amadey | a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
640b35e62443a62ba15beba6aa317500.exe
Size 489KB
Sample240607-gmgnfsae3x
SHA256 a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d
MD5 640b35e62443a62ba15beba6aa317500
SHA1 09bac93ca0e9e16cc840d22e45a7f14f54a0745c
SHA512 0046cbe3974aa855c4746270873bb5976727f325606538f15e82c30f3a4225894840b8c2a853267780d99ecd83c5ee56120adae4d079f7683d9481a29bd6b10a
SSDEEP 6144:Oc0LIpbZrTSoNGAtGMbJ/Po13iKoBcymNzUEpKRzCnuzZs9rxzkETgY4Tavc:r0spbZrTJGMdkRoBjVZCnuzZs9rZTgN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 1 IoCs

pid	Process
2608	Dctooux.exe

Loads dropped DLL 2 IoCs

pid	Process
1368	640b35e62443a62ba15beba6aa317500.exe
1368	640b35e62443a62ba15beba6aa317500.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	640b35e62443a62ba15beba6aa317500.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	640b35e62443a62ba15beba6aa317500.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2608	1368	640b35e62443a62ba15beba6aa317500.exe	28
PID 1368 wrote to memory of 2608	1368	640b35e62443a62ba15beba6aa317500.exe	28
PID 1368 wrote to memory of 2608	1368	640b35e62443a62ba15beba6aa317500.exe	28
PID 1368 wrote to memory of 2608	1368	640b35e62443a62ba15beba6aa317500.exe	28

C:\Users\Admin\AppData\Local\Temp\640b35e62443a62ba15beba6aa317500.exe
"C:\Users\Admin\AppData\Local\Temp\640b35e62443a62ba15beba6aa317500.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

680803933149

Path C:\Users\Admin\AppData\Local\Temp\680803933149
Size 61KB
SHA256 7e3fb5452aa1f4fdaf5571ef92045860b687cb4400e994c0f01c54d0a3816b3e
MD5 bfef40e933ac13ef8f024ef50dd7460c
SHA1 e28cd51c36635833d526f0eb685b34ee193f701e
SHA512 2090238ddb7f21b8bc18d2cf87ad0296ca7c4a3dcd4bc870a6c2c1d86b2e7c47a5d2b0b4d587da26aad22b15591d62e039738806628de07ab2d94dab3a32f2bb
SSDEEP 1536:sgW5rqCR9ovh4uJKRrLSXWZvHQPMbzNnUnfxhdsiGwtZ:NCDoZ4uKEmlwPMlnUnfxhCiGwtZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
Size 489KB
SHA256 a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d
MD5 640b35e62443a62ba15beba6aa317500
SHA1 09bac93ca0e9e16cc840d22e45a7f14f54a0745c
SHA512 0046cbe3974aa855c4746270873bb5976727f325606538f15e82c30f3a4225894840b8c2a853267780d99ecd83c5ee56120adae4d079f7683d9481a29bd6b10a
SSDEEP 6144:Oc0LIpbZrTSoNGAtGMbJ/Po13iKoBcymNzUEpKRzCnuzZs9rxzkETgY4Tavc:r0spbZrTJGMdkRoBjVZCnuzZs9rZTgN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-1-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/1368-2-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/1368-8-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/1368-18-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/2608-35-0x0000000000400000-0x0000000001825000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads