amadey | ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a

Analysis

max time kernel
293s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14/06/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe
Size 451KB
Sample240614-aey47s1amn
SHA256 ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a
MD5 4b8cad4e596920ace7137ed2515c8e0d
SHA1 a174a7254b0b3a104519ce73cfdd32cc49d23169
SHA512 5911d532d777c2a80bf16d4719f0e5fcddd9eb53f4ec34cf6c1fde27c2da56e682c22be0b768ac73166edd712f189f7ee1ff7bdba2d53d997483c8b96eb520c4
SSDEEP 6144:n1/peoye55gHFU/uyd0ZR4oe63Un8KLa7fy7mwTVaGAJVOtVvtT:1/pCu/uBe63Sw7qKwTVaZJVOLvZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com
http://otyt.ru
http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 6 IoCs

pid	Process
3876	Dctooux.exe
5004	Dctooux.exe
4852	Dctooux.exe
2156	Dctooux.exe
1420	Dctooux.exe
1424	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 16 IoCs

pid	pid_target	Process	procid_target
2448	3296	WerFault.exe	74
68	3296	WerFault.exe	74
4108	3296	WerFault.exe	74
1124	3296	WerFault.exe	74
4388	3296	WerFault.exe	74
4384	3296	WerFault.exe	74
3004	3296	WerFault.exe	74
4372	3296	WerFault.exe	74
3320	3296	WerFault.exe	74
2240	3296	WerFault.exe	74
4896	3876	WerFault.exe	85
3544	3876	WerFault.exe	85
5064	3876	WerFault.exe	85
1784	3876	WerFault.exe	85
1928	3876	WerFault.exe	85
2128	3876	WerFault.exe	85

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3296	ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3876	3296	ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe	85
PID 3296 wrote to memory of 3876	3296	ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe	85
PID 3296 wrote to memory of 3876	3296	ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe	85

C:\Users\Admin\AppData\Local\Temp\ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe
"C:\Users\Admin\AppData\Local\Temp\ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 684
  2⤵
  - Program crash
  PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 736
  2⤵
  - Program crash
  PID:68
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 808
  2⤵
  - Program crash
  PID:4108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 816
  2⤵
  - Program crash
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 844
  2⤵
  - Program crash
  PID:4388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 792
  2⤵
  - Program crash
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1056
  2⤵
  - Program crash
  PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1084
  2⤵
  - Program crash
  PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1032
  2⤵
  - Program crash
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 632
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 688
    3⤵
    - Program crash
    PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 712
    3⤵
    - Program crash
    PID:5064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 792
    3⤵
    - Program crash
    PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 800
    3⤵
    - Program crash
    PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 888
    3⤵
    - Program crash
    PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1508
  2⤵
  - Program crash
  PID:2240

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
Size 451KB
SHA256 ea7f2dd7c8390bef3b0676e9ba9faf34e1a0905b8f9dac75e677def1b4b7113a
MD5 4b8cad4e596920ace7137ed2515c8e0d
SHA1 a174a7254b0b3a104519ce73cfdd32cc49d23169
SHA512 5911d532d777c2a80bf16d4719f0e5fcddd9eb53f4ec34cf6c1fde27c2da56e682c22be0b768ac73166edd712f189f7ee1ff7bdba2d53d997483c8b96eb520c4
SSDEEP 6144:n1/peoye55gHFU/uyd0ZR4oe63Un8KLa7fy7mwTVaGAJVOtVvtT:1/pCu/uBe63Sw7qKwTVaZJVOLvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1420-51-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1424-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2156-42-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3296-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3296-14-0x00000000020B0000-0x000000000211F000-memory.dmp

Download

memory/3296-1-0x0000000000530000-0x0000000000630000-memory.dmp

Download

memory/3296-15-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3296-3-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3296-2-0x00000000020B0000-0x000000000211F000-memory.dmp

Download

memory/3876-16-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3876-17-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4852-33-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5004-23-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5004-24-0x0000000000400000-0x0000000000482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads