amadey | d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe
Size 485KB
Sample240620-m2g6estdnc
SHA256 d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77
MD5 4c56662fa80c2e376642690efbe5db81
SHA1 1e99ecfdeb83a10ee51eb645961759f8c00b21c3
SHA512 f5851c76d6a5aaefe1ec4eec79604acd61c9ca3329ee4d0772fa0920f7811ba8d200b5cc445ede8610906ca79adaae46a832090ec7c6e537aa8cc3d56f7a8918
SSDEEP 6144:UQrLFSk5LJ47L+mRsp/jsRQWlrPNv0mnjdNhNQxVHNAhSRlhj0Lp:JJSk5L3mRimQWdPNv9nJrQNAjL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 4 IoCs

pid	Process
3188	Dctooux.exe
4524	Dctooux.exe
1416	Dctooux.exe
1056	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
1976	1796	WerFault.exe	79
2440	1796	WerFault.exe	79
3928	1796	WerFault.exe	79
1516	1796	WerFault.exe	79
5044	1796	WerFault.exe	79
724	1796	WerFault.exe	79
3132	1796	WerFault.exe	79
4548	1796	WerFault.exe	79
3076	1796	WerFault.exe	79
776	1796	WerFault.exe	79
3576	3188	WerFault.exe	99
4940	3188	WerFault.exe	99
4012	3188	WerFault.exe	99
3616	3188	WerFault.exe	99
2572	3188	WerFault.exe	99
568	3188	WerFault.exe	99
4312	3188	WerFault.exe	99
2736	3188	WerFault.exe	99
4200	3188	WerFault.exe	99
2472	3188	WerFault.exe	99
4644	3188	WerFault.exe	99
2400	3188	WerFault.exe	99
2028	3188	WerFault.exe	99
1688	3188	WerFault.exe	99
2916	3188	WerFault.exe	99
3604	3188	WerFault.exe	99
4968	3188	WerFault.exe	99
5024	4524	WerFault.exe	136
4168	1416	WerFault.exe	139
3948	3188	WerFault.exe	99

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 3188	1796	d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe	99
PID 1796 wrote to memory of 3188	1796	d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe	99
PID 1796 wrote to memory of 3188	1796	d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe	99

C:\Users\Admin\AppData\Local\Temp\d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe
"C:\Users\Admin\AppData\Local\Temp\d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 776
  2⤵
  - Program crash
  PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 820
  2⤵
  - Program crash
  PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 876
  2⤵
  - Program crash
  PID:3928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 924
  2⤵
  - Program crash
  PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 968
  2⤵
  - Program crash
  PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 924
  2⤵
  - Program crash
  PID:724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1028
  2⤵
  - Program crash
  PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1092
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1140
  2⤵
  - Program crash
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 584
    3⤵
    - Program crash
    PID:3576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 604
    3⤵
    - Program crash
    PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 628
    3⤵
    - Program crash
    PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 656
    3⤵
    - Program crash
    PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 752
    3⤵
    - Program crash
    PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 896
    3⤵
    - Program crash
    PID:568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 920
    3⤵
    - Program crash
    PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 940
    3⤵
    - Program crash
    PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 980
    3⤵
    - Program crash
    PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1000
    3⤵
    - Program crash
    PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1044
    3⤵
    - Program crash
    PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1200
    3⤵
    - Program crash
    PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1448
    3⤵
    - Program crash
    PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1420
    3⤵
    - Program crash
    PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1424
    3⤵
    - Program crash
    PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1508
    3⤵
    - Program crash
    PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1468
    3⤵
    - Program crash
    PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 900
    3⤵
    - Program crash
    PID:3948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1184
  2⤵
  - Program crash
  PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1796 -ip 1796
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1796 -ip 1796
1⤵
PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1796 -ip 1796
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1796 -ip 1796
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1796 -ip 1796
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1796 -ip 1796
1⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1796 -ip 1796
1⤵
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1796 -ip 1796
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1796 -ip 1796
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1796 -ip 1796
1⤵
PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3188 -ip 3188
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3188 -ip 3188
1⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3188 -ip 3188
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3188 -ip 3188
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3188 -ip 3188
1⤵
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3188 -ip 3188
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3188 -ip 3188
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3188 -ip 3188
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3188 -ip 3188
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3188 -ip 3188
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3188 -ip 3188
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3188 -ip 3188
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3188 -ip 3188
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3188 -ip 3188
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3188 -ip 3188
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3188 -ip 3188
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3188 -ip 3188
1⤵
PID:2692

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 480
  2⤵
  - Program crash
  PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4524 -ip 4524
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 480
  2⤵
  - Program crash
  PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1416 -ip 1416
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3188 -ip 3188
1⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

433428765247

Path C:\Users\Admin\AppData\Local\Temp\433428765247
Size 74KB
SHA256 8c93472bc192ba7e9c7d4ba649acc1a09c4c4f9af2e4dcf26322d5096647064a
MD5 c2d78a4ff3baa9ee6574f07e22638eb7
SHA1 00780f87a978cd6846f0b7a68186d8dff909dec1
SHA512 21870ff9af5d06393a492d7bf06e7f46c970abca3bafff01136f55d715cfb321c49d198be62c70e5e1f78cb6e8edbcf5b95cca7dc4394799a9f4d3f9ad2a95b7
SSDEEP 1536:skyxrmh/W46zx/fc8gZGHiJNeMVMeO6Um9:GxSh/WZtXcFRHeyMeP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
Size 485KB
SHA256 d2d022a3366c1ae252fcb146277ac60e373e0078b6550b91dcc9fbcc9a42cc77
MD5 4c56662fa80c2e376642690efbe5db81
SHA1 1e99ecfdeb83a10ee51eb645961759f8c00b21c3
SHA512 f5851c76d6a5aaefe1ec4eec79604acd61c9ca3329ee4d0772fa0920f7811ba8d200b5cc445ede8610906ca79adaae46a832090ec7c6e537aa8cc3d56f7a8918
SSDEEP 6144:UQrLFSk5LJ47L+mRsp/jsRQWlrPNv0mnjdNhNQxVHNAhSRlhj0Lp:JJSk5L3mRimQWdPNv9nJrQNAjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-47-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/1796-1-0x0000000002970000-0x0000000002A70000-memory.dmp

Download

memory/1796-2-0x00000000044E0000-0x000000000454B000-memory.dmp

Download

memory/1796-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1796-18-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1796-17-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3188-16-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3188-34-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4524-38-0x0000000000400000-0x0000000002766000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads