Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Dctooux.job	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2104 wrote to memory of 1696	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2104 wrote to memory of 1696	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2104 wrote to memory of 1696	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe

"C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1236

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1432

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1616 -ip 1616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 440

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2088 -ip 2088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 892

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
BE	88.221.83.203:443	www.bing.com	tcp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	203.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	check-ftp.ru	udp
US	8.8.8.8:53		udp
US	8.8.8.8:53	techolivls.in	udp
MD	188.237.2.116:80	check-ftp.ru	tcp
MD	188.237.2.116:80	check-ftp.ru	tcp
N/A	127.0.0.127:80		tcp
N/A	127.0.0.127:80		tcp
MD	188.237.2.116:80	check-ftp.ru	tcp
US	8.8.8.8:53	116.2.237.188.in-addr.arpa	udp
N/A	127.0.0.127:80		tcp
N/A	127.0.0.127:80		tcp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
N/A	127.0.0.127:80		tcp
US	8.8.8.8:53	techolivls.in	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	65.139.73.23.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	152.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

memory/2104-1-0x0000000000710000-0x0000000000810000-memory.dmp

memory/2104-2-0x0000000001FB0000-0x000000000201B000-memory.dmp

memory/2104-3-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

MD5	a697d145e3d3eec4667492f4924733d3
SHA1	b64d35875bfa9ca4b26b52eb34efd03b9516f152
SHA256	e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408
SHA512	ea6798cff47f9a677b9993dc62435f44fe2c79d0b8982a5d96adc925b520a8ca1995e07e87719757449ba45abbc50c1b3f0ac756cc38766711888dfe235f8dca

memory/2104-20-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2104-19-0x0000000001FB0000-0x000000000201B000-memory.dmp

memory/2104-18-0x0000000000400000-0x000000000047A000-memory.dmp

memory/1696-22-0x0000000000400000-0x000000000047A000-memory.dmp

memory/1696-24-0x0000000000400000-0x000000000047A000-memory.dmp

memory/1696-23-0x0000000000400000-0x000000000047A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\004059303877

MD5	8ba1db37bf0b30028fcbd4e17dbd688c
SHA1	443e66ab3d140cc7107a134cfd1b8b9651ba3601
SHA256	f633f573fad2f8cfc90103980ad1426d3849a3bfdda5d653dc8b175171d0ac2a
SHA512	d0c5d7c3253ecedcc94bd879bac6e1a794dc57c90ab0501c541d40755b10cf5d2ea23b2c7f0a73ebe7f857b655dcd881174a434068d743ddcdb5f4cd636a92ca

memory/1696-33-0x0000000000400000-0x000000000047A000-memory.dmp

memory/1696-41-0x0000000000400000-0x000000000047A000-memory.dmp

memory/1616-47-0x0000000000400000-0x000000000047A000-memory.dmp

memory/1616-48-0x0000000000400000-0x000000000047A000-memory.dmp

memory/2088-58-0x0000000000400000-0x000000000047A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 09:48

Reported

2024-06-19 09:50

Platform

win11-20240508-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Dctooux.job	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 644 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 644 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 644 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe	C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe

"C:\Users\Admin\AppData\Local\Temp\e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 1140

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1532

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2504 -ip 2504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 904

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	dnschnj.at	udp
US	8.8.8.8:53	techolivls.in	udp
US	8.8.8.8:53	check-ftp.ru	udp
MX	187.152.17.215:80	check-ftp.ru	tcp
MX	187.152.17.215:80	check-ftp.ru	tcp
MX	187.152.17.215:80	check-ftp.ru	tcp

Files

memory/644-1-0x0000000000640000-0x0000000000740000-memory.dmp

memory/644-2-0x00000000021E0000-0x000000000224B000-memory.dmp

memory/644-3-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

MD5	a697d145e3d3eec4667492f4924733d3
SHA1	b64d35875bfa9ca4b26b52eb34efd03b9516f152
SHA256	e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408
SHA512	ea6798cff47f9a677b9993dc62435f44fe2c79d0b8982a5d96adc925b520a8ca1995e07e87719757449ba45abbc50c1b3f0ac756cc38766711888dfe235f8dca

memory/644-17-0x0000000000400000-0x000000000047A000-memory.dmp

memory/644-20-0x0000000000400000-0x0000000000470000-memory.dmp

memory/644-19-0x00000000021E0000-0x000000000224B000-memory.dmp

memory/2504-22-0x0000000000400000-0x000000000047A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\433428765247

MD5	26d373026e9ef32c0ab2f99c02f2c44b
SHA1	2722278e3e946ef6f34c9a127a547525064e3156
SHA256	9b5b0f4ae57817a7ec1f51ff96c137e832cd2b0d3f8e059db82872f7adee1af3
SHA512	ea5acdd6bed7361902265bd70c033a04b0d992a0994d596c85b16068483e1b2aeb46ade8fbb7529d6a3dcd9052984f900519fa99e2e54c0f7c279515411763f6

memory/2504-38-0x0000000000400000-0x000000000047A000-memory.dmp

memory/4264-44-0x0000000000400000-0x000000000047A000-memory.dmp

memory/4264-45-0x0000000000400000-0x000000000047A000-memory.dmp

memory/4264-46-0x0000000000400000-0x000000000047A000-memory.dmp

memory/2532-55-0x0000000000400000-0x000000000047A000-memory.dmp

Sample ID	240619-lssecsyamc
Target	e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408
SHA256	e71406c0c2b813a55ec12d1f91bfa3a68d20003f82b5180742d5584fdf5c8408
Tags	amadey 9a3efc trojan

Malware Analysis Report

2024-09-11 11:20

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files