amadey | f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6

Analysis

max time kernel
143s
max time network
66s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe
Size 485KB
Sample240620-fx9ljs1bna
SHA256 f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6
MD5 63f4a9d79e15748b849f796db8890b8c
SHA1 136fbafce2c84a883da23106b3c7134f878dfd3c
SHA512 69a0f154d181fcd56619156b4e51274d3424210cb7e31a4c9d76682feeba21e10e4c76c86c75269c9e28f18f5d05bfdea10e280a5f9b1c99e2d8742e09a7573a
SSDEEP 6144:iEVLU6ETYZMapmWg2ofxUolHtsfyi8mDvQ6zyhplpeJwMKfW9Z2HhZqTR+:tA6ETYLm3hl3owplggO94iR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 3 IoCs

pid	Process
2408	Dctooux.exe
2460	Dctooux.exe
580	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
2076	412	WerFault.exe	77
3204	412	WerFault.exe	77
5084	412	WerFault.exe	77
4964	412	WerFault.exe	77
2540	412	WerFault.exe	77
2096	412	WerFault.exe	77
5116	412	WerFault.exe	77
2760	412	WerFault.exe	77
1344	412	WerFault.exe	77
1868	412	WerFault.exe	77
4436	2408	WerFault.exe	97
848	2408	WerFault.exe	97
4748	2408	WerFault.exe	97
800	2408	WerFault.exe	97
3188	2408	WerFault.exe	97
4672	2408	WerFault.exe	97
1436	2408	WerFault.exe	97
1732	2408	WerFault.exe	97
2372	2408	WerFault.exe	97
2396	2408	WerFault.exe	97
3884	2408	WerFault.exe	97
4220	2408	WerFault.exe	97
4612	2408	WerFault.exe	97
2644	2408	WerFault.exe	97
5004	2408	WerFault.exe	97
3192	2408	WerFault.exe	97
2856	2408	WerFault.exe	97
1424	2460	WerFault.exe	134
1816	580	WerFault.exe	137
4624	2408	WerFault.exe	97

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
412	f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2408	412	f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe	97
PID 412 wrote to memory of 2408	412	f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe	97
PID 412 wrote to memory of 2408	412	f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe	97

C:\Users\Admin\AppData\Local\Temp\f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe
"C:\Users\Admin\AppData\Local\Temp\f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 776
  2⤵
  - Program crash
  PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 796
  2⤵
  - Program crash
  PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 840
  2⤵
  - Program crash
  PID:5084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 932
  2⤵
  - Program crash
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 976
  2⤵
  - Program crash
  PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 1012
  2⤵
  - Program crash
  PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 840
  2⤵
  - Program crash
  PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 1084
  2⤵
  - Program crash
  PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 1132
  2⤵
  - Program crash
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 576
    3⤵
    - Program crash
    PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 624
    3⤵
    - Program crash
    PID:848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 588
    3⤵
    - Program crash
    PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 736
    3⤵
    - Program crash
    PID:800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 876
    3⤵
    - Program crash
    PID:3188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 916
    3⤵
    - Program crash
    PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 776
    3⤵
    - Program crash
    PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 888
    3⤵
    - Program crash
    PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 964
    3⤵
    - Program crash
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 872
    3⤵
    - Program crash
    PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1064
    3⤵
    - Program crash
    PID:3884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1072
    3⤵
    - Program crash
    PID:4220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1448
    3⤵
    - Program crash
    PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1404
    3⤵
    - Program crash
    PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1408
    3⤵
    - Program crash
    PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1508
    3⤵
    - Program crash
    PID:3192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1452
    3⤵
    - Program crash
    PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 928
    3⤵
    - Program crash
    PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 1284
  2⤵
  - Program crash
  PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 412 -ip 412
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 412 -ip 412
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 412 -ip 412
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 412 -ip 412
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 412 -ip 412
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 412 -ip 412
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 412 -ip 412
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 412 -ip 412
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 412 -ip 412
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 412 -ip 412
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2408 -ip 2408
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2408 -ip 2408
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2408 -ip 2408
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2408 -ip 2408
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2408 -ip 2408
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2408 -ip 2408
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
1⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2408 -ip 2408
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2408 -ip 2408
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2408 -ip 2408
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2408 -ip 2408
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2408 -ip 2408
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2408 -ip 2408
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2408 -ip 2408
1⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 472
  2⤵
  - Program crash
  PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2460 -ip 2460
1⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 472
  2⤵
  - Program crash
  PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 580 -ip 580
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2408 -ip 2408
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

457560273698

Path C:\Users\Admin\AppData\Local\Temp\457560273698
Size 81KB
SHA256 c3e3552530dd59ce87625a99b27b89ca4876919bf1b3c4d79b1281f9ba13bcfc
MD5 6cb907d7c9518f2e7d04f7f4b156afdc
SHA1 5067e0c98c6029cc6bb70049fb3c922cf481ee6b
SHA512 60ccac5ab84a4def6024190d5e5191b043520b5fb92f644939aac00f8860b09f27cdb377482862dc0d41ee312906b4d350c900d5b09f3619d659ac3f6ad42aa9
SSDEEP 1536:sZpEkBJlLrYX8Vy49//8rs7CgOzYPNlYvMIJVmcVQSmALCjW:Sb1By4F0rs724ZQVHL2W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
Size 485KB
SHA256 f46dad8197b2d0a34a8d55b46a204c0f0be76efd2cfad9125631e0d26f1125c6
MD5 63f4a9d79e15748b849f796db8890b8c
SHA1 136fbafce2c84a883da23106b3c7134f878dfd3c
SHA512 69a0f154d181fcd56619156b4e51274d3424210cb7e31a4c9d76682feeba21e10e4c76c86c75269c9e28f18f5d05bfdea10e280a5f9b1c99e2d8742e09a7573a
SSDEEP 6144:iEVLU6ETYZMapmWg2ofxUolHtsfyi8mDvQ6zyhplpeJwMKfW9Z2HhZqTR+:tA6ETYLm3hl3owplggO94iR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/412-2-0x0000000004490000-0x00000000044FB000-memory.dmp

Download

memory/412-18-0x0000000004490000-0x00000000044FB000-memory.dmp

Download

memory/412-19-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/412-17-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/412-1-0x0000000002920000-0x0000000002A20000-memory.dmp

Download

memory/580-49-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/2408-16-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/2408-24-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/2408-37-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/2460-40-0x0000000000400000-0x0000000002766000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads