amadey | 70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe
Size

463KB
MD5

d20a3d88ce4efcf17d5af475e5cf4370
SHA1

7b7231f10aed63c58445efd9fd1e40a0df163acc
SHA256

70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c
SHA512

65c4d56579c68697be9836e8df33d4ce0a43fb0c92cd63337bce5a55305017a637518b4dfbf18ee24433d461bbcb14f1b58e736910d9dbd42d9f57f48747089d
SSDEEP

6144:aFbHHkE8Nd8FJe8OMTNdkPDGzmCPdu1cxtcsz+fCOfc2YafSD5z38GzJSvTH:aRkpuve8tfriCPkivzqCecFlzZUH

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com

http://otyt.ru

http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe

Executes dropped EXE 3 IoCs

pid	Process
3552	Dctooux.exe
2316	Dctooux.exe
3308	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
4516	2852	WerFault.exe	82
1940	2852	WerFault.exe	82
4836	2852	WerFault.exe	82
2656	2852	WerFault.exe	82
1316	2852	WerFault.exe	82
3932	2852	WerFault.exe	82
2156	2852	WerFault.exe	82
1952	2852	WerFault.exe	82
4244	2852	WerFault.exe	82
412	2852	WerFault.exe	82
2572	3552	WerFault.exe	102
3828	3552	WerFault.exe	102
3120	3552	WerFault.exe	102
3100	3552	WerFault.exe	102
5024	3552	WerFault.exe	102
2624	3552	WerFault.exe	102
3464	3552	WerFault.exe	102
1608	3552	WerFault.exe	102
2072	3552	WerFault.exe	102
3924	3552	WerFault.exe	102
804	3552	WerFault.exe	102
3324	3552	WerFault.exe	102
2508	3552	WerFault.exe	102
2516	3552	WerFault.exe	102
2736	3552	WerFault.exe	102
2980	3552	WerFault.exe	102
1912	3552	WerFault.exe	102
1952	2316	WerFault.exe	143
3044	3308	WerFault.exe	149
876	3552	WerFault.exe	102

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3552	2852	70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe	102
PID 2852 wrote to memory of 3552	2852	70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe	102
PID 2852 wrote to memory of 3552	2852	70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe	102

C:\Users\Admin\AppData\Local\Temp\70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe
"C:\Users\Admin\AppData\Local\Temp\70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 756
  2⤵
  - Program crash
  PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 784
  2⤵
  - Program crash
  PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 828
  2⤵
  - Program crash
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 928
  2⤵
  - Program crash
  PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 936
  2⤵
  - Program crash
  PID:1316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 912
  2⤵
  - Program crash
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1124
  2⤵
  - Program crash
  PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1176
  2⤵
  - Program crash
  PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1236
  2⤵
  - Program crash
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 560
    3⤵
    - Program crash
    PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 580
    3⤵
    - Program crash
    PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 580
    3⤵
    - Program crash
    PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 564
    3⤵
    - Program crash
    PID:3100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 560
    3⤵
    - Program crash
    PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 796
    3⤵
    - Program crash
    PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 808
    3⤵
    - Program crash
    PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 912
    3⤵
    - Program crash
    PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 716
    3⤵
    - Program crash
    PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 964
    3⤵
    - Program crash
    PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 792
    3⤵
    - Program crash
    PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 960
    3⤵
    - Program crash
    PID:3324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1044
    3⤵
    - Program crash
    PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1196
    3⤵
    - Program crash
    PID:2516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1412
    3⤵
    - Program crash
    PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1420
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1324
    3⤵
    - Program crash
    PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 916
    3⤵
    - Program crash
    PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1312
  2⤵
  - Program crash
  PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 2852
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2852 -ip 2852
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2852 -ip 2852
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2852 -ip 2852
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2852 -ip 2852
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2852 -ip 2852
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2852 -ip 2852
1⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2852 -ip 2852
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2852 -ip 2852
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2852 -ip 2852
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3552 -ip 3552
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3552 -ip 3552
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3552 -ip 3552
1⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3552 -ip 3552
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3552 -ip 3552
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3552 -ip 3552
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3552 -ip 3552
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3552 -ip 3552
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3552 -ip 3552
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3552 -ip 3552
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3552 -ip 3552
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3552 -ip 3552
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3552 -ip 3552
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3552 -ip 3552
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3552 -ip 3552
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3552 -ip 3552
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3552 -ip 3552
1⤵
PID:1816

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 440
  2⤵
  - Program crash
  PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2316 -ip 2316
1⤵
PID:3648

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 448
  2⤵
  - Program crash
  PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3308 -ip 3308
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3552 -ip 3552
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\539840389126

Filesize
76KB

MD5
91fdb835a6800d61e28c60987ad0dbda

SHA1
ee1eee9dc04c38361a5ab8424a690116d6467d0f

SHA256
d1ecfef2dc8e8cbbc60ce88741f0753074b1100538f4273a948c2fd8e6e59598

SHA512
13b8eab43f686b0671bf4208b809c61833e785bfd8de0ac7e2d965c9280f31aae27e2c95a2f82a14f53b1d8c1c379ed97aed0f7315602aa02e98b85132c602b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Filesize
463KB

MD5
d20a3d88ce4efcf17d5af475e5cf4370

SHA1
7b7231f10aed63c58445efd9fd1e40a0df163acc

SHA256
70719c9030f6a556fb9769db5820fb369b5e6e6967651882aba35b3f9476dc1c

SHA512
65c4d56579c68697be9836e8df33d4ce0a43fb0c92cd63337bce5a55305017a637518b4dfbf18ee24433d461bbcb14f1b58e736910d9dbd42d9f57f48747089d

Download Submit
memory/2316-45-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2316-44-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2852-20-0x00000000005F0000-0x000000000065F000-memory.dmp

Filesize
444KB

Download
memory/2852-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2852-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2852-1-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download
memory/2852-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2852-2-0x00000000005F0000-0x000000000065F000-memory.dmp

Filesize
444KB

Download
memory/3308-54-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3308-55-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3552-22-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3552-27-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3552-28-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3552-40-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download