amadey | 27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe
Size

479KB
MD5

75c1b653f733ae5c4ab3c1654225eed7
SHA1

5ef25cc5fd701cb10cc94dde2fe8fdb06a3892bf
SHA256

27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d
SHA512

59b04bdd8e770ae11fa700b1f7e4c9e32a47bd438cdbe1179151df5675be24941a0fc63db6b93f67dabaf7e278e3f1e00b965d880921f18f164d61edb96ca412
SSDEEP

6144:MhDtFk4NeB9BPlldSJM3qTowxi+fJFZRIEEzDeTfFb4T:4tFk4NobdSyqfrFGzDeT6

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 1 IoCs

pid	Process
2512	Dctooux.exe

Loads dropped DLL 2 IoCs

pid	Process
2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe
2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2512	2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe	28
PID 2932 wrote to memory of 2512	2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe	28
PID 2932 wrote to memory of 2512	2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe	28
PID 2932 wrote to memory of 2512	2932	27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe	28

C:\Users\Admin\AppData\Local\Temp\27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe
"C:\Users\Admin\AppData\Local\Temp\27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\248906074286

Filesize
60KB

MD5
34e967803029e1ddf1466cf346afba20

SHA1
a0259682f75cf5b9bbef7ba953cb931caa8eb7c5

SHA256
289cf13d6026a19b67f11223db21ff59c6a0157dc4e0d2c74f1896ba6da5b9fe

SHA512
ad9832ef452bbf5d70e2beb3cc045e7944eead268b539c2adc157b80b8cda72931ba6e3e268cbd0eb87db9e5a72aca1f494fdb8bcbe72b6df14fbe1a407c3eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Filesize
479KB

MD5
75c1b653f733ae5c4ab3c1654225eed7

SHA1
5ef25cc5fd701cb10cc94dde2fe8fdb06a3892bf

SHA256
27263008f674083d9b76bfa572103a5c5cfeaac82375ff1b2014903ab42aee8d

SHA512
59b04bdd8e770ae11fa700b1f7e4c9e32a47bd438cdbe1179151df5675be24941a0fc63db6b93f67dabaf7e278e3f1e00b965d880921f18f164d61edb96ca412

Download Submit
memory/2512-23-0x0000000000400000-0x00000000006AA000-memory.dmp

Filesize
2.7MB

Download
memory/2512-41-0x0000000000400000-0x00000000006AA000-memory.dmp

Filesize
2.7MB

Download
memory/2512-33-0x0000000000400000-0x00000000006AA000-memory.dmp

Filesize
2.7MB

Download
memory/2932-7-0x0000000000400000-0x00000000006AA000-memory.dmp

Filesize
2.7MB

Download
memory/2932-21-0x0000000000400000-0x00000000006AA000-memory.dmp

Filesize
2.7MB

Download
memory/2932-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2932-19-0x0000000001EB0000-0x0000000001F1B000-memory.dmp

Filesize
428KB

Download
memory/2932-18-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2932-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2932-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2932-2-0x0000000001EB0000-0x0000000001F1B000-memory.dmp

Filesize
428KB

Download