amadey | fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e

Analysis

max time kernel
145s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2024, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe
Size 486KB
Sample240620-p7znrssgnl
SHA256 fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e
MD5 319d536f9299bf92b5d97150caed8fec
SHA1 b1e3514d557de62a2ea5460890cf36db62524c1c
SHA512 bc880c0d91d604bd122cbda12d2e248a15b41ff6900c7a760b851922beab02eaecce5fa70eb3fc13bd0ced30ddf158a9a534e6782d26ebf374e39624928a4f1a
SSDEEP 6144:pQ5Laikgzk7ztGAlAFor21ycKPRiLQQG3wD2pnhaDzB2r+Wo:yeikgw7zfQj6ocWzBHW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 1 IoCs

pid	Process
3256	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
4628	1436	WerFault.exe	76
2552	1436	WerFault.exe	76
2256	1436	WerFault.exe	76
3628	1436	WerFault.exe	76
3284	1436	WerFault.exe	76
4552	1436	WerFault.exe	76
2452	1436	WerFault.exe	76
4992	1436	WerFault.exe	76
3052	1436	WerFault.exe	76
2024	1436	WerFault.exe	76
3972	3256	WerFault.exe	96
1596	3256	WerFault.exe	96
1652	3256	WerFault.exe	96
896	3256	WerFault.exe	96
1540	3256	WerFault.exe	96
2500	3256	WerFault.exe	96
1228	3256	WerFault.exe	96
1608	3256	WerFault.exe	96
1744	3256	WerFault.exe	96
4604	3256	WerFault.exe	96
1484	3256	WerFault.exe	96
2264	3256	WerFault.exe	96
4344	3256	WerFault.exe	96
2112	3256	WerFault.exe	96
3356	3256	WerFault.exe	96
560	3256	WerFault.exe	96
3076	3256	WerFault.exe	96

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1436	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 3256	1436	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe	96
PID 1436 wrote to memory of 3256	1436	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe	96
PID 1436 wrote to memory of 3256	1436	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe	96

C:\Users\Admin\AppData\Local\Temp\fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe
"C:\Users\Admin\AppData\Local\Temp\fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 776
  2⤵
  - Program crash
  PID:4628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 820
  2⤵
  - Program crash
  PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 836
  2⤵
  - Program crash
  PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 932
  2⤵
  - Program crash
  PID:3628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 840
  2⤵
  - Program crash
  PID:3284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 968
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 956
  2⤵
  - Program crash
  PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1080
  2⤵
  - Program crash
  PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1060
  2⤵
  - Program crash
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:3256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 584
    3⤵
    - Program crash
    PID:3972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 604
    3⤵
    - Program crash
    PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 592
    3⤵
    - Program crash
    PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 720
    3⤵
    - Program crash
    PID:896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 832
    3⤵
    - Program crash
    PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 904
    3⤵
    - Program crash
    PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 832
    3⤵
    - Program crash
    PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 844
    3⤵
    - Program crash
    PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 840
    3⤵
    - Program crash
    PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 968
    3⤵
    - Program crash
    PID:4604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1064
    3⤵
    - Program crash
    PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1068
    3⤵
    - Program crash
    PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1452
    3⤵
    - Program crash
    PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1432
    3⤵
    - Program crash
    PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1412
    3⤵
    - Program crash
    PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1552
    3⤵
    - Program crash
    PID:560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 924
    3⤵
    - Program crash
    PID:3076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1284
  2⤵
  - Program crash
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 1436
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1436 -ip 1436
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1436 -ip 1436
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1436 -ip 1436
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1436 -ip 1436
1⤵
PID:72

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1436 -ip 1436
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1436 -ip 1436
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1436 -ip 1436
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1436 -ip 1436
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1436 -ip 1436
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3256 -ip 3256
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3256 -ip 3256
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3256 -ip 3256
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3256 -ip 3256
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3256 -ip 3256
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3256 -ip 3256
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3256 -ip 3256
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3256 -ip 3256
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3256 -ip 3256
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3256 -ip 3256
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3256 -ip 3256
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3256 -ip 3256
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3256 -ip 3256
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3256 -ip 3256
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3256 -ip 3256
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3256 -ip 3256
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3256 -ip 3256
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

433428765247

Path C:\Users\Admin\AppData\Local\Temp\433428765247
Size 79KB
SHA256 d92fef6974bc9d5832671a11469d99fb475a29c28832b80f840e84e8855b5cd4
MD5 c3f5453522b8ad61ac56d2e3773e4728
SHA1 885bfd461fc355d67be76ee120ad302119b2fc40
SHA512 afa7105e9028a97e80381b8aab981b3909d71fd9aa7486f50d7472bf3846740017b969676fdc308ed84d2ebf352155b4184455397ee15682d3199ac06fb7548b
SSDEEP 1536:sUG5ObeQ2MjfyugdaTm67sUvH5cSxwcmx2Tu1G0kVvpagpb:yUbFfytm579vHGSxRTR0kVRam
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
Size 486KB
SHA256 fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e
MD5 319d536f9299bf92b5d97150caed8fec
SHA1 b1e3514d557de62a2ea5460890cf36db62524c1c
SHA512 bc880c0d91d604bd122cbda12d2e248a15b41ff6900c7a760b851922beab02eaecce5fa70eb3fc13bd0ced30ddf158a9a534e6782d26ebf374e39624928a4f1a
SSDEEP 6144:pQ5Laikgzk7ztGAlAFor21ycKPRiLQQG3wD2pnhaDzB2r+Wo:yeikgw7zfQj6ocWzBHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1436-1-0x0000000002850000-0x0000000002950000-memory.dmp

Download

memory/1436-2-0x00000000044A0000-0x000000000450B000-memory.dmp

Download

memory/1436-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1436-19-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1436-18-0x00000000044A0000-0x000000000450B000-memory.dmp

Download

memory/1436-17-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3256-16-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3256-28-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3256-36-0x0000000000400000-0x0000000002766000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads