amadey | 4439c40b5de4942e215ac33995c521bd20c906125ef009c913fcf466c7406f19

Resubmissions

28-06-2024 17:14

240628-vr2fbaxclf 10

09-03-2024 17:17

240309-vtrnwsdg2s 10

Analysis

max time kernel
139s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OneApp.IGCC.WinService.exe
Size

5.5MB
MD5

0cb7d11ea511391d791b0fbb9637ee79
SHA1

96c13496ad8342bdf1cb0ffbe59f673c8395e99b
SHA256

502129a00203367b15d57f87b5b51d01fb292928708decb723cd7ad866a7fda3
SHA512

8823a02a66d883cb7bffce5f4c93a216dd3280f5f65b340b00b8d6e72112327ef4e64fe6cd3c43dfe3dc7e241d19d4ea98bc9e9e3d49ca2818131920b4093aeb
SSDEEP

98304:MXu+i79EbSTjewAV6G67Ngr9wZZGBysnji/MZ/HqLGdOVnhamYMNwHYo8C4Esg6:MXuzCSTqwAV63Ngr9w6Zj5lHkG8hzqHw

Score

10^/10

amadey hijackloader 84fc95 loader trojan

Malware Config

Extracted

Family

amadey

Version

4.18

Botnet

84fc95

http://pleasurecanbesafe.com

Attributes

install_dir
40c3273379
install_file
Dctooux.exe
strings_key
65688f14a915e81474c2405160e45f77
url_paths
/7vAficZogD/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2868-0-0x0000000000400000-0x0000000000A04000-memory.dmp family_hijackloader
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Loads dropped DLL 10 IoCs

Processes:

more.comprocmap.exeWerFault.exe

pid process

2976 more.com
2976 more.com
2760 procmap.exe
2508 WerFault.exe
2508 WerFault.exe
2508 WerFault.exe
2508 WerFault.exe
2508 WerFault.exe
2508 WerFault.exe
2508 WerFault.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

OneApp.IGCC.WinService.exe

description pid process target process

PID 2868 set thread context of 2976 2868 OneApp.IGCC.WinService.exe more.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2508 2760 WerFault.exe procmap.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

OneApp.IGCC.WinService.exemore.com

pid process

2868 OneApp.IGCC.WinService.exe
2868 OneApp.IGCC.WinService.exe
2976 more.com
2976 more.com
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

OneApp.IGCC.WinService.exemore.com

pid process

2868 OneApp.IGCC.WinService.exe
2976 more.com

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x0000000000A04000-memory.dmp	family_hijackloader

pid	process
2976	more.com
2976	more.com
2760	procmap.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe

description	pid	process	target process
PID 2868 set thread context of 2976	2868	OneApp.IGCC.WinService.exe	more.com

pid	pid_target	process	target process
2508	2760	WerFault.exe	procmap.exe

pid	process
2868	OneApp.IGCC.WinService.exe
2868	OneApp.IGCC.WinService.exe
2976	more.com
2976	more.com

pid	process
2868	OneApp.IGCC.WinService.exe
2976	more.com

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

OneApp.IGCC.WinService.exemore.comprocmap.exe

description	pid	process	target process
PID 2868 wrote to memory of 2976	2868	OneApp.IGCC.WinService.exe	more.com
PID 2868 wrote to memory of 2976	2868	OneApp.IGCC.WinService.exe	more.com
PID 2868 wrote to memory of 2976	2868	OneApp.IGCC.WinService.exe	more.com
PID 2868 wrote to memory of 2976	2868	OneApp.IGCC.WinService.exe	more.com
PID 2868 wrote to memory of 2976	2868	OneApp.IGCC.WinService.exe	more.com
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe
PID 2760 wrote to memory of 2508	2760	procmap.exe	WerFault.exe
PID 2760 wrote to memory of 2508	2760	procmap.exe	WerFault.exe
PID 2760 wrote to memory of 2508	2760	procmap.exe	WerFault.exe
PID 2760 wrote to memory of 2508	2760	procmap.exe	WerFault.exe
PID 2976 wrote to memory of 2760	2976	more.com	procmap.exe

C:\Users\Admin\AppData\Local\Temp\OneApp.IGCC.WinService.exe
"C:\Users\Admin\AppData\Local\Temp\OneApp.IGCC.WinService.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\procmap.exe
C:\Users\Admin\AppData\Local\Temp\procmap.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 152
4⤵
- Loads dropped DLL
- Program crash
PID:2508

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9c4c77b4
Filesize
1.1MB

MD5
1b4b4bcaab0051fd09daed1b5177efca

SHA1
624fc2a128d7b9f04956cf0adcaa7bf1eaabe0c3

SHA256
cc72408fcff1fbf524d9f115ba1af5e637fbad2ba3914476c4e29f6115924efb

SHA512
ae93c94b0102f493a6b14fa7de9d15a50eb79ef04dfbdba332eb46ca153ab5d83b27736e89a86db0ce0e20fdbb894e51bb7e26186d0e51e2c2c27c4577acf0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\procmap.exe
Filesize
13KB

MD5
0c13dfbc137a3bb4cc8da0b6301e9468

SHA1
f2ce29eed4c9f219dab415cf6729ee06c8fcff4d

SHA256
ee8ef58f3bf0dab066eb608cb0f167b1585e166bf4730858961c192860ceffe9

SHA512
e9343db4f416b4428745e57e47626e7ce52a21d0fa904915554fd900bab1b26d49d0f77b74bbf5404ec898b19af2287cdef3ed6b8ccf50760767eb3fc204a895

Download Submit
memory/2760-39-0x00000000001B0000-0x000000000021D000-memory.dmp

Filesize
436KB

Download
memory/2760-37-0x00000000001B0000-0x000000000021D000-memory.dmp

Filesize
436KB

Download
memory/2760-29-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2760-27-0x00000000001B0000-0x000000000021D000-memory.dmp

Filesize
436KB

Download
memory/2760-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-5-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download
memory/2868-0-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2868-4-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download
memory/2868-3-0x0000000074932000-0x0000000074933000-memory.dmp

Filesize
4KB

Download
memory/2868-2-0x00000000773B0000-0x0000000077559000-memory.dmp

Filesize
1.7MB

Download
memory/2868-1-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download
memory/2976-9-0x00000000773B0000-0x0000000077559000-memory.dmp

Filesize
1.7MB

Download
memory/2976-12-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download
memory/2976-19-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download
memory/2976-21-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2976-20-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2976-7-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download
memory/2976-25-0x0000000074920000-0x0000000074A94000-memory.dmp

Filesize
1.5MB

Download