amadey | 928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 00:16

Target

928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe
Size

1.8MB
MD5

86202e9c39d6f8ceed7e843e460cdbd0
SHA1

52b063c48bbffdcb193416e787e957b47e267fd5
SHA256

928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad
SHA512

5a75209bf0663787aad5eeab2b62d3fcaea8d1ab4151b1c472d5ffa4cfbb651470507bf10684d4b07408fa06ad97fb414c7b6a6a8b097051c9f71fa31db8fd97
SSDEEP

49152:b6jf6jHyPOS5+WrYL2CkAmdUhDfUCdogW+NvCanzg1+M:+jfgyPzUQsnvm48CdoghNKanq+M

Score

10^/10

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2996 2932 WerFault.exe

pid	pid_target	process
2996	2932	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe

description	pid	process	target process
PID 2932 wrote to memory of 2996	2932	928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe	WerFault.exe
PID 2932 wrote to memory of 2996	2932	928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe	WerFault.exe
PID 2932 wrote to memory of 2996	2932	928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe	WerFault.exe
PID 2932 wrote to memory of 2996	2932	928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe
"C:\Users\Admin\AppData\Local\Temp\928bf16a3d841264b5cc8515c02eed216a89bc1e12351f34fb3abd10566a98ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 36
2⤵
- Program crash
PID:2996

memory/2932-0-0x0000000000DB0000-0x000000000126B000-memory.dmp

Filesize
4.7MB

Download