amadey | fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e

Analysis

max time kernel
145s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe
Size 486KB
Sample240621-b6n9ravfpg
SHA256 fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e
MD5 319d536f9299bf92b5d97150caed8fec
SHA1 b1e3514d557de62a2ea5460890cf36db62524c1c
SHA512 bc880c0d91d604bd122cbda12d2e248a15b41ff6900c7a760b851922beab02eaecce5fa70eb3fc13bd0ced30ddf158a9a534e6782d26ebf374e39624928a4f1a
SSDEEP 6144:pQ5Laikgzk7ztGAlAFor21ycKPRiLQQG3wD2pnhaDzB2r+Wo:yeikgw7zfQj6ocWzBHW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe

Executes dropped EXE 4 IoCs

pid	Process
4104	Dctooux.exe
948	Dctooux.exe
4396	Dctooux.exe
2996	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
1336	3184	WerFault.exe	80
6088	3184	WerFault.exe	80
1948	3184	WerFault.exe	80
4204	3184	WerFault.exe	80
1356	3184	WerFault.exe	80
1156	3184	WerFault.exe	80
3360	3184	WerFault.exe	80
5344	3184	WerFault.exe	80
4984	3184	WerFault.exe	80
5376	4104	WerFault.exe	100
1380	4104	WerFault.exe	100
4580	4104	WerFault.exe	100
2932	4104	WerFault.exe	100
3624	4104	WerFault.exe	100
444	4104	WerFault.exe	100
5708	4104	WerFault.exe	100
5532	4104	WerFault.exe	100
2324	4104	WerFault.exe	100
5400	4104	WerFault.exe	100
5668	4104	WerFault.exe	100
5416	4104	WerFault.exe	100
756	4104	WerFault.exe	100
1992	4104	WerFault.exe	100
4968	4104	WerFault.exe	100
2696	4104	WerFault.exe	100
4488	4104	WerFault.exe	100

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3184	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4104	3184	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe	100
PID 3184 wrote to memory of 4104	3184	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe	100
PID 3184 wrote to memory of 4104	3184	fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe	100

C:\Users\Admin\AppData\Local\Temp\fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe
"C:\Users\Admin\AppData\Local\Temp\fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 560
  2⤵
  - Program crash
  PID:1336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 792
  2⤵
  - Program crash
  PID:6088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 856
  2⤵
  - Program crash
  PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 904
  2⤵
  - Program crash
  PID:4204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 860
  2⤵
  - Program crash
  PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 964
  2⤵
  - Program crash
  PID:1156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1124
  2⤵
  - Program crash
  PID:3360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1184
  2⤵
  - Program crash
  PID:5344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1240
  2⤵
  - Program crash
  PID:4984
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 556
    3⤵
    - Program crash
    PID:5376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 596
    3⤵
    - Program crash
    PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 564
    3⤵
    - Program crash
    PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 612
    3⤵
    - Program crash
    PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 708
    3⤵
    - Program crash
    PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 884
    3⤵
    - Program crash
    PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 916
    3⤵
    - Program crash
    PID:5708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 936
    3⤵
    - Program crash
    PID:5532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 664
    3⤵
    - Program crash
    PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 720
    3⤵
    - Program crash
    PID:5400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 884
    3⤵
    - Program crash
    PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1176
    3⤵
    - Program crash
    PID:5416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1404
    3⤵
    - Program crash
    PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1436
    3⤵
    - Program crash
    PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1464
    3⤵
    - Program crash
    PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1468
    3⤵
    - Program crash
    PID:2696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 888
    3⤵
    - Program crash
    PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3184 -ip 3184
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3184 -ip 3184
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3184 -ip 3184
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3184 -ip 3184
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3184 -ip 3184
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3184 -ip 3184
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3184 -ip 3184
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3184 -ip 3184
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3184 -ip 3184
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4104 -ip 4104
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4104 -ip 4104
1⤵
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4104 -ip 4104
1⤵
PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4104 -ip 4104
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4104 -ip 4104
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4104 -ip 4104
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4104 -ip 4104
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4104 -ip 4104
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4104 -ip 4104
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4104 -ip 4104
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4104 -ip 4104
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4104 -ip 4104
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4104 -ip 4104
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4104 -ip 4104
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4104 -ip 4104
1⤵
PID:564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4104 -ip 4104
1⤵
PID:660

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:948

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 4104
1⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

124900551406

Path C:\Users\Admin\AppData\Local\Temp\124900551406
Size 84KB
SHA256 c7af62f29d9d0afedeb972b29bec342ab21200c4817feddf0a92b1bb630ef7b6
MD5 7ea3f738776ef33b9439816b04da2ab5
SHA1 61a23b77ff5c29879c1e5c401d67313b8e5252c3
SHA512 649a879046c67d5432f643eae110b6fb286ff899533af60388290cfa6d29b07fd9a61d8c0c5f2660d3f7776599b61a337513bc60fe1c60834f1a63d3865661df
SSDEEP 1536:swwACTPjv/4UkV8KFGESwyRSDhw7YQH6ieGeM7soK41CHL:5CLbM8OyMa7Y66ieQeHL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
Size 486KB
SHA256 fb7293cace4d978b86a0057ba90270b76b1ac2a4138de62f04124e3629ec696e
MD5 319d536f9299bf92b5d97150caed8fec
SHA1 b1e3514d557de62a2ea5460890cf36db62524c1c
SHA512 bc880c0d91d604bd122cbda12d2e248a15b41ff6900c7a760b851922beab02eaecce5fa70eb3fc13bd0ced30ddf158a9a534e6782d26ebf374e39624928a4f1a
SSDEEP 6144:pQ5Laikgzk7ztGAlAFor21ycKPRiLQQG3wD2pnhaDzB2r+Wo:yeikgw7zfQj6ocWzBHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-28-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/2996-57-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3184-15-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/3184-16-0x0000000004370000-0x00000000043DB000-memory.dmp

Download

memory/3184-2-0x0000000004370000-0x00000000043DB000-memory.dmp

Download

memory/3184-17-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3184-1-0x00000000029A0000-0x0000000002AA0000-memory.dmp

Download

memory/3184-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4104-19-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4104-20-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4104-25-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4104-41-0x0000000000400000-0x0000000002766000-memory.dmp

Download

memory/4396-48-0x0000000000400000-0x0000000002766000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads