amadey | 1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 21:29

Target

1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe
Size

1.8MB
MD5

05f876eaecb5f74acc2d7d2d2dbc8a80
SHA1

2d7e810d07f12c91666ef33b73f2fb28f8ccc8b8
SHA256

1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0
SHA512

4e02e7eb0a3bccdbd11647bb8e4eca353b0c342470702d2955c15a1a0ac0b223418864a34d5d309257c5ff6785f53c20394d391da5b40787003c829294b532c1
SSDEEP

24576:JrtZOeEFbdfAg84s0sk04I6G4+57ZvNdoDQG5LtibEWnmF3HXFjs/iT7qxf4TXSB:E9FVAg9sY+5hgf4bnmFVe8+d7hxp42j

Score

10^/10

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2220 1752 WerFault.exe 1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe

pid	pid_target	process	target process
2220	1752	WerFault.exe	1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe

description	pid	process	target process
PID 1752 wrote to memory of 2220	1752	1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe	WerFault.exe
PID 1752 wrote to memory of 2220	1752	1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe	WerFault.exe
PID 1752 wrote to memory of 2220	1752	1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe	WerFault.exe
PID 1752 wrote to memory of 2220	1752	1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 36
2⤵
- Program crash
PID:2220

memory/1752-0-0x00000000003E0000-0x000000000089C000-memory.dmp

Filesize
4.7MB

Download