amadey | ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5

Analysis

max time kernel
195s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/09/2024, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe
Size

539KB
MD5

4d40ebb93aa34bf94d303c07c6a7e5e5
SHA1

9333bc5b3f78f0a3cca32e1f6a90af8064bf8a81
SHA256

ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5
SHA512

9cdce881809159ad07d99e9691c1457e7888aa96cf0ea93a19eea105b9db928f8f61c8de98c3b9179556b528fde4eb790d59e954db8a86799aecb38461741d3a
SSDEEP

12288:qOfX3Lh7cnz3M+QnY1UXC0lQkqTJ9k3TBV+zF:nHJcnz3HIC0lmk3TqF

Score

10^/10

amadey 1176f2 discovery trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3204	4708	WerFault.exe	72

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72
PID 4236 wrote to memory of 4708	4236	ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe	72

C:\Users\Admin\AppData\Local\Temp\ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe
"C:\Users\Admin\AppData\Local\Temp\ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 616
    3⤵
    - Program crash
    PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4236-0-0x00007FFFD3123000-0x00007FFFD3124000-memory.dmp

Filesize
4KB

Download
memory/4236-1-0x00000000005D0000-0x000000000065E000-memory.dmp

Filesize
568KB

Download
memory/4236-2-0x00007FFFD3120000-0x00007FFFD3B0C000-memory.dmp

Filesize
9.9MB

Download
memory/4236-3-0x000000001C0A0000-0x000000001C122000-memory.dmp

Filesize
520KB

Download
memory/4236-5-0x000000001C260000-0x000000001C2D0000-memory.dmp

Filesize
448KB

Download
memory/4236-4-0x00007FFFD3120000-0x00007FFFD3B0C000-memory.dmp

Filesize
9.9MB

Download
memory/4236-11-0x00007FFFD3120000-0x00007FFFD3B0C000-memory.dmp

Filesize
9.9MB

Download
memory/4236-12-0x00007FFFD3120000-0x00007FFFD3B0C000-memory.dmp

Filesize
9.9MB

Download
memory/4708-6-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4708-10-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4708-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4708-7-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download