amadey | 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f

General

Target

5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe
Size

491KB
MD5

13b2bc3048a18cdd25de8e3449db2d5c
SHA1

875751b8aa356540e60b2ce80b9ccae2b84523e4
SHA256

5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f
SHA512

db7ab32acde9409838c517ede93026a65df572ad46455284a703a7b6524c16a5b2473b9c0f0e41323f757d98df16b393cb6f6d86edcda02b0c1ff022c1ae8fdf
SSDEEP

6144:ZQmLJe2lRMI3SLuyvO81jbQRViKT+UePVBnODIJm+8/aGAAzUCeiEU+SSSSSSSxC:emdTzCL1vBjkViKT+U6FOcJ5uoCeqVK

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

C2

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe

Executes dropped EXE 2 IoCs

pid	Process
2204	Dctooux.exe
2232	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
3152	620	WerFault.exe	81
4860	620	WerFault.exe	81
2068	620	WerFault.exe	81
2476	620	WerFault.exe	81
4584	620	WerFault.exe	81
1668	620	WerFault.exe	81
4632	620	WerFault.exe	81
4524	620	WerFault.exe	81
4412	620	WerFault.exe	81
1368	620	WerFault.exe	81
4732	2204	WerFault.exe	107
4548	2232	WerFault.exe	117
1608	2232	WerFault.exe	117
4228	2232	WerFault.exe	117
3288	2232	WerFault.exe	117
3428	2232	WerFault.exe	117
1612	2232	WerFault.exe	117
5048	2232	WerFault.exe	117
3056	2232	WerFault.exe	117
8	2232	WerFault.exe	117
2192	2232	WerFault.exe	117
4724	2232	WerFault.exe	117
804	2232	WerFault.exe	117
1932	2232	WerFault.exe	117
3324	2232	WerFault.exe	117
2488	2232	WerFault.exe	117
4424	2232	WerFault.exe	117

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
620	5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2204	620	5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe	107
PID 620 wrote to memory of 2204	620	5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe	107
PID 620 wrote to memory of 2204	620	5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe	107

C:\Users\Admin\AppData\Local\Temp\5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe
"C:\Users\Admin\AppData\Local\Temp\5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 756
  2⤵
  - Program crash
  PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 828
  2⤵
  - Program crash
  PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 856
  2⤵
  - Program crash
  PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 864
  2⤵
  - Program crash
  PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 912
  2⤵
  - Program crash
  PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 868
  2⤵
  - Program crash
  PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 1112
  2⤵
  - Program crash
  PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 1112
  2⤵
  - Program crash
  PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 1236
  2⤵
  - Program crash
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:2204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 472
    3⤵
    - Program crash
    PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 1280
  2⤵
  - Program crash
  PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 620 -ip 620
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 620 -ip 620
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 620 -ip 620
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 620 -ip 620
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 620 -ip 620
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 620 -ip 620
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 620 -ip 620
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 620 -ip 620
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 620 -ip 620
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 620 -ip 620
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2204 -ip 2204
1⤵
PID:3400

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 528
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 568
  2⤵
  - Program crash
  PID:1608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 572
  2⤵
  - Program crash
  PID:4228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 592
  2⤵
  - Program crash
  PID:3288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 700
  2⤵
  - Program crash
  PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 812
  2⤵
  - Program crash
  PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 860
  2⤵
  - Program crash
  PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 812
  2⤵
  - Program crash
  PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 812
  2⤵
  - Program crash
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 896
  2⤵
  - Program crash
  PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 988
  2⤵
  - Program crash
  PID:4724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1128
  2⤵
  - Program crash
  PID:804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 992
  2⤵
  - Program crash
  PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1408
  2⤵
  - Program crash
  PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1152
  2⤵
  - Program crash
  PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1460
  2⤵
  - Program crash
  PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2232 -ip 2232
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2232 -ip 2232
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2232 -ip 2232
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2232 -ip 2232
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2232 -ip 2232
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2232 -ip 2232
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2232 -ip 2232
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2232 -ip 2232
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2232 -ip 2232
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2232 -ip 2232
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2232 -ip 2232
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2232 -ip 2232
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2232 -ip 2232
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2232 -ip 2232
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2232 -ip 2232
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2232 -ip 2232
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\804150937214

Filesize
84KB

MD5
eb6b213deac2d232db199ce122176dbf

SHA1
cb88caacb68415c9f5aea39cc22c340c447a7f4d

SHA256
c7edc9dc10fce17033fc742c16d623fb2fb054e638c9dd38b59bdc420389067d

SHA512
8c62f01d459f554eef7b8112fcb24008c1b32726700ca5fba27348cc551d905e6a4fb4063a3e6f07a5bca004ddd7fe8154712ba3730db7ffb668d35518d5f6f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Filesize
491KB

MD5
13b2bc3048a18cdd25de8e3449db2d5c

SHA1
875751b8aa356540e60b2ce80b9ccae2b84523e4

SHA256
5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f

SHA512
db7ab32acde9409838c517ede93026a65df572ad46455284a703a7b6524c16a5b2473b9c0f0e41323f757d98df16b393cb6f6d86edcda02b0c1ff022c1ae8fdf

Download Submit
memory/620-2-0x00000000034B0000-0x000000000351B000-memory.dmp

Filesize
428KB

Download
memory/620-1-0x0000000001890000-0x0000000001990000-memory.dmp

Filesize
1024KB

Download
memory/620-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/620-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/620-19-0x00000000034B0000-0x000000000351B000-memory.dmp

Filesize
428KB

Download
memory/620-18-0x0000000000400000-0x0000000001825000-memory.dmp

Filesize
20.1MB

Download
memory/2204-16-0x0000000000400000-0x0000000001825000-memory.dmp

Filesize
20.1MB

Download
memory/2204-17-0x0000000000400000-0x0000000001825000-memory.dmp

Filesize
20.1MB

Download
memory/2204-22-0x0000000000400000-0x0000000001825000-memory.dmp

Filesize
20.1MB

Download
memory/2232-40-0x0000000000400000-0x0000000001825000-memory.dmp

Filesize
20.1MB

Download

Analysis

Sharing