Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Dctooux.job	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1608 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 1608 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 1608 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 1608 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe

"C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe"

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	jkshb.su	udp
US	8.8.8.8:53	greendag.ru	udp
US	8.8.8.8:53	osdhs.in.ne	udp
US	8.8.8.8:53	jkshb.su	udp
US	8.8.8.8:53	osdhs.in.ne	udp
US	8.8.8.8:53	greendag.ru	udp
US	8.8.8.8:53	greendag.ru	udp
US	8.8.8.8:53	jkshb.su	udp
US	8.8.8.8:53	osdhs.in.ne	udp

Files

memory/1608-1-0x0000000000510000-0x0000000000610000-memory.dmp

memory/1608-2-0x00000000002B0000-0x000000000031B000-memory.dmp

memory/1608-3-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1608-5-0x0000000000400000-0x0000000000483000-memory.dmp

\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

MD5	4ea8eb48f819692ee592d11901006a52
SHA1	bf1d234d281ce3ccd0e926a3b33c28d4ed560495
SHA256	c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8
SHA512	3df5829cde0bfb92b6244fff07503013e3f6505ae8e20a54f295648aac56cd511816efeedb7fd9064c01c4efcfb8ae6b846d2de49c4a5064e62b7c3974357202

memory/1608-20-0x0000000000400000-0x0000000000483000-memory.dmp

memory/1608-19-0x0000000000510000-0x0000000000610000-memory.dmp

memory/1608-18-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2732-22-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2732-23-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2732-24-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2732-30-0x0000000000400000-0x0000000000483000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\691908287377

MD5	ef83e5c8340238151e9e6381f75d667a
SHA1	83e0c50541a5e87838975ba0ee1704a8d12eca61
SHA256	a35efde8656653737311f93b8d76f58f93494d17d5f27b430cd055a4860448ca
SHA512	4c722fb9679d360c6bbd7ca2efb1ddba15407a5cde88481bbedccfed4f0c7401c4fa82bea9f2d459d06c37e02b5ce467ee180d070fcedeca36b3207e389bcb66

memory/2732-36-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2732-44-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2732-48-0x0000000000400000-0x0000000000483000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 01:52

Reported

2024-06-17 01:55

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe"

Signatures

Amadey

trojan amadey

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Dctooux.job	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4200 wrote to memory of 3692	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 4200 wrote to memory of 3692	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 4200 wrote to memory of 3692	N/A	C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe

"C:\Users\Admin\AppData\Local\Temp\c11f5b061356ae3b3391c8cabfbf0d9675a135c2504af8cdadbbbfdeaad9bcc8.exe"