d2865184a9f3d
SHA256

8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5
SHA512

1a9c6f225e44015485fda7531233bcf09e5303965aed791475de1b783f00574d6d2cd2424e7eb3df3a57884420564ab8f733541e7ed01dacc591a370e4de326f
SSDEEP

12288:MUwAyBoj109MuP7/EQv2xZvOaOujZpHGY:b6SuMuLIxzX1UY

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe

Executes dropped EXE 3 IoCs

pid	Process
3964	Dctooux.exe
548	Dctooux.exe
2960	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
3992	1424	WerFault.exe	89
4840	1424	WerFault.exe	89
2980	1424	WerFault.exe	89
3480	1424	WerFault.exe	89
3440	1424	WerFault.exe	89
3880	1424	WerFault.exe	89
3632	1424	WerFault.exe	89
1328	1424	WerFault.exe	89
3864	1424	WerFault.exe	89
3124	1424	WerFault.exe	89
1160	3964	WerFault.exe	114
4372	3964	WerFault.exe	114
3548	3964	WerFault.exe	114
3484	3964	WerFault.exe	114
3776	3964	WerFault.exe	114
820	3964	WerFault.exe	114
2980	3964	WerFault.exe	114
2192	3964	WerFault.exe	114
3500	3964	WerFault.exe	114
1932	3964	WerFault.exe	114
3468	3964	WerFault.exe	114
3636	3964	WerFault.exe	114
1376	3964	WerFault.exe	114
1320	3964	WerFault.exe	114
1768	3964	WerFault.exe	114
2908	3964	WerFault.exe	114
5112	548	WerFault.exe	152
1376	2960	WerFault.exe	156
3000	3964	WerFault.exe	114

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1424	8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 3964	1424	8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe	114
PID 1424 wrote to memory of 3964	1424	8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe	114
PID 1424 wrote to memory of 3964	1424	8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe	114

C:\Users\Admin\AppData\Local\Temp\8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe
"C:\Users\Admin\AppData\Local\Temp\8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 756
  2⤵
  - Program crash
  PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 804
  2⤵
  - Program crash
  PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 860
  2⤵
  - Program crash
  PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 868
  2⤵
  - Program crash
  PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 864
  2⤵
  - Program crash
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 920
  2⤵
  - Program crash
  PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1144
  2⤵
  - Program crash
  PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1136
  2⤵
  - Program crash
  PID:1328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1164
  2⤵
  - Program crash
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 556
    3⤵
    - Program crash
    PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 564
    3⤵
    - Program crash
    PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 596
    3⤵
    - Program crash
    PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 664
    3⤵
    - Program crash
    PID:3484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 724
    3⤵
    - Program crash
    PID:3776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 888
    3⤵
    - Program crash
    PID:820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 696
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 888
    3⤵
    - Program crash
    PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 888
    3⤵
    - Program crash
    PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 680
    3⤵
    - Program crash
    PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1016
    3⤵
    - Program crash
    PID:3468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1168
    3⤵
    - Program crash
    PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1228
    3⤵
    - Program crash
    PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1240
    3⤵
    - Program crash
    PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1240
    3⤵
    - Program crash
    PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1300
    3⤵
    - Program crash
    PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 892
    3⤵
    - Program crash
    PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1332
  2⤵
  - Program crash
  PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1424 -ip 1424
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1424 -ip 1424
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1424 -ip 1424
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1424 -ip 1424
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1424 -ip 1424
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1424 -ip 1424
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1424 -ip 1424
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1424 -ip 1424
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1424 -ip 1424
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1424 -ip 1424
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3964 -ip 3964
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3964 -ip 3964
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3964 -ip 3964
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3964 -ip 3964
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3964 -ip 3964
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3964 -ip 3964
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3964 -ip 3964
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3964 -ip 3964
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3964 -ip 3964
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3964 -ip 3964
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 3964
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 3964
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3964 -ip 3964
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3964 -ip 3964
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3964 -ip 3964
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3964 -ip 3964
1⤵
PID:2708

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 444
  2⤵
  - Program crash
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 548 -ip 548
1⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 452
  2⤵
  - Program crash
  PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2960 -ip 2960
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 3964
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\808065738166

Filesize
84KB

MD5
9b7db0d8c611500850a73f324cc7ab39

SHA1
002df99af9ca70637671df24bbcd3becc9e34597

SHA256
24da57310920392548fa59d68dc3ffa92b5467b5b11edcf4e71dd6b6ab9f1373

SHA512
a58a40b0eb6d6746ac42d788e5fe735394f1a3764e31d6b866c599742e2c85fef72bdebdf01a98bd95320f7ba936611ec45bbdedabddab81da4e257b2fcc36eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Filesize
442KB

MD5
0172a14cc31c07e8297ea92083c94551

SHA1
457abd00a63729c1a5ed3f259e9d2865184a9f3d

SHA256
8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5

SHA512
1a9c6f225e44015485fda7531233bcf09e5303965aed791475de1b783f00574d6d2cd2424e7eb3df3a57884420564ab8f733541e7ed01dacc591a370e4de326f

Download Submit
memory/548-34-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/548-33-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/1424-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1424-1-0x0000000000A70000-0x0000000000B70000-memory.dmp

Filesize
1024KB

Download
memory/1424-19-0x0000000000800000-0x000000000086B000-memory.dmp

Filesize
428KB

Download
memory/1424-18-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/1424-5-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/1424-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1424-2-0x0000000000800000-0x000000000086B000-memory.dmp

Filesize
428KB

Download
memory/2960-50-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/3964-17-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/3964-25-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download
memory/3964-42-0x0000000000400000-0x00000000006A7000-memory.dmp

Filesize
2.7MB

Download