amadey | 1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181

Analysis

max time kernel
32s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe
Size 424KB
Sample240810-q44c8asbll
SHA256 1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181
MD5 fb5ac625bfeaf62d095bca6f36cdf10e
SHA1 46b1af6b9954e7fe6536c7176992ca1963fbf8a3
SHA512 8c0cb41e28cacb135b05d506402c085ff8a90c9a575e914fe5a16d7ea16d82b1e64d6080ebe6920a2958d495ee5cf65832f847045908264ef0d60200b912c80d
SSDEEP 12288:r9S8Z84PKuzQ6e9UGHpnMXPBDHXLVKSeZT:r9S8Z84Pt+UeQPBD3LVKS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 0657d1 discovery trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5724 set thread context of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	3704	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81
PID 5724 wrote to memory of 3704	5724	1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe	81

C:\Users\Admin\AppData\Local\Temp\1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe
"C:\Users\Admin\AppData\Local\Temp\1402a0c673ab6c2c1f4293e6cd28e4a5d8042c98cdd53f6b63d9b9dd16517181.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 528
    3⤵
    - Program crash
    PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 3704
1⤵
PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3704-4-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3704-7-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3704-8-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3704-10-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/5724-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

Download

memory/5724-1-0x0000000000560000-0x00000000005D0000-memory.dmp

Download

memory/5724-11-0x00000000748C0000-0x0000000075071000-memory.dmp

Download

memory/5724-12-0x00000000748C0000-0x0000000075071000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads