amadey | ff0500a380008b913b550a84c7ddcc17f4a8c07b6778f24e7dc333988b1fe336

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/02/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a1dfe0fb4917f9f6c0585af695ffc45.exe
Size 244KB
Sample240208-wqa3eaae99
SHA256 ff0500a380008b913b550a84c7ddcc17f4a8c07b6778f24e7dc333988b1fe336
MD5 1a1dfe0fb4917f9f6c0585af695ffc45
SHA1 9cfbb619dc98498f9791cf8b759bd1fca6983243
SHA512 0d9d6f4a7f2ea94a4877cf51a35b86141ff9e2ffd855986de097200f1f6bac1fef641275932cd1ea759fc555343ae94d8582cad237b02956758bc2338457e64e
SSDEEP 3072:/wZm1wLxrRmddvRLByDde2D0IifymfM3Md6kbYZQTdNRunrcSO4Dtl16/AaqP:Am1widpLByDdPD0lBfMfZjrNh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey smokeloader pub1 backdoor spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

amadey

Version

4.14

http://anfesq.com
http://cbinr.com
http://rimakc.ru

Attributes

install_dir
68fd3d7ade
install_file
Utsysc.exe
strings_key
27ec7fd6f50f63b8af0c1d3deefcc8fe
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
1192	Process not Found

Executes dropped EXE 4 IoCs

pid	Process
2680	9711.exe
2484	Utsysc.exe
2024	Utsysc.exe
2692	Utsysc.exe

Loads dropped DLL 44 IoCs

pid	Process
2680	9711.exe
2680	9711.exe
2784	rundll32.exe
2784	rundll32.exe
2784	rundll32.exe
2784	rundll32.exe
676	rundll32.exe
676	rundll32.exe
676	rundll32.exe
676	rundll32.exe
752	WerFault.exe
752	WerFault.exe
2020	rundll32.exe
2020	rundll32.exe
2020	rundll32.exe
2020	rundll32.exe
1656	rundll32.exe
1656	rundll32.exe
1656	rundll32.exe
1656	rundll32.exe
380	WerFault.exe
380	WerFault.exe
2096	rundll32.exe
2096	rundll32.exe
2096	rundll32.exe
2096	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
1880	WerFault.exe
1880	WerFault.exe
1936	rundll32.exe
1936	rundll32.exe
1936	rundll32.exe
1936	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1a1dfe0fb4917f9f6c0585af695ffc45.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1a1dfe0fb4917f9f6c0585af695ffc45.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1a1dfe0fb4917f9f6c0585af695ffc45.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2936	1a1dfe0fb4917f9f6c0585af695ffc45.exe
2936	1a1dfe0fb4917f9f6c0585af695ffc45.exe
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2936	1a1dfe0fb4917f9f6c0585af695ffc45.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Process not Found
Token: SeShutdownPrivilege	1192	Process not Found
Token: SeShutdownPrivilege	1192	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1192	Process not Found
1192	Process not Found
2680	9711.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1192	Process not Found
1192	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2680	1192	Process not Found	28
PID 1192 wrote to memory of 2680	1192	Process not Found	28
PID 1192 wrote to memory of 2680	1192	Process not Found	28
PID 1192 wrote to memory of 2680	1192	Process not Found	28
PID 2680 wrote to memory of 2484	2680	9711.exe	29
PID 2680 wrote to memory of 2484	2680	9711.exe	29
PID 2680 wrote to memory of 2484	2680	9711.exe	29
PID 2680 wrote to memory of 2484	2680	9711.exe	29
PID 2484 wrote to memory of 2760	2484	Utsysc.exe	30
PID 2484 wrote to memory of 2760	2484	Utsysc.exe	30
PID 2484 wrote to memory of 2760	2484	Utsysc.exe	30
PID 2484 wrote to memory of 2760	2484	Utsysc.exe	30
PID 1264 wrote to memory of 2024	1264	taskeng.exe	35
PID 1264 wrote to memory of 2024	1264	taskeng.exe	35
PID 1264 wrote to memory of 2024	1264	taskeng.exe	35
PID 1264 wrote to memory of 2024	1264	taskeng.exe	35
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2484 wrote to memory of 2784	2484	Utsysc.exe	38
PID 2784 wrote to memory of 676	2784	rundll32.exe	39
PID 2784 wrote to memory of 676	2784	rundll32.exe	39
PID 2784 wrote to memory of 676	2784	rundll32.exe	39
PID 2784 wrote to memory of 676	2784	rundll32.exe	39
PID 676 wrote to memory of 752	676	rundll32.exe	40
PID 676 wrote to memory of 752	676	rundll32.exe	40
PID 676 wrote to memory of 752	676	rundll32.exe	40
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2484 wrote to memory of 2020	2484	Utsysc.exe	41
PID 2020 wrote to memory of 1656	2020	rundll32.exe	42
PID 2020 wrote to memory of 1656	2020	rundll32.exe	42
PID 2020 wrote to memory of 1656	2020	rundll32.exe	42
PID 2020 wrote to memory of 1656	2020	rundll32.exe	42
PID 1656 wrote to memory of 380	1656	rundll32.exe	43
PID 1656 wrote to memory of 380	1656	rundll32.exe	43
PID 1656 wrote to memory of 380	1656	rundll32.exe	43
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2484 wrote to memory of 2096	2484	Utsysc.exe	44
PID 2096 wrote to memory of 2056	2096	rundll32.exe	45
PID 2096 wrote to memory of 2056	2096	rundll32.exe	45
PID 2096 wrote to memory of 2056	2096	rundll32.exe	45
PID 2096 wrote to memory of 2056	2096	rundll32.exe	45
PID 2056 wrote to memory of 1880	2056	rundll32.exe	46
PID 2056 wrote to memory of 1880	2056	rundll32.exe	46
PID 2056 wrote to memory of 1880	2056	rundll32.exe	46
PID 2484 wrote to memory of 1936	2484	Utsysc.exe	47
PID 2484 wrote to memory of 1936	2484	Utsysc.exe	47
PID 2484 wrote to memory of 1936	2484	Utsysc.exe	47
PID 2484 wrote to memory of 1936	2484	Utsysc.exe	47
PID 2484 wrote to memory of 1936	2484	Utsysc.exe	47
PID 2484 wrote to memory of 1936	2484	Utsysc.exe	47

C:\Users\Admin\AppData\Local\Temp\1a1dfe0fb4917f9f6c0585af695ffc45.exe
"C:\Users\Admin\AppData\Local\Temp\1a1dfe0fb4917f9f6c0585af695ffc45.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2936

C:\Users\Admin\AppData\Local\Temp\9711.exe
C:\Users\Admin\AppData\Local\Temp\9711.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2760
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 676 -s 308
        5⤵
        Loads dropped DLL
        
        PID:752
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1656 -s 308
        5⤵
        Loads dropped DLL
        
        PID:380
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2056 -s 308
        5⤵
        Loads dropped DLL
        
        PID:1880
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1936
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:2520

C:\Windows\system32\taskeng.exe
taskeng.exe {7CAB8A4F-B5F3-4A88-B5D5-0BA2B2B9B1A3} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  2⤵
  - Executes dropped EXE
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

470981204343

Path C:\Users\Admin\AppData\Local\Temp\470981204343
Size 63KB
SHA256 3e474b04e74d8f649d744d91f2b2b559fd3f3409dc1fc2725536fb9561163a16
MD5 c569e43b08f3484bd65ffbcad8e443b3
SHA1 cc23bb0f7876ac7e233a889006e3e81bad6b3970
SHA512 8c8bdc6aeee6033e826de4d774f9bcc8dd399f639dcd100b7f2be5ba14f20c42945e31106755a88c9d897d49f37ad11a5aba5f1693d7483f8410da1119561924
SSDEEP 1536:s5BWqpBtAHWV1Ql62uUfCIvWqJ6mAN6kdQbFpGAVqBgaa15b:SntKWbQsIFWqJ6DNr25pGAVqBgaob
MD5 SHA1 SHA512 SSDEEP

Submit Download

9711.exe

Path C:\Users\Admin\AppData\Local\Temp\9711.exe
Size 349KB
SHA256 6060ce8f51a10ae5ebc3b2c8dbdccca2fe30e626652f170bca0a1b2256f5464b
MD5 d713561644bc8d1c46520cebc01358fb
SHA1 fe1c875267ab7e66fc2831d95e513d73bbb1cb47
SHA512 750bba5febe4275606400ffb8dd14332858c132bec0113f9970298f3f1c809a01483349eddf0330c77d6c16d7bee412a7e246d59b987b2a385c6d23067c0bad8
SSDEEP 6144:w3hATyb78RwGAGDebIWQjoN2j1f+4+GSAkrOWzNCU2OC:MATfwGCbIWSj1fvSAkrOyUOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll
Size 102KB
SHA256 97e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
MD5 4194e9b8b694b1e9b672c36f0d868e32
SHA1 252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA512 f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
SSDEEP 3072:SbEDxEOC3+EX4W2sosmLWuQRAwQrT7xUCYNS60Z:iM7HQ+sCWuQRYoNS60Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll
Size 1.1MB
SHA256 83ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
MD5 f01f5bc76b9596e0cfeab8a272cba3a5
SHA1 19cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA512 ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
SSDEEP 24576:Pc6CX/YqLAS81Un+J35XBMpZ9+Jo73Jw/tDMX/td:rqLAS81UnI5XQZ92ogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-4-0x0000000002930000-0x0000000002946000-memory.dmp

Download

memory/2024-59-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2024-58-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

Download

memory/2484-103-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-118-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-128-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-123-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-41-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-42-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

Download

memory/2484-92-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-51-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2484-81-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

Download

memory/2484-80-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2680-18-0x0000000002D60000-0x0000000002E60000-memory.dmp

Download

memory/2680-19-0x0000000000220000-0x000000000028F000-memory.dmp

Download

memory/2680-32-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2680-35-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2680-33-0x0000000002D60000-0x0000000002E60000-memory.dmp

Download

memory/2692-132-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

Download

memory/2692-131-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/2936-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

Download

memory/2936-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/2936-2-0x0000000000220000-0x000000000022B000-memory.dmp

Download

memory/2936-3-0x0000000000400000-0x0000000000449000-memory.dmp

Download