Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 02:45

General

  • Target

    ced8891ea8d87005de989f25f0f94634d1fc70ebb37302cf21aa0c0b0e13350f.exe

  • Size

    1.3MB

  • MD5

    db04aa6e158c5d52c20fc855f5285905

  • SHA1

    822416dfa3f094aa6776ed0cad77fb9083db29a3

  • SHA256

    ced8891ea8d87005de989f25f0f94634d1fc70ebb37302cf21aa0c0b0e13350f

  • SHA512

    cdc0ff46ac48178da0a68d4e2601a46a960c3aa998edd66a7bb6a39d1caa7dbbe53f1aa463307a9932996d2993386addc7c54cee73811897b075dd75fbc904ff

  • SSDEEP

    24576:wbsh2BfGSklE31Sa1jnzi+k24VR5SLRUyvQAqBYcTHykVbFv4pOdfEPkXsvHo/s/:wbsQf6lEFti+kZRSUJAqB/VRsO/oo/sJ

Malware Config

Extracted

Family

amadey

Version

4.18

Botnet

1cc3fe

C2

http://vitantgroup.com

Attributes
  • install_dir

    431a343abc

  • install_file

    Dctooux.exe

  • strings_key

    5a2387e2bfef84adb686c856b4155237

  • url_paths

    /xmlrpc.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ced8891ea8d87005de989f25f0f94634d1fc70ebb37302cf21aa0c0b0e13350f.exe
    "C:\Users\Admin\AppData\Local\Temp\ced8891ea8d87005de989f25f0f94634d1fc70ebb37302cf21aa0c0b0e13350f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
      "C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4596
  • C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
    C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2044
  • C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
    C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\050598569159

    Filesize

    79KB

    MD5

    69e5e03a97b2b453e2447c0d2ad5f05a

    SHA1

    36f1f5e779bc5d212288bd8b91e083f9a16f2971

    SHA256

    de6f0bc4d13c5cda49e9f68582c26078c611e46ba07ba942051601209a1d0cae

    SHA512

    5c0171df8d59e728002e97b9e59bbbe23f91c95cc91b1320da8d4e3a293de82a6679d1b58150f77bffe330760c8d2f18c65c261aa3b14d5cf5107817b7879879

  • C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe

    Filesize

    1.3MB

    MD5

    db04aa6e158c5d52c20fc855f5285905

    SHA1

    822416dfa3f094aa6776ed0cad77fb9083db29a3

    SHA256

    ced8891ea8d87005de989f25f0f94634d1fc70ebb37302cf21aa0c0b0e13350f

    SHA512

    cdc0ff46ac48178da0a68d4e2601a46a960c3aa998edd66a7bb6a39d1caa7dbbe53f1aa463307a9932996d2993386addc7c54cee73811897b075dd75fbc904ff

  • C:\Users\Admin\AppData\Roaming\bfbcc7a80c10a7\cred64.dll

    Filesize

    4KB

    MD5

    103aee4a4b19eab69b5d015d0575632c

    SHA1

    8912c0abcea9a67950c7ed16c81a87bfc358f2b4

    SHA256

    fd973eb374e3ba68f501681b7c773c3bc41d87f5f0a455177e53e19ad2f6a950

    SHA512

    f73de06fffd6f93bdf8adbc156b6e4a66b460de45ba37de51b0b8e8bc3603117bd5c1699cc6ce6bed60b441da8199a2a7d85605639b6c84b829c022890631c92

  • memory/2044-48-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/3460-1-0x0000000000570000-0x0000000000949000-memory.dmp

    Filesize

    3.8MB

  • memory/3460-2-0x0000000000861000-0x0000000000949000-memory.dmp

    Filesize

    928KB

  • memory/3460-0-0x0000000000570000-0x0000000000949000-memory.dmp

    Filesize

    3.8MB

  • memory/3460-13-0x0000000000570000-0x0000000000949000-memory.dmp

    Filesize

    3.8MB

  • memory/4356-66-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-36-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-61-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-27-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-17-0x00000000003A1000-0x0000000000489000-memory.dmp

    Filesize

    928KB

  • memory/4596-46-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-16-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-49-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-50-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-51-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-28-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-62-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-65-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-15-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-67-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-68-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-69-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-79-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB

  • memory/4596-80-0x00000000000B0000-0x0000000000489000-memory.dmp

    Filesize

    3.8MB