amadey | 4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815

Analysis

max time kernel
292s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/06/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe
Size 422KB
Sample240613-2pt2saxdrp
SHA256 4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815
MD5 504e7b2212f1805adf164fb062a9b7a6
SHA1 e9f20911a7a999835ddd1ce78f7d1610b303d86f
SHA512 0496d25abb970fea8e6ce80490282aac40fb300e18f029ae6bdc1a8f7aab532874ce05e998d22c07a858c2c2f2c9883f1d87eda1d65ea328541aaa10a2f72409
SSDEEP 6144:VtLU/kyPGdpmoiNURqkkNU5rfkrplcqjdw//g4QWrFWjUioqQMAcEB3E:3Q/kgGdJVxGDi/44QWwEqQih
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com
http://otyt.ru
http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 12 IoCs

pid	Process
4904	Dctooux.exe
4956	Dctooux.exe
1296	Dctooux.exe
2988	Dctooux.exe
4552	Dctooux.exe
5108	Dctooux.exe
2788	Dctooux.exe
652	Dctooux.exe
1124	Dctooux.exe
2388	Dctooux.exe
592	Dctooux.exe
5028	Dctooux.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 4904 set thread context of 4956	4904	Dctooux.exe	75
PID 1296 set thread context of 2988	1296	Dctooux.exe	77
PID 4552 set thread context of 5108	4552	Dctooux.exe	79
PID 2788 set thread context of 652	2788	Dctooux.exe	81
PID 1124 set thread context of 2388	1124	Dctooux.exe	83
PID 592 set thread context of 5028	592	Dctooux.exe	85

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 2872 wrote to memory of 804	2872	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	73
PID 804 wrote to memory of 4904	804	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	74
PID 804 wrote to memory of 4904	804	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	74
PID 804 wrote to memory of 4904	804	4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe	74
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 4904 wrote to memory of 4956	4904	Dctooux.exe	75
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 1296 wrote to memory of 2988	1296	Dctooux.exe	77
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 4552 wrote to memory of 5108	4552	Dctooux.exe	79
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 2788 wrote to memory of 652	2788	Dctooux.exe	81
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 1124 wrote to memory of 2388	1124	Dctooux.exe	83
PID 592 wrote to memory of 5028	592	Dctooux.exe	85

C:\Users\Admin\AppData\Local\Temp\4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe
"C:\Users\Admin\AppData\Local\Temp\4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe
  "C:\Users\Admin\AppData\Local\Temp\4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
    "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
      4⤵
      Executes dropped EXE
      PID:4956

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:2988

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:5108

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:652

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:2388

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:592
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

106386276412

Path C:\Users\Admin\AppData\Local\Temp\106386276412
Size 70KB
SHA256 db2d701794a4dca6fc3a287037881e51a2bb0966290b6694b4656d92f253f4c9
MD5 e3ea6f26674e7751f8dcb7b4430e1762
SHA1 e5d9038924c6b1816e61e80b1b3bba827b9c14ff
SHA512 cf4dbc942cf511c495efbe27cbf6eb49b17aa13be09cf9f963e6224cce9dd680c1667f5391c92614a0c80a8da6e41972f5ba7ac3863f9ce3b6df35279480a59f
SSDEEP 1536:saW+C3yArZ0a0LE0ee2RiELNyTCTLsGk7mVVX1UHOv:J0r/fVNyTCT67mbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
Size 422KB
SHA256 4221658b6432fd66575d528ed2c486354c9197b737ac161d6e0e24d7290ca815
MD5 504e7b2212f1805adf164fb062a9b7a6
SHA1 e9f20911a7a999835ddd1ce78f7d1610b303d86f
SHA512 0496d25abb970fea8e6ce80490282aac40fb300e18f029ae6bdc1a8f7aab532874ce05e998d22c07a858c2c2f2c9883f1d87eda1d65ea328541aaa10a2f72409
SSDEEP 6144:VtLU/kyPGdpmoiNURqkkNU5rfkrplcqjdw//g4QWrFWjUioqQMAcEB3E:3Q/kgGdJVxGDi/44QWwEqQih
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll
Size 153B
SHA256 6807c84bf35d67496e020c1528303b87d4759933c09817e514a7159ac689d352
MD5 d47b646093dd84d34885a714ce4bd74e
SHA1 c4df23671b6440e29159093dc52cb8c4aa184597
SHA512 906fb89d5ec9dc4338f9d5e26fdc9ccc041225157a8f114465449106128d69e9fbc7723b2bcdd56a17c74c29983f7126a1d970b24e3902a3c4e817834f21f338
MD5 SHA1 SHA512

Submit Download

memory/652-85-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/652-84-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/804-17-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/804-4-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/804-5-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/804-6-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/804-3-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2388-105-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2388-104-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2872-2-0x0000000003840000-0x00000000038AF000-memory.dmp

Download

memory/2872-1-0x0000000001DA0000-0x0000000001EA0000-memory.dmp

Download

memory/2988-39-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2988-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-21-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-67-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-49-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-60-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-99-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-22-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-50-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4956-127-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5028-138-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5028-139-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5108-71-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5108-72-0x0000000000400000-0x0000000000472000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads