amadey | 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
Size

398KB
MD5

efccb8ebc3cee38b7656617bd1b670ad
SHA1

6754e5a59ff6c2e569d61bd400e50beccc86f81b
SHA256

2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4
SHA512

6b9acfb5c7edd0dced0fc4358faa291a608ed5da1412f92b613a025ed462b9b9fb83e27d3f430f25cbf86a4d33032b573919faa8493981d2d4153fbf4ef6706e
SSDEEP

6144:zNyo3FETe9jaAjGExnmq15CWhFzVVB7JPueHPLEmeukdMdcH:zxFEi9jJHnmqCwF7B7dVOFH

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com

http://otyt.ru

http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

Executes dropped EXE 6 IoCs

pid	Process
4448	Dctooux.exe
4896	Dctooux.exe
4944	Dctooux.exe
60	Dctooux.exe
3520	Dctooux.exe
3664	Dctooux.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4968 set thread context of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4448 set thread context of 4896	4448	Dctooux.exe	88
PID 4944 set thread context of 60	4944	Dctooux.exe	92
PID 3520 set thread context of 3664	3520	Dctooux.exe	99

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 4968 wrote to memory of 1752	4968	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	86
PID 1752 wrote to memory of 4448	1752	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	87
PID 1752 wrote to memory of 4448	1752	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	87
PID 1752 wrote to memory of 4448	1752	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	87
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4448 wrote to memory of 4896	4448	Dctooux.exe	88
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 4944 wrote to memory of 60	4944	Dctooux.exe	92
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99
PID 3520 wrote to memory of 3664	3520	Dctooux.exe	99

C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
  "C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
    "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
      4⤵
      Executes dropped EXE
      PID:4896

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:60

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\124900551406

Filesize
76KB

MD5
5176105db85c14dbaeba822bf6f6d572

SHA1
f42fbebc760556c329e71b593aed974eca04042b

SHA256
e25d058d8b54dfeb653caae9fa5075dbaa01d3b11329a0ae26874798157191ca

SHA512
3f0c55f6d3f38f3d2f0796f44dc2ef2fb1f6ed3998e40388f0d901cd11312f72d791f308bb76695dab85cc209a0fed41cb5a6bfcec8027a1b6accd621e38d529

Download Submit
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Filesize
398KB

MD5
efccb8ebc3cee38b7656617bd1b670ad

SHA1
6754e5a59ff6c2e569d61bd400e50beccc86f81b

SHA256
2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4

SHA512
6b9acfb5c7edd0dced0fc4358faa291a608ed5da1412f92b613a025ed462b9b9fb83e27d3f430f25cbf86a4d33032b573919faa8493981d2d4153fbf4ef6706e

Download Submit
memory/60-58-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/60-57-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1752-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1752-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1752-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1752-20-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1752-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3664-71-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3664-70-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4448-26-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4448-28-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4896-29-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4896-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4896-31-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4896-45-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4896-27-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4896-60-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4896-30-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4968-2-0x0000000000520000-0x000000000058F000-memory.dmp

Filesize
444KB

Download
memory/4968-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download