amadey | d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe
Size

392KB
MD5

187aabbcb4ca164f10f47ea6d9b1dec4
SHA1

4de7ed089147f8dca9e0ec9c39114167765a5a0c
SHA256

d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0
SHA512

8a9033717f6375fb53e2460d516ee74acdaed6039b05306d011c23d0fe837ffa48c2835d6e87bea237fc7920b126c495f40525104ed51c28b9d508586250dd18
SSDEEP

6144:G4IXFkvOBWPO7U4tOKeRdn1rD02TL7lc2Sov08cH:GRFkvOBWPhbvrosRc2SocHH

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe

Executes dropped EXE 1 IoCs

pid	Process
4808	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
1504	4940	WerFault.exe	84
2808	4940	WerFault.exe	84
3416	4940	WerFault.exe	84
4472	4940	WerFault.exe	84
2276	4940	WerFault.exe	84
3428	4940	WerFault.exe	84
348	4940	WerFault.exe	84
2616	4940	WerFault.exe	84
1188	4940	WerFault.exe	84
4524	4940	WerFault.exe	84
4088	4940	WerFault.exe	84
2316	4940	WerFault.exe	84
2604	4808	WerFault.exe	114
1996	4808	WerFault.exe	114
244	4808	WerFault.exe	114
924	4808	WerFault.exe	114
980	4808	WerFault.exe	114
1200	4808	WerFault.exe	114
400	4808	WerFault.exe	114
4372	4808	WerFault.exe	114
2300	4808	WerFault.exe	114
1984	4808	WerFault.exe	114
4208	4808	WerFault.exe	114
4892	4808	WerFault.exe	114
3404	4808	WerFault.exe	114
756	4808	WerFault.exe	114
936	4808	WerFault.exe	114
4016	4808	WerFault.exe	114

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4940	d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4808	4940	d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe	114
PID 4940 wrote to memory of 4808	4940	d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe	114
PID 4940 wrote to memory of 4808	4940	d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe	114

C:\Users\Admin\AppData\Local\Temp\d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe
"C:\Users\Admin\AppData\Local\Temp\d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 768
  2⤵
  - Program crash
  PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 836
  2⤵
  - Program crash
  PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 848
  2⤵
  - Program crash
  PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 920
  2⤵
  - Program crash
  PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 936
  2⤵
  - Program crash
  PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 972
  2⤵
  - Program crash
  PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1136
  2⤵
  - Program crash
  PID:348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1224
  2⤵
  - Program crash
  PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1160
  2⤵
  - Program crash
  PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1584
  2⤵
  - Program crash
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 556
    3⤵
    - Program crash
    PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 576
    3⤵
    - Program crash
    PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 600
    3⤵
    - Program crash
    PID:244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 608
    3⤵
    - Program crash
    PID:924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 724
    3⤵
    - Program crash
    PID:980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 892
    3⤵
    - Program crash
    PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 928
    3⤵
    - Program crash
    PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 948
    3⤵
    - Program crash
    PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 728
    3⤵
    - Program crash
    PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 728
    3⤵
    - Program crash
    PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1016
    3⤵
    - Program crash
    PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1016
    3⤵
    - Program crash
    PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1404
    3⤵
    - Program crash
    PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1516
    3⤵
    - Program crash
    PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1552
    3⤵
    - Program crash
    PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 896
    3⤵
    - Program crash
    PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 840
  2⤵
  - Program crash
  PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 780
  2⤵
  - Program crash
  PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4940 -ip 4940
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4940 -ip 4940
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4940 -ip 4940
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4940 -ip 4940
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4940 -ip 4940
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4940 -ip 4940
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4940 -ip 4940
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4940 -ip 4940
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4940 -ip 4940
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4940 -ip 4940
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4940 -ip 4940
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4940 -ip 4940
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4808 -ip 4808
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4808 -ip 4808
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4808 -ip 4808
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4808 -ip 4808
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4808 -ip 4808
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4808 -ip 4808
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4808 -ip 4808
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4808 -ip 4808
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4808 -ip 4808
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4808 -ip 4808
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4808 -ip 4808
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4808 -ip 4808
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4808 -ip 4808
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4808 -ip 4808
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4808 -ip 4808
1⤵
PID:528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4808 -ip 4808
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\080292272204

Filesize
78KB

MD5
39756c97bc871459de5fb29e9cd12e9e

SHA1
931b6533e16be24bbd0590fc9c4d7dd8ad86535d

SHA256
c7ac60b5ebb522686be8e1788258ca53fc139424e1a66881679e1f0a188ab003

SHA512
73ff847233a32b35f39b9015a231dad0360fc5037cec6bba45d8c76ec801f382668cd26cb0d79140e5a1356efc308807a56360a51993ac3b877b56000bf2086c

Download Submit
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Filesize
392KB

MD5
187aabbcb4ca164f10f47ea6d9b1dec4

SHA1
4de7ed089147f8dca9e0ec9c39114167765a5a0c

SHA256
d714a2ea0b437ad3ddb4759188b73d8923feb35d997a5cadc108382a1b438df0

SHA512
8a9033717f6375fb53e2460d516ee74acdaed6039b05306d011c23d0fe837ffa48c2835d6e87bea237fc7920b126c495f40525104ed51c28b9d508586250dd18

Download Submit
memory/4808-22-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4808-23-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4808-24-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4808-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-1-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/4940-2-0x0000000002080000-0x00000000020EB000-memory.dmp

Filesize
428KB

Download
memory/4940-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4940-19-0x0000000002080000-0x00000000020EB000-memory.dmp

Filesize
428KB

Download
memory/4940-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4940-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download