amadey | e13ae7c90a4db4542a59eddfe1c9f782734f38c10afdc7af5d9af8643de71d64

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 424KB
Sample240810-qaccmsvcme
SHA256 e13ae7c90a4db4542a59eddfe1c9f782734f38c10afdc7af5d9af8643de71d64
MD5 15d1a6dbe8e03ed42dd3331704c831c6
SHA1 8e99e168c0ebbb7ebebd90aca2f4e7e9fa162d99
SHA512 12cc492e5a6b3be78ba9f63b721b0203bae65481836cee5f9494dcf7273008fb7c65f43f8f9a02f5ba969b9828b329d3d8f90db79cf5c1678c1317de6ac79454
SSDEEP 12288:kQ0gckq7EK9/8LfpvOJy9p9CE7NPHNLaMxcDZY1TfPfOouob3sMcg:J5ckq7EKZ8LfpvgVEPLamsYhP13sMn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 0657d1 discovery trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 2336	3240	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3960	2336	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4868	3240	file.exe	85
PID 3240 wrote to memory of 4868	3240	file.exe	85
PID 3240 wrote to memory of 4868	3240	file.exe	85
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86
PID 3240 wrote to memory of 2336	3240	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 592
    3⤵
    - Program crash
    PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2336 -ip 2336
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-4-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2336-8-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2336-10-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2336-7-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3240-0-0x000000007510E000-0x000000007510F000-memory.dmp

Download

memory/3240-1-0x0000000000F60000-0x0000000000FD0000-memory.dmp

Download

memory/3240-11-0x0000000075100000-0x00000000758B0000-memory.dmp

Download

memory/3240-12-0x0000000075100000-0x00000000758B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads