amadey | 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4

Analysis

max time kernel
143s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
19-06-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
Size

398KB
MD5

efccb8ebc3cee38b7656617bd1b670ad
SHA1

6754e5a59ff6c2e569d61bd400e50beccc86f81b
SHA256

2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4
SHA512

6b9acfb5c7edd0dced0fc4358faa291a608ed5da1412f92b613a025ed462b9b9fb83e27d3f430f25cbf86a4d33032b573919faa8493981d2d4153fbf4ef6706e
SSDEEP

6144:zNyo3FETe9jaAjGExnmq15CWhFzVVB7JPueHPLEmeukdMdcH:zxFEi9jJHnmqCwF7B7dVOFH

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com

http://otyt.ru

http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 6 IoCs

pid	Process
4060	Dctooux.exe
2612	Dctooux.exe
1044	Dctooux.exe
2268	Dctooux.exe
8	Dctooux.exe
3912	Dctooux.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4120 set thread context of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4060 set thread context of 2612	4060	Dctooux.exe	79
PID 1044 set thread context of 2268	1044	Dctooux.exe	81
PID 8 set thread context of 3912	8	Dctooux.exe	83

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 4120 wrote to memory of 1108	4120	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	77
PID 1108 wrote to memory of 4060	1108	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	78
PID 1108 wrote to memory of 4060	1108	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	78
PID 1108 wrote to memory of 4060	1108	2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe	78
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 4060 wrote to memory of 2612	4060	Dctooux.exe	79
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 1044 wrote to memory of 2268	1044	Dctooux.exe	81
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83
PID 8 wrote to memory of 3912	8	Dctooux.exe	83

C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
  "C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
    "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
      4⤵
      Executes dropped EXE
      PID:2612

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:2268

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\474490143322

Filesize
83KB

MD5
2b46cecf0f8852ef966a58bc0a9e17e2

SHA1
d02fe3d9a7be78087d2bdd0df99b020059be7236

SHA256
79f7386963c690ea71a5033e12a0a212a7bd79d81d759a791e26887fc41db73b

SHA512
7389ee945f5b66053b384f12a65976afa2c7a8bddeb697c86a0f1c86336110315b62be6e3d2e6bb113bf80aec1f68f3ad3ac2e6744469f1c0da405b244f5e9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Filesize
398KB

MD5
efccb8ebc3cee38b7656617bd1b670ad

SHA1
6754e5a59ff6c2e569d61bd400e50beccc86f81b

SHA256
2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4

SHA512
6b9acfb5c7edd0dced0fc4358faa291a608ed5da1412f92b613a025ed462b9b9fb83e27d3f430f25cbf86a4d33032b573919faa8493981d2d4153fbf4ef6706e

Download Submit
memory/1108-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1108-2-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1108-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1108-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1108-22-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2268-58-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2268-59-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-32-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-30-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-31-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-41-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-46-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-28-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2612-61-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3912-71-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3912-72-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4060-29-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4060-25-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4120-4-0x00000000006E0000-0x000000000074F000-memory.dmp

Filesize
444KB

Download
memory/4120-1-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download