Analysis
- max time kernel
142s - max time network
118s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
21/06/2024, 01:21
General
- Target 7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe
- Size 486KB
- Sample240621-bq6tvsvbma
- SHA256 7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9
Malware Config
Extracted
-
amadey
-
4.21
-
b2c2c1
-
http://greendag.ru
-
install_dir
e221f72865
-
install_file
Dctooux.exe
-
strings_key
09a7af7983af08af50ea3f51a73065e9
-
url_paths
/forum/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe"C:\Users\Admin\AppData\Local\Temp\7ffdaf476524a9f3c0966b1fa0cb5551d542f310e6ed20d8832ca10b48e29dc9.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
691908287377
Dctooux.exe
memory/2416-1-0x00000000002F0000-0x00000000003F0000-memory.dmp
memory/2416-2-0x00000000027E0000-0x000000000284B000-memory.dmp
memory/2416-3-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2416-19-0x00000000002F0000-0x00000000003F0000-memory.dmp
memory/2416-20-0x0000000000400000-0x0000000002766000-memory.dmp
memory/2416-18-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2416-16-0x0000000000400000-0x0000000002766000-memory.dmp
memory/2708-30-0x0000000000400000-0x0000000002766000-memory.dmp
memory/2708-38-0x0000000000400000-0x0000000002766000-memory.dmp