amadey | 83f17052a7366bd07cacf01d9a6fcc31b6bcb5b89fc7f5320edbfa2de3c01b85

Analysis

max time kernel
145s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe
Size

466KB
MD5

2aab50071ed7cd04279bc8a6fac68280
SHA1

4884142b96c2b1f67d9ec57ae4de3253a6449976
SHA256

83f17052a7366bd07cacf01d9a6fcc31b6bcb5b89fc7f5320edbfa2de3c01b85
SHA512

bb94ee262e7c4d21631520c499fe9b0034f30882b95847eb72838138b5e4b3d6c5eb9e1aa122e2dcc33c666eeb8fd34ffbb234248d3c15e6899d8ce5f9d42998
SSDEEP

6144:K0fLDXkuiLa34e70xdsfVC6k4G+YOxqprNRJYsLkXV425EYdxivK4:BfPXka4DxdL8Gv+qpdYeIS25EYdxir

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 1 IoCs

pid	Process
3068	Dctooux.exe

Loads dropped DLL 2 IoCs

pid	Process
2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe
2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3068	2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe	28
PID 2256 wrote to memory of 3068	2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe	28
PID 2256 wrote to memory of 3068	2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe	28
PID 2256 wrote to memory of 3068	2256	2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2aab50071ed7cd04279bc8a6fac68280_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\309405411416

Filesize
68KB

MD5
36e3afa3dc2a201034bb438fb6343e83

SHA1
4eb4ce65ac14dbe39ba257c8d31bf980648c3ad9

SHA256
d0acd88ff220f2c7029c58728a7a495081e74ef042ac6c2c125b339d82bf7e77

SHA512
1cf0ea49ce672d287c96552fe48af0c2a504145d47c0e00ac5d2c2789e8451c3813b01e9d2d750e9b35c3bcd21bd5204585cee25a72d6d650e5f9d6ec8f85b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Filesize
466KB

MD5
2aab50071ed7cd04279bc8a6fac68280

SHA1
4884142b96c2b1f67d9ec57ae4de3253a6449976

SHA256
83f17052a7366bd07cacf01d9a6fcc31b6bcb5b89fc7f5320edbfa2de3c01b85

SHA512
bb94ee262e7c4d21631520c499fe9b0034f30882b95847eb72838138b5e4b3d6c5eb9e1aa122e2dcc33c666eeb8fd34ffbb234248d3c15e6899d8ce5f9d42998

Download Submit
memory/2256-1-0x0000000000400000-0x0000000001BF0000-memory.dmp

Filesize
23.9MB

Download
memory/2256-2-0x0000000000400000-0x0000000001BF0000-memory.dmp

Filesize
23.9MB

Download
memory/2256-18-0x0000000000400000-0x0000000001BF0000-memory.dmp

Filesize
23.9MB

Download
memory/2256-16-0x0000000000400000-0x0000000001BF0000-memory.dmp

Filesize
23.9MB

Download
memory/3068-35-0x0000000000400000-0x0000000001BF0000-memory.dmp

Filesize
23.9MB

Download