amadey | 4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b

Analysis

max time kernel
212s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
Size

146KB
MD5

d2011ed8320e1d4a6336246e7148c060
SHA1

d396242b8e9978f7dda69becd59a6d35aa9da5e4
SHA256

4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b
SHA512

0c7c1e3603725bbd541ef30ac3c3bf7435737dd139079862fc904cd3a33471689afa8521535390be1586cdcd80f3c51381097f9360098ac9e76a4fc8f5ec3b6e
SSDEEP

3072:qxVNKV0rwQIQ29B5UWrLB6aVNkvq7Kp1ZxFPp:E2Q2jh6aVOvq7KlxB

Score

10^/10

amadey smokeloader backdoor trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3112-133-0x00000000006F0000-0x00000000006F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

F6E9.exe

pid process

2064 F6E9.exe

pid	process
2064	F6E9.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe

pid	process
3112	4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
3112	4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584
2584

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2584
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe

pid process

3112 4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 2584
Token: SeCreatePagefilePrivilege 2584

pid	process
2584

description	pid	process
Token: SeShutdownPrivilege	2584
Token: SeCreatePagefilePrivilege	2584

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

description	pid	target process
PID 2584 wrote to memory of 2064	2584	F6E9.exe
PID 2584 wrote to memory of 2064	2584	F6E9.exe
PID 2584 wrote to memory of 2064	2584	F6E9.exe

C:\Users\Admin\AppData\Local\Temp\4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe
"C:\Users\Admin\AppData\Local\Temp\4bcfb4be98000417c511d1a3ac412bd2440d13f84353a2c96a99ac8d50afcb9b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3112

C:\Users\Admin\AppData\Local\Temp\F6E9.exe
C:\Users\Admin\AppData\Local\Temp\F6E9.exe
1⤵
- Executes dropped EXE
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F6E9.exe
Filesize
206KB

MD5
3b349d28da5fff68b3dd58313dda061f

SHA1
1860f2cceb7557386b7fef37702e93027c841990

SHA256
94bb170f101a1f2f44b310f36b3bfcf2851e03e4644d96d2699c363a8068d9a2

SHA512
316574826c7215b9e6f35780ca29da6893dcd340c36ff840e1334dafe1e0ec205483e6a8b5671f19ae29a284ee85c5393c4242d53691f20ca495116d5bc1d92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F6E9.exe
Filesize
206KB

MD5
3b349d28da5fff68b3dd58313dda061f

SHA1
1860f2cceb7557386b7fef37702e93027c841990

SHA256
94bb170f101a1f2f44b310f36b3bfcf2851e03e4644d96d2699c363a8068d9a2

SHA512
316574826c7215b9e6f35780ca29da6893dcd340c36ff840e1334dafe1e0ec205483e6a8b5671f19ae29a284ee85c5393c4242d53691f20ca495116d5bc1d92b

Download Submit
memory/2064-136-0x0000000000000000-mapping.dmp

Download
memory/2064-139-0x00000000005AD000-0x00000000005CC000-memory.dmp

Filesize
124KB

Download
memory/2064-140-0x00000000020A0000-0x00000000020DE000-memory.dmp

Filesize
248KB

Download
memory/3112-132-0x000000000077F000-0x000000000078F000-memory.dmp

Filesize
64KB

Download
memory/3112-133-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/3112-134-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3112-135-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download