amadey | 7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9

Analysis

max time kernel
146s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2024, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe
Size 486KB
Sample240620-p3neyayare
SHA256 7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9
MD5 09371b0ec59d68d008b7c08a10de35cb
SHA1 3f8ea250788004d66680f2837352814f34eb2881
SHA512 4639e53f144de0d0c7160313f342fd0d25d20e19093b3bd87789a88820d660d5a44b135a0de1b9143ee38404fcd70ac850ee3169082eb46c6107bf82b46ab2d5
SSDEEP 6144:PQtL23MN3MyDFPfhLGNX1yH9pcYpPa3Yc/LLLXKUI:Ui3MNZ9fY29xpy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey b2c2c1 trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

http://greendag.ru

Attributes

install_dir
e221f72865
install_file
Dctooux.exe
strings_key
09a7af7983af08af50ea3f51a73065e9
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 3 IoCs

pid	Process
4968	Dctooux.exe
560	Dctooux.exe
2928	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2356	1480	WerFault.exe	79
5116	1480	WerFault.exe	79
3284	1480	WerFault.exe	79
2504	1480	WerFault.exe	79
1448	1480	WerFault.exe	79
4736	1480	WerFault.exe	79
3292	1480	WerFault.exe	79
1532	1480	WerFault.exe	79
3212	1480	WerFault.exe	79
3888	1480	WerFault.exe	79
856	4968	WerFault.exe	100
4136	4968	WerFault.exe	100
952	4968	WerFault.exe	100
1608	4968	WerFault.exe	100
4976	4968	WerFault.exe	100
904	4968	WerFault.exe	100
2488	4968	WerFault.exe	100
1828	4968	WerFault.exe	100
1824	4968	WerFault.exe	100
1444	4968	WerFault.exe	100
1028	4968	WerFault.exe	100
4080	4968	WerFault.exe	100
2076	4968	WerFault.exe	100
3496	4968	WerFault.exe	100
3152	4968	WerFault.exe	100
3956	4968	WerFault.exe	100
4168	560	WerFault.exe	135
1532	2928	WerFault.exe	138
1468	4968	WerFault.exe	100

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1480	7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4968	1480	7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe	100
PID 1480 wrote to memory of 4968	1480	7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe	100
PID 1480 wrote to memory of 4968	1480	7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe	100

C:\Users\Admin\AppData\Local\Temp\7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe
"C:\Users\Admin\AppData\Local\Temp\7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 776
  2⤵
  - Program crash
  PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 832
  2⤵
  - Program crash
  PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 876
  2⤵
  - Program crash
  PID:3284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 944
  2⤵
  - Program crash
  PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 948
  2⤵
  - Program crash
  PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 964
  2⤵
  - Program crash
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 964
  2⤵
  - Program crash
  PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1052
  2⤵
  - Program crash
  PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1132
  2⤵
  - Program crash
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 584
    3⤵
    - Program crash
    PID:856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 592
    3⤵
    - Program crash
    PID:4136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 604
    3⤵
    - Program crash
    PID:952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 608
    3⤵
    - Program crash
    PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 752
    3⤵
    - Program crash
    PID:4976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 772
    3⤵
    - Program crash
    PID:904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 908
    3⤵
    - Program crash
    PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 908
    3⤵
    - Program crash
    PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 980
    3⤵
    - Program crash
    PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 988
    3⤵
    - Program crash
    PID:1444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 712
    3⤵
    - Program crash
    PID:1028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1204
    3⤵
    - Program crash
    PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1432
    3⤵
    - Program crash
    PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1488
    3⤵
    - Program crash
    PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1404
    3⤵
    - Program crash
    PID:3152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1408
    3⤵
    - Program crash
    PID:3956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 856
    3⤵
    - Program crash
    PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1208
  2⤵
  - Program crash
  PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 1480
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1480 -ip 1480
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1480 -ip 1480
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1480 -ip 1480
1⤵
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1480 -ip 1480
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1480 -ip 1480
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1480 -ip 1480
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1480 -ip 1480
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1480 -ip 1480
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1480 -ip 1480
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4968 -ip 4968
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4968 -ip 4968
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4968 -ip 4968
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4968 -ip 4968
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4968 -ip 4968
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4968 -ip 4968
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4968 -ip 4968
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4968 -ip 4968
1⤵
PID:128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4968 -ip 4968
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4968 -ip 4968
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4968 -ip 4968
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4968 -ip 4968
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4968 -ip 4968
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4968 -ip 4968
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4968 -ip 4968
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4968 -ip 4968
1⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 468
  2⤵
  - Program crash
  PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 560 -ip 560
1⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 480
  2⤵
  - Program crash
  PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2928 -ip 2928
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4968 -ip 4968
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

560405787796

Path C:\Users\Admin\AppData\Local\Temp\560405787796
Size 79KB
SHA256 cb10aeac4d8274d42d3cb07a294a19a2689c181f044ffb925ca930b222399dc6
MD5 7e43bb48be08346f6fdeb67066de8a45
SHA1 147328a03fa5b6d83884b386ab0d575b1012e55f
SHA512 a1f323ccecd2305c15de5d1706db083c1e1cda7d88358b15723e44cfb7912e9f172454608e9ae1e3ed86b34ab2d3d74cf0306111527f73dd0ecd10f4cc42f224
SSDEEP 1536:svrjZdWcI5NfiwfGV3AEokEVkre5wxQGUsWURpcWFhw7i:SrWy8GHokEueuxPUX7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
Size 486KB
SHA256 7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9
MD5 09371b0ec59d68d008b7c08a10de35cb
SHA1 3f8ea250788004d66680f2837352814f34eb2881
SHA512 4639e53f144de0d0c7160313f342fd0d25d20e19093b3bd87789a88820d660d5a44b135a0de1b9143ee38404fcd70ac850ee3169082eb46c6107bf82b46ab2d5
SSDEEP 6144:PQtL23MN3MyDFPfhLGNX1yH9pcYpPa3Yc/LLLXKUI:Ui3MNZ9fY29xpy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-40-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/1480-18-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1480-19-0x0000000004470000-0x00000000044DB000-memory.dmp

Download

memory/1480-1-0x00000000028C0000-0x00000000029C0000-memory.dmp

Download

memory/1480-17-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/1480-2-0x0000000004470000-0x00000000044DB000-memory.dmp

Download

memory/1480-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2928-49-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4968-16-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4968-28-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4968-36-0x0000000000400000-0x0000000002766000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads