amadey | ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
16/06/2024, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe
Size 486KB
Sample240616-145w6avblk
SHA256 ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8
MD5 7e21139b2ee068b54e0a8c8a2ae2da55
SHA1 44519c4665d33143a19100cf9e2884a5d8c5677f
SHA512 b158bce9c6ff838f75bc515b9d6f3d4f953d293179cfd3c52c7b9b0bfa36499e22b1d87bd0694628fd0545809154f52fdd764b1a61c0caf9677644d8d2ca4285
SSDEEP 6144:XjxL1o4By2pmW51IAaXhpI/s+jK6IxxnEGkl5gfSVQj79lBsVg5wawy57AAV:XdtBfB51naRpn+u6Qbkj7079Ifm7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com
http://otyt.ru
http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 6 IoCs

pid	Process
4888	Dctooux.exe
3184	Dctooux.exe
4748	Dctooux.exe
3632	Dctooux.exe
4664	Dctooux.exe
2248	Dctooux.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 4888 set thread context of 3184	4888	Dctooux.exe	82
PID 4748 set thread context of 3632	4748	Dctooux.exe	84
PID 4664 set thread context of 2248	4664	Dctooux.exe	87

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 5024 wrote to memory of 708	5024	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	80
PID 708 wrote to memory of 4888	708	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	81
PID 708 wrote to memory of 4888	708	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	81
PID 708 wrote to memory of 4888	708	ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe	81
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4888 wrote to memory of 3184	4888	Dctooux.exe	82
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4748 wrote to memory of 3632	4748	Dctooux.exe	84
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87
PID 4664 wrote to memory of 2248	4664	Dctooux.exe	87

C:\Users\Admin\AppData\Local\Temp\ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe
"C:\Users\Admin\AppData\Local\Temp\ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe
  "C:\Users\Admin\AppData\Local\Temp\ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
    "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
      4⤵
      Executes dropped EXE
      PID:3184

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:3632

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

524922173293

Path C:\Users\Admin\AppData\Local\Temp\524922173293
Size 82KB
SHA256 0b54abed231df3c038e6252c63207e421b00216af0aeb930bfc8690f64c26dfe
MD5 da6e020c0fce571b37793a1d192af120
SHA1 5e2cf7e144c4944a2f087f5da2a80097daf2ca4a
SHA512 c1b6c41595f378ae81caa43725f61dfc6481efdba6c32142ba07cfea105c4b250d074cf3f962243a44a04163eb424a0cd3f1d3f07eb005060271efcab226ce1e
SSDEEP 1536:sPs1P3cfl4fsq5l/n8GlMh3dE16JG011OGu6Nlgfn:iwPbfsq5lVMhu1J011Olfn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
Size 486KB
SHA256 ada480a52b1b5b050f4186e0f6a7969fd7c951a3a9596f5a1824af11fb48b2e8
MD5 7e21139b2ee068b54e0a8c8a2ae2da55
SHA1 44519c4665d33143a19100cf9e2884a5d8c5677f
SHA512 b158bce9c6ff838f75bc515b9d6f3d4f953d293179cfd3c52c7b9b0bfa36499e22b1d87bd0694628fd0545809154f52fdd764b1a61c0caf9677644d8d2ca4285
SSDEEP 6144:XjxL1o4By2pmW51IAaXhpI/s+jK6IxxnEGkl5gfSVQj79lBsVg5wawy57AAV:XdtBfB51naRpn+u6Qbkj7079Ifm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/708-3-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/708-4-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/708-5-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/708-6-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/708-20-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2248-67-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2248-66-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3184-24-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3184-25-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3184-45-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3184-46-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3632-53-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3632-54-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5024-1-0x0000000002650000-0x0000000002750000-memory.dmp

Download

memory/5024-2-0x00000000040F0000-0x000000000415F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads