amadey | cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a

Analysis

max time kernel
145s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2024, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe
Size 501KB
Sample240613-mmerrayglp
SHA256 cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a
MD5 b59d75a0cac3fdf8e58fcc7fff4bf9bf
SHA1 fc6a8e66a46f89c7fa0dfc05b0fac195a475d062
SHA512 4f385dcdab362446ebad78853c5be6b7169f308f5131e13a03a3154bf0461d5f4f6962f7b554b8f77e98f05552ea2030dc3b470b27fbe8c8a3c969e5f13ab16d
SSDEEP 6144:m6IKW0L7frH8sADhOVFIK9rTDMM3udjrl3FFHfrLaXfbTO8SgQb:g0vfrH8RDwUKG9dvl/Hfr2PMg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 4 IoCs

pid	Process
3480	Dctooux.exe
4836	Dctooux.exe
1692	Dctooux.exe
4524	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
4236	4760	WerFault.exe	76
4872	4760	WerFault.exe	76
4812	4760	WerFault.exe	76
3412	4760	WerFault.exe	76
3504	4760	WerFault.exe	76
3300	4760	WerFault.exe	76
1948	4760	WerFault.exe	76
1392	4760	WerFault.exe	76
3012	4760	WerFault.exe	76
1540	4760	WerFault.exe	76
2572	4760	WerFault.exe	76
1460	4760	WerFault.exe	76
1028	4760	WerFault.exe	76
4416	3480	WerFault.exe	101
5044	3480	WerFault.exe	101
1172	3480	WerFault.exe	101
4532	3480	WerFault.exe	101
4012	3480	WerFault.exe	101
3100	3480	WerFault.exe	101
4240	3480	WerFault.exe	101
3316	3480	WerFault.exe	101
3560	3480	WerFault.exe	101
4176	3480	WerFault.exe	101
3376	3480	WerFault.exe	101
428	3480	WerFault.exe	101
4884	3480	WerFault.exe	101
1396	3480	WerFault.exe	101
3836	3480	WerFault.exe	101
2700	3480	WerFault.exe	101
3636	4836	WerFault.exe	137
4424	1692	WerFault.exe	140
1040	3480	WerFault.exe	101
3964	4524	WerFault.exe	145

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4760	cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3480	4760	cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe	101
PID 4760 wrote to memory of 3480	4760	cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe	101
PID 4760 wrote to memory of 3480	4760	cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe	101

C:\Users\Admin\AppData\Local\Temp\cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe
"C:\Users\Admin\AppData\Local\Temp\cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 776
  2⤵
  - Program crash
  PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 820
  2⤵
  - Program crash
  PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 852
  2⤵
  - Program crash
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 944
  2⤵
  - Program crash
  PID:3412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 880
  2⤵
  - Program crash
  PID:3504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 980
  2⤵
  - Program crash
  PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 936
  2⤵
  - Program crash
  PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1044
  2⤵
  - Program crash
  PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1132
  2⤵
  - Program crash
  PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1428
  2⤵
  - Program crash
  PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 824
  2⤵
  - Program crash
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 584
    3⤵
    - Program crash
    PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 592
    3⤵
    - Program crash
    PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 620
    3⤵
    - Program crash
    PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 596
    3⤵
    - Program crash
    PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 728
    3⤵
    - Program crash
    PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 896
    3⤵
    - Program crash
    PID:3100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 776
    3⤵
    - Program crash
    PID:4240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 948
    3⤵
    - Program crash
    PID:3316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 984
    3⤵
    - Program crash
    PID:3560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 964
    3⤵
    - Program crash
    PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1056
    3⤵
    - Program crash
    PID:3376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1224
    3⤵
    - Program crash
    PID:428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1260
    3⤵
    - Program crash
    PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1456
    3⤵
    - Program crash
    PID:1396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1432
    3⤵
    - Program crash
    PID:3836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1500
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 900
    3⤵
    - Program crash
    PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 900
  2⤵
  - Program crash
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1284
  2⤵
  - Program crash
  PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4760 -ip 4760
1⤵
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4760 -ip 4760
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4760 -ip 4760
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4760 -ip 4760
1⤵
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4760 -ip 4760
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4760 -ip 4760
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4760 -ip 4760
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4760 -ip 4760
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4760 -ip 4760
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4760 -ip 4760
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4760 -ip 4760
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4760 -ip 4760
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4760 -ip 4760
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3480 -ip 3480
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3480 -ip 3480
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3480 -ip 3480
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3480 -ip 3480
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3480 -ip 3480
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3480 -ip 3480
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3480 -ip 3480
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3480 -ip 3480
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3480 -ip 3480
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3480 -ip 3480
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3480 -ip 3480
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3480 -ip 3480
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3480 -ip 3480
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3480 -ip 3480
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3480 -ip 3480
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3480 -ip 3480
1⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 480
  2⤵
  - Program crash
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4836 -ip 4836
1⤵
PID:492

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 472
  2⤵
  - Program crash
  PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1692 -ip 1692
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3480 -ip 3480
1⤵
PID:920

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 480
  2⤵
  - Program crash
  PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4524 -ip 4524
1⤵
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

235821424191

Path C:\Users\Admin\AppData\Local\Temp\235821424191
Size 76KB
SHA256 e406495d19c3049dde3548feaf817f13a4fa60cb7fd9203924a49003a7cc6a48
MD5 f08879328ec19c9e075bceae031c04ea
SHA1 90264c781e668c5d6f4864704a2af0a30f6bf98e
SHA512 b3f7a7d006b1766d9f1867f5340df24459525d6adf54a2319a0575e46ef90f5899e9f02f5a19a23fb21b971be83065217d5a81f0f58f6fbb629116bdd00ae071
SSDEEP 1536:spILXeLwk6mGDt/Cdx+fV6FLKIXuV2JGp+8978SvGEa:RUbWt/s+fV6JKEJCbV8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
Size 501KB
SHA256 cb3b203f1fc56eec52f17cf5ecc96a51e1944a36ffeb9a385d4df8f59d88665a
MD5 b59d75a0cac3fdf8e58fcc7fff4bf9bf
SHA1 fc6a8e66a46f89c7fa0dfc05b0fac195a475d062
SHA512 4f385dcdab362446ebad78853c5be6b7169f308f5131e13a03a3154bf0461d5f4f6962f7b554b8f77e98f05552ea2030dc3b470b27fbe8c8a3c969e5f13ab16d
SSDEEP 6144:m6IKW0L7frH8sADhOVFIK9rTDMM3udjrl3FFHfrLaXfbTO8SgQb:g0vfrH8RDwUKG9dvl/Hfr2PMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1692-47-0x0000000000400000-0x0000000001BF8000-memory.dmp

Download

memory/3480-35-0x0000000000400000-0x0000000001BF8000-memory.dmp

Download

memory/3480-16-0x0000000000400000-0x0000000001BF8000-memory.dmp

Download

memory/4524-56-0x0000000000400000-0x0000000001BF8000-memory.dmp

Download

memory/4760-19-0x0000000003960000-0x00000000039CB000-memory.dmp

Download

memory/4760-18-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4760-17-0x0000000000400000-0x0000000001BF8000-memory.dmp

Download

memory/4760-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4760-1-0x0000000001D40000-0x0000000001E40000-memory.dmp

Download

memory/4760-2-0x0000000003960000-0x00000000039CB000-memory.dmp

Download

memory/4836-38-0x0000000000400000-0x0000000001BF8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads