amadey | 0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053

Analysis

max time kernel
145s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
19/06/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe
Size 393KB
Sample240619-3selyaxdmc
SHA256 0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053
MD5 15fe2f0f485f3fd3324d0a46970c2f75
SHA1 2be21ce37e7da24f65278f4239c3e2e3703380ef
SHA512 d727eab5f0ce87a851a5a49ce8fb045fa3d9a41ffc9779b8484c97a0ecc1bf54d88b38e8ad610b8392fa4a287ec70ef9a15696ed28af3b4054a89eeba29a3853
SSDEEP 6144:t7IXFk+bAgHkED1sD6ZTRjQ/IioBnNdOd1Aq4qpSGgR8NWcH:t0FkGAgHVfS9oBnNSCxnCH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 3 IoCs

pid	Process
3152	Dctooux.exe
3148	Dctooux.exe
4192	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
1928	3308	WerFault.exe	79
2352	3308	WerFault.exe	79
4932	3308	WerFault.exe	79
1536	3308	WerFault.exe	79
936	3308	WerFault.exe	79
2756	3308	WerFault.exe	79
1704	3308	WerFault.exe	79
4584	3308	WerFault.exe	79
4788	3308	WerFault.exe	79
692	3308	WerFault.exe	79
2808	3152	WerFault.exe	101
1084	3152	WerFault.exe	101
4444	3152	WerFault.exe	101
3564	3152	WerFault.exe	101
2028	3152	WerFault.exe	101
2332	3152	WerFault.exe	101
644	3152	WerFault.exe	101
3140	3152	WerFault.exe	101
3796	3152	WerFault.exe	101
4848	3152	WerFault.exe	101
2656	3152	WerFault.exe	101
3776	3152	WerFault.exe	101
2600	3152	WerFault.exe	101
3548	3152	WerFault.exe	101
4516	3152	WerFault.exe	101
3552	3152	WerFault.exe	101
5104	3148	WerFault.exe	136
740	4192	WerFault.exe	139
2340	3152	WerFault.exe	101

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3308	0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3152	3308	0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe	101
PID 3308 wrote to memory of 3152	3308	0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe	101
PID 3308 wrote to memory of 3152	3308	0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe	101

C:\Users\Admin\AppData\Local\Temp\0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe
"C:\Users\Admin\AppData\Local\Temp\0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 776
  2⤵
  - Program crash
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 820
  2⤵
  - Program crash
  PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 836
  2⤵
  - Program crash
  PID:4932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 944
  2⤵
  - Program crash
  PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 960
  2⤵
  - Program crash
  PID:936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 988
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 924
  2⤵
  - Program crash
  PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 1056
  2⤵
  - Program crash
  PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 1132
  2⤵
  - Program crash
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 584
    3⤵
    - Program crash
    PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 624
    3⤵
    - Program crash
    PID:1084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 672
    3⤵
    - Program crash
    PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 592
    3⤵
    - Program crash
    PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 600
    3⤵
    - Program crash
    PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 896
    3⤵
    - Program crash
    PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 604
    3⤵
    - Program crash
    PID:644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 928
    3⤵
    - Program crash
    PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 772
    3⤵
    - Program crash
    PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 980
    3⤵
    - Program crash
    PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1064
    3⤵
    - Program crash
    PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1072
    3⤵
    - Program crash
    PID:3776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1372
    3⤵
    - Program crash
    PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1464
    3⤵
    - Program crash
    PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1424
    3⤵
    - Program crash
    PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1444
    3⤵
    - Program crash
    PID:3552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 900
    3⤵
    - Program crash
    PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 828
  2⤵
  - Program crash
  PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 3308
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3308 -ip 3308
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3308 -ip 3308
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3308 -ip 3308
1⤵
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3308 -ip 3308
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3308 -ip 3308
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3308 -ip 3308
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3308 -ip 3308
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3308 -ip 3308
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3308 -ip 3308
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3152 -ip 3152
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3152 -ip 3152
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3152 -ip 3152
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3152 -ip 3152
1⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3152 -ip 3152
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3152 -ip 3152
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3152 -ip 3152
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3152 -ip 3152
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3152 -ip 3152
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3152 -ip 3152
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3152 -ip 3152
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3152 -ip 3152
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3152 -ip 3152
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3152 -ip 3152
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3152 -ip 3152
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3152 -ip 3152
1⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 472
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3148 -ip 3148
1⤵
PID:4508

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 476
  2⤵
  - Program crash
  PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4192 -ip 4192
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3152 -ip 3152
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

235821424191

Path C:\Users\Admin\AppData\Local\Temp\235821424191
Size 73KB
SHA256 6563524cacd8978df9e0cdf8452a8827dddd3e68390ad116cb266d172a69f4fb
MD5 5b521c370ec9bf9b1903157d121d23a7
SHA1 0b2d81112d14b872b1e2ab8c6a88b1db825fc975
SHA512 1d3c71f8a1d1d97f676f7999d929593f9cbd9f231395849fdb83f97a2fab9ad489b087058f2e47fd00f76f0122c9f3476a4b9578e85cc1ec4dce0547107bbbc2
SSDEEP 1536:smh0O9Zw5pXsVc2JOlG1qqns16/kmMqiu09m8978SvGPE:fn9JPJ4GYqns1aPMqdODV80
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
Size 393KB
SHA256 0cd3680d33ba4b97dc4966483187e70f6cb310052bee318a04cd40d9ba969053
MD5 15fe2f0f485f3fd3324d0a46970c2f75
SHA1 2be21ce37e7da24f65278f4239c3e2e3703380ef
SHA512 d727eab5f0ce87a851a5a49ce8fb045fa3d9a41ffc9779b8484c97a0ecc1bf54d88b38e8ad610b8392fa4a287ec70ef9a15696ed28af3b4054a89eeba29a3853
SSDEEP 6144:t7IXFk+bAgHkED1sD6ZTRjQ/IioBnNdOd1Aq4qpSGgR8NWcH:t0FkGAgHVfS9oBnNSCxnCH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3148-43-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3148-42-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3152-19-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3152-21-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3152-20-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3152-37-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3308-16-0x0000000002190000-0x00000000021FB000-memory.dmp

Download

memory/3308-15-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3308-1-0x0000000000670000-0x0000000000770000-memory.dmp

Download

memory/3308-17-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3308-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3308-2-0x0000000002190000-0x00000000021FB000-memory.dmp

Download

memory/4192-52-0x0000000000400000-0x0000000000472000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads