amadey | cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821

Analysis

max time kernel
146s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
19/06/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe
Size 418KB
Sample240619-yb8q8sshjl
SHA256 cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821
MD5 e17d585a0eced5c95e2701fdfc4fefd5
SHA1 517e9808fc160c9f894ce5b65df84b42c9ca97d1
SHA512 c628fa8c10b5e3b9892bf4ebe7671ca7cf5cbee8637961addc7ba884bd9c410cf96222b3f9c52a4bc7432f79fcdadbd867d487cecaeb39be1018d304a78710a6
SSDEEP 12288:2nvoAoALor4lTuqJKeYwT5NkZ/vsNdXH:YLLorOTPKeYwlNQEPX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com
http://otyt.ru
http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 4 IoCs

pid	Process
2052	Dctooux.exe
2320	Dctooux.exe
2416	Dctooux.exe
4572	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 37 IoCs

pid	pid_target	Process	procid_target
3588	2888	WerFault.exe	76
4232	2888	WerFault.exe	76
3824	2888	WerFault.exe	76
2352	2888	WerFault.exe	76
1936	2888	WerFault.exe	76
1208	2888	WerFault.exe	76
5116	2888	WerFault.exe	76
3744	2888	WerFault.exe	76
2596	2888	WerFault.exe	76
4604	2888	WerFault.exe	76
748	2888	WerFault.exe	76
2876	2888	WerFault.exe	76
2488	2052	WerFault.exe	96
1948	2052	WerFault.exe	96
1176	2052	WerFault.exe	96
2960	2052	WerFault.exe	96
1568	2052	WerFault.exe	96
3184	2052	WerFault.exe	96
3844	2052	WerFault.exe	96
4792	2052	WerFault.exe	96
1092	2052	WerFault.exe	96
656	2052	WerFault.exe	96
4480	2052	WerFault.exe	96
2616	2052	WerFault.exe	96
4560	2052	WerFault.exe	96
2148	2052	WerFault.exe	96
2972	2052	WerFault.exe	96
5100	2052	WerFault.exe	96
2040	2052	WerFault.exe	96
4668	2320	WerFault.exe	117
1000	2052	WerFault.exe	96
4248	2320	WerFault.exe	117
4360	2416	WerFault.exe	144
4056	2416	WerFault.exe	144
1548	4572	WerFault.exe	149
4720	4572	WerFault.exe	149
4368	2052	WerFault.exe	96

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2052	2888	cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe	96
PID 2888 wrote to memory of 2052	2888	cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe	96
PID 2888 wrote to memory of 2052	2888	cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe	96

C:\Users\Admin\AppData\Local\Temp\cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe
"C:\Users\Admin\AppData\Local\Temp\cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 776
  2⤵
  - Program crash
  PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 816
  2⤵
  - Program crash
  PID:4232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 876
  2⤵
  - Program crash
  PID:3824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 932
  2⤵
  - Program crash
  PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 972
  2⤵
  - Program crash
  PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1008
  2⤵
  - Program crash
  PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 920
  2⤵
  - Program crash
  PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 920
  2⤵
  - Program crash
  PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1132
  2⤵
  - Program crash
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 588
    3⤵
    - Program crash
    PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 608
    3⤵
    - Program crash
    PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 624
    3⤵
    - Program crash
    PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 688
    3⤵
    - Program crash
    PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 764
    3⤵
    - Program crash
    PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 772
    3⤵
    - Program crash
    PID:3184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 720
    3⤵
    - Program crash
    PID:3844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 932
    3⤵
    - Program crash
    PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 952
    3⤵
    - Program crash
    PID:1092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 952
    3⤵
    - Program crash
    PID:656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 988
    3⤵
    - Program crash
    PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1072
    3⤵
    - Program crash
    PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1216
    3⤵
    - Program crash
    PID:4560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1244
    3⤵
    - Program crash
    PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1380
    3⤵
    - Program crash
    PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1484
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1380
    3⤵
    - Program crash
    PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1348
    3⤵
    - Program crash
    PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 896
    3⤵
    - Program crash
    PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 892
  2⤵
  - Program crash
  PID:4604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1620
  2⤵
  - Program crash
  PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1628
  2⤵
  - Program crash
  PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 2888
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2888 -ip 2888
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2888 -ip 2888
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2888 -ip 2888
1⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2888 -ip 2888
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2888 -ip 2888
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2888 -ip 2888
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2888 -ip 2888
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2888 -ip 2888
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2888 -ip 2888
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2888 -ip 2888
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2888 -ip 2888
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2052 -ip 2052
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2052 -ip 2052
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2052 -ip 2052
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2052 -ip 2052
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2052 -ip 2052
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2052 -ip 2052
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2052 -ip 2052
1⤵
PID:404

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 472
  2⤵
  - Program crash
  PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 520
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2052 -ip 2052
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2052 -ip 2052
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2052 -ip 2052
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2052 -ip 2052
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2052 -ip 2052
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2052 -ip 2052
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2052 -ip 2052
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2052 -ip 2052
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2052 -ip 2052
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2052 -ip 2052
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2320 -ip 2320
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2052 -ip 2052
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2320 -ip 2320
1⤵
PID:2108

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 472
  2⤵
  - Program crash
  PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 492
  2⤵
  - Program crash
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2416 -ip 2416
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2416 -ip 2416
1⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 472
  2⤵
  - Program crash
  PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 480
  2⤵
  - Program crash
  PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4572 -ip 4572
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4572 -ip 4572
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2052 -ip 2052
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

198854727384

Path C:\Users\Admin\AppData\Local\Temp\198854727384
Size 73KB
SHA256 31498cc8d053efdbe623b6a159566b1633636fdbd03a063270e8500644eb7d67
MD5 ceeba5b0088d116a2e72cf6ee7636e02
SHA1 f450420a45e5778774fd4497c2254e9272d1237a
SHA512 eb66cb0a72bdddf6409ac65f0a6f51fabe95a54b6c1682a144c1573557fb210a5348d6030aaa8fc901d415b4e50e6b7f13d8050952feb566dbc8f605ef75469c
SSDEEP 1536:sv/7SPiUJb+atMjfx4ZXK/C3D6u68oKwX6fFeZopMwmr7WSqXXp:w7EiUJbefC8/46u6IYawoiwmr71M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
Size 418KB
SHA256 cb5a0d461b5a3b743512012fad2824c2c240ef469cf8c10bcfa647fe0c24e821
MD5 e17d585a0eced5c95e2701fdfc4fefd5
SHA1 517e9808fc160c9f894ce5b65df84b42c9ca97d1
SHA512 c628fa8c10b5e3b9892bf4ebe7671ca7cf5cbee8637961addc7ba884bd9c410cf96222b3f9c52a4bc7432f79fcdadbd867d487cecaeb39be1018d304a78710a6
SSDEEP 12288:2nvoAoALor4lTuqJKeYwT5NkZ/vsNdXH:YLLorOTPKeYwlNQEPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2052-43-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2052-42-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2052-19-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2320-30-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2320-29-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2416-50-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2888-21-0x0000000002180000-0x00000000021EF000-memory.dmp

Download

memory/2888-22-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2888-2-0x0000000002180000-0x00000000021EF000-memory.dmp

Download

memory/2888-20-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2888-3-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2888-1-0x0000000000620000-0x0000000000720000-memory.dmp

Download

memory/4572-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads