amadey | 84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
Size

208KB
MD5

960c380ba57e06e4687f4f123600d704
SHA1

905aabfe25088890f09dfd8de35e7229fe0632f7
SHA256

84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6
SHA512

51793a6d5eae5a6a9cc00cc5160b00ea842f1967de087c49b9e101c254b9ae706918c871a00ff6a13fffef989434e470e40454a05958b440e0f4b9f0aca1d1ea
SSDEEP

3072:usLXps3ttQL00rAh0PjoUTFsxIIu9u0SPr91u368:1htAqr/SII7xbu3P

Score

10^/10

amadey smokeloader backdoor evasion trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Detects executables packed with unregistered version of .NET Reactor 2 IoCs

resource	yara_rule
behavioral1/files/0x0005000000004ed7-45.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1264-48-0x0000000000F40000-0x0000000001416000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	754F.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	754F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	754F.exe

Deletes itself 1 IoCs

pid	Process
1200	Process not Found

Executes dropped EXE 2 IoCs

pid	Process
2668	754F.exe
1264	9F2D.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Wine	754F.exe

Loads dropped DLL 5 IoCs

pid	Process
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2668	754F.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	754F.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	1264	WerFault.exe	31

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2236	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
2236	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2236	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1200	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	754F.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2668	1200	Process not Found	28
PID 1200 wrote to memory of 2668	1200	Process not Found	28
PID 1200 wrote to memory of 2668	1200	Process not Found	28
PID 1200 wrote to memory of 2668	1200	Process not Found	28
PID 1200 wrote to memory of 1264	1200	Process not Found	31
PID 1200 wrote to memory of 1264	1200	Process not Found	31
PID 1200 wrote to memory of 1264	1200	Process not Found	31
PID 1200 wrote to memory of 1264	1200	Process not Found	31
PID 1264 wrote to memory of 596	1264	9F2D.exe	32
PID 1264 wrote to memory of 596	1264	9F2D.exe	32
PID 1264 wrote to memory of 596	1264	9F2D.exe	32
PID 1264 wrote to memory of 596	1264	9F2D.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
"C:\Users\Admin\AppData\Local\Temp\84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2236

C:\Users\Admin\AppData\Local\Temp\754F.exe
C:\Users\Admin\AppData\Local\Temp\754F.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2668

C:\Users\Admin\AppData\Local\Temp\9F2D.exe
C:\Users\Admin\AppData\Local\Temp\9F2D.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 560
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\754F.exe

Filesize
1.8MB

MD5
aaacf46a89720b66de3ad6b5a2947fa8

SHA1
5718da5742ed0025a1164e6b1bc8c100504408d0

SHA256
cddb36a5d37c4a7343f0284b830345ee18ef510c21f8a673d20cc770077ec61a

SHA512
cb9716cfdf6576f47873a05c7763f0a15c356fe885d76bc516dab7e501fd2fa63e34c4da14a7bb96d86c311849daef9c3167f7be4cfa4c8bf3d14941e6ee225d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9F2D.exe

Filesize
4.8MB

MD5
0de49b7358184b13c717ea9a823f12bb

SHA1
a764efe549b694c7ce05773c55b7d582b6f4ba2d

SHA256
48c26d758ee7acee07033f1583de83451a9e1f07facf958b786c654786f7f18f

SHA512
d10361e573912aad2dd49791c14cb6eec6d271eb5353b9c500e2824eb229e96799ecc982e96abb3fbd610eef6cb55487873bbac9dfbf0a68872beac746e9044a

Download Submit
memory/1200-4-0x0000000002FB0000-0x0000000002FC6000-memory.dmp

Filesize
88KB

Download
memory/1264-49-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1264-48-0x0000000000F40000-0x0000000001416000-memory.dmp

Filesize
4.8MB

Download
memory/1264-47-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2236-1-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2236-3-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2236-2-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download
memory/2236-5-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2668-26-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2668-29-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/2668-23-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/2668-25-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/2668-21-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2668-24-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/2668-27-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2668-28-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/2668-30-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/2668-22-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/2668-31-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2668-34-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/2668-33-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2668-35-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2668-36-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/2668-41-0x0000000001330000-0x00000000017D3000-memory.dmp

Filesize
4.6MB

Download
memory/2668-20-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/2668-19-0x0000000001330000-0x00000000017D3000-memory.dmp

Filesize
4.6MB

Download
memory/2668-18-0x00000000778F0000-0x00000000778F2000-memory.dmp

Filesize
8KB

Download
memory/2668-17-0x0000000001330000-0x00000000017D3000-memory.dmp

Filesize
4.6MB

Download