amadey | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
Size

359KB
MD5

082931c582b6984be9ecf0b9a10d3a97
SHA1

b54ae43dca0f037b8d859239e1e395bc574d750b
SHA256

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f
SHA512

1f5ec57654b837da94d5ac211b9560b4adf15c40da8a0b8d8694383af7f9aa9c523e110cd5274873b20fae90b9448567863d0a14a40e90ca1ce4ca860f046c7e
SSDEEP

6144:Kry+bnr+qp0yN90QEJGvSQG82CRZn4ERr7UXYfoi2vT7hQrFvCqfuln45:BMrey903GV2K17UXYAi5rlCqfulM

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
behavioral5/memory/1624-14-0x0000000000350000-0x000000000035A000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a2105606.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2105606.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0579240.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	b0579240.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

Processes:

v4031479.exea2105606.exeb0579240.exedanke.exec1909896.exedanke.exedanke.exe

pid process

5088 v4031479.exe
1624 a2105606.exe
5028 b0579240.exe
1408 danke.exe
1536 c1909896.exe
664 danke.exe
2292 danke.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a2105606.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a2105606.exe

pid	process
5088	v4031479.exe
1624	a2105606.exe
5028	b0579240.exe
1408	danke.exe
1536	c1909896.exe
664	danke.exe
2292	danke.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2105606.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exev4031479.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4031479.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4900 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4900	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c1909896.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3852 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a2105606.exe

pid process

1624 a2105606.exe
1624 a2105606.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a2105606.exe

description pid process

Token: SeDebugPrivilege 1624 a2105606.exe

pid	process
3852	schtasks.exe

pid	process
1624	a2105606.exe
1624	a2105606.exe

description	pid	process
Token: SeDebugPrivilege	1624	a2105606.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exev4031479.exeb0579240.exedanke.execmd.exe

description	pid	process	target process
PID 1140 wrote to memory of 5088	1140	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	v4031479.exe
PID 1140 wrote to memory of 5088	1140	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	v4031479.exe
PID 1140 wrote to memory of 5088	1140	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	v4031479.exe
PID 5088 wrote to memory of 1624	5088	v4031479.exe	a2105606.exe
PID 5088 wrote to memory of 1624	5088	v4031479.exe	a2105606.exe
PID 5088 wrote to memory of 5028	5088	v4031479.exe	b0579240.exe
PID 5088 wrote to memory of 5028	5088	v4031479.exe	b0579240.exe
PID 5088 wrote to memory of 5028	5088	v4031479.exe	b0579240.exe
PID 5028 wrote to memory of 1408	5028	b0579240.exe	danke.exe
PID 5028 wrote to memory of 1408	5028	b0579240.exe	danke.exe
PID 5028 wrote to memory of 1408	5028	b0579240.exe	danke.exe
PID 1140 wrote to memory of 1536	1140	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	c1909896.exe
PID 1140 wrote to memory of 1536	1140	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	c1909896.exe
PID 1140 wrote to memory of 1536	1140	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	c1909896.exe
PID 1408 wrote to memory of 3852	1408	danke.exe	schtasks.exe
PID 1408 wrote to memory of 3852	1408	danke.exe	schtasks.exe
PID 1408 wrote to memory of 3852	1408	danke.exe	schtasks.exe
PID 1408 wrote to memory of 5056	1408	danke.exe	cmd.exe
PID 1408 wrote to memory of 5056	1408	danke.exe	cmd.exe
PID 1408 wrote to memory of 5056	1408	danke.exe	cmd.exe
PID 5056 wrote to memory of 4976	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 4976	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 4976	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 4492	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 4492	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 4492	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 732	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 732	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 732	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 4428	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 4428	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 4428	5056	cmd.exe	cmd.exe
PID 5056 wrote to memory of 2704	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 2704	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 2704	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 3200	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 3200	5056	cmd.exe	cacls.exe
PID 5056 wrote to memory of 3200	5056	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
"C:\Users\Admin\AppData\Local\Temp\13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1140

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
5⤵
- Creates scheduled task(s)
PID:3852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4976

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:N"
6⤵
PID:4492

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:R" /E
6⤵
PID:732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4428

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:N"
6⤵
PID:2704

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:R" /E
6⤵
PID:3200

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1536

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:664

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
Filesize
35KB

MD5
c1ca03861c05e415f889876efdc23a29

SHA1
cca730bd7ccf37922e32f24dd9cf0760ab36cb4c

SHA256
a85a9d3a94aee89882a39d62896f65b0c55c227bf9d0037fa22772e1a228e041

SHA512
8797c876ac03222f09240e0b4e9f133a515e5203e3bea9b11c515483ca6a31ce1e40a87657e8f5d90b9174644b26b5aa176b03e3b7348a03e89994dfc8f54227

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
Filesize
235KB

MD5
d288727843b47d19343f9ddd1c19b5b8

SHA1
8894bba26077430a1a8b1abac8c8cc64ab6152a3

SHA256
24686872945ec4ee8a449870510b06baceabd4bdbb5e1ee548e25df8b6866e33

SHA512
e7f792c5a1946077cb756895642d769f14f6a20dd8438b948cdaa6d86f32a8a0c7c02cb357601b34d7bed9ec3b3b052942096103933ca043dde1f263dd43ee1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
Filesize
13KB

MD5
efda7dedc4ae060004ed85426e7e75e4

SHA1
f024ccc9afe9864fda74b1582b0e7a5da8726615

SHA256
d896f9758fc3b328a0d0dc46f4d687772389a6d9600ebc99fad37822e88fc3ea

SHA512
0bca35f62887c908b721cec5f7b3fc27459fb2547e3c7cafb9a8cdb59f0cd63efab7929c0afe7988ce7d48e4227f775e65d212e59154daaba530954a125a1d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
Filesize
230KB

MD5
9d3cc6c5347481c56a87e7b75b204c49

SHA1
7a4aab48fca250c6e3ae8e7addfeae33f1cd83d9

SHA256
7a5781640086b621d579df2b22d112c5825cb23e2f4609014061b2dcf521cf26

SHA512
eb03867e03ef70be053428313e1f6411ff2a346364c88214bbc331e4ae20bc0debf61507cc44c5e21bab8d6ccb10757d79f1c1ee10b5f830f5f035445a85c072

Download Submit
memory/1536-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1624-14-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/1624-15-0x00007FFB34C93000-0x00007FFB34C95000-memory.dmp

Filesize
8KB

Download