amadey | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
Size

359KB
MD5

082931c582b6984be9ecf0b9a10d3a97
SHA1

b54ae43dca0f037b8d859239e1e395bc574d750b
SHA256

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f
SHA512

1f5ec57654b837da94d5ac211b9560b4adf15c40da8a0b8d8694383af7f9aa9c523e110cd5274873b20fae90b9448567863d0a14a40e90ca1ce4ca860f046c7e
SSDEEP

6144:Kry+bnr+qp0yN90QEJGvSQG82CRZn4ERr7UXYfoi2vT7hQrFvCqfuln45:BMrey903GV2K17UXYAi5rlCqfulM

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe	healer
behavioral5/memory/2928-15-0x0000000000BC0000-0x0000000000BCA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a2105606.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2105606.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2105606.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0579240.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	b0579240.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

Processes:

v4031479.exea2105606.exeb0579240.exedanke.exec1909896.exedanke.exedanke.exe

pid process

2512 v4031479.exe
2928 a2105606.exe
1140 b0579240.exe
2684 danke.exe
1832 c1909896.exe
456 danke.exe
3128 danke.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a2105606.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a2105606.exe

pid	process
2512	v4031479.exe
2928	a2105606.exe
1140	b0579240.exe
2684	danke.exe
1832	c1909896.exe
456	danke.exe
3128	danke.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2105606.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v4031479.exe13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4031479.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c1909896.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1304 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a2105606.exe

pid process

2928 a2105606.exe
2928 a2105606.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a2105606.exe

description pid process

Token: SeDebugPrivilege 2928 a2105606.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b0579240.exe

pid process

1140 b0579240.exe

pid	process
1304	schtasks.exe

pid	process
2928	a2105606.exe
2928	a2105606.exe

description	pid	process
Token: SeDebugPrivilege	2928	a2105606.exe

pid	process
1140	b0579240.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exev4031479.exeb0579240.exedanke.execmd.exe

description	pid	process	target process
PID 3172 wrote to memory of 2512	3172	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	v4031479.exe
PID 3172 wrote to memory of 2512	3172	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	v4031479.exe
PID 3172 wrote to memory of 2512	3172	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	v4031479.exe
PID 2512 wrote to memory of 2928	2512	v4031479.exe	a2105606.exe
PID 2512 wrote to memory of 2928	2512	v4031479.exe	a2105606.exe
PID 2512 wrote to memory of 1140	2512	v4031479.exe	b0579240.exe
PID 2512 wrote to memory of 1140	2512	v4031479.exe	b0579240.exe
PID 2512 wrote to memory of 1140	2512	v4031479.exe	b0579240.exe
PID 1140 wrote to memory of 2684	1140	b0579240.exe	danke.exe
PID 1140 wrote to memory of 2684	1140	b0579240.exe	danke.exe
PID 1140 wrote to memory of 2684	1140	b0579240.exe	danke.exe
PID 3172 wrote to memory of 1832	3172	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	c1909896.exe
PID 3172 wrote to memory of 1832	3172	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	c1909896.exe
PID 3172 wrote to memory of 1832	3172	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	c1909896.exe
PID 2684 wrote to memory of 1304	2684	danke.exe	schtasks.exe
PID 2684 wrote to memory of 1304	2684	danke.exe	schtasks.exe
PID 2684 wrote to memory of 1304	2684	danke.exe	schtasks.exe
PID 2684 wrote to memory of 4916	2684	danke.exe	cmd.exe
PID 2684 wrote to memory of 4916	2684	danke.exe	cmd.exe
PID 2684 wrote to memory of 4916	2684	danke.exe	cmd.exe
PID 4916 wrote to memory of 2860	4916	cmd.exe	cmd.exe
PID 4916 wrote to memory of 2860	4916	cmd.exe	cmd.exe
PID 4916 wrote to memory of 2860	4916	cmd.exe	cmd.exe
PID 4916 wrote to memory of 1956	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 1956	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 1956	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 4572	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 4572	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 4572	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 4396	4916	cmd.exe	cmd.exe
PID 4916 wrote to memory of 4396	4916	cmd.exe	cmd.exe
PID 4916 wrote to memory of 4396	4916	cmd.exe	cmd.exe
PID 4916 wrote to memory of 2888	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 2888	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 2888	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 1664	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 1664	4916	cmd.exe	cacls.exe
PID 4916 wrote to memory of 1664	4916	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
"C:\Users\Admin\AppData\Local\Temp\13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
      "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1304
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4916
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2860
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        6⤵
        
        PID:1956
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        6⤵
        
        PID:4572
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4396
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        6⤵
        
        PID:2888
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        6⤵
        
        PID:1664
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:1832

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:456

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe

Filesize
35KB

MD5
c1ca03861c05e415f889876efdc23a29

SHA1
cca730bd7ccf37922e32f24dd9cf0760ab36cb4c

SHA256
a85a9d3a94aee89882a39d62896f65b0c55c227bf9d0037fa22772e1a228e041

SHA512
8797c876ac03222f09240e0b4e9f133a515e5203e3bea9b11c515483ca6a31ce1e40a87657e8f5d90b9174644b26b5aa176b03e3b7348a03e89994dfc8f54227

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe

Filesize
235KB

MD5
d288727843b47d19343f9ddd1c19b5b8

SHA1
8894bba26077430a1a8b1abac8c8cc64ab6152a3

SHA256
24686872945ec4ee8a449870510b06baceabd4bdbb5e1ee548e25df8b6866e33

SHA512
e7f792c5a1946077cb756895642d769f14f6a20dd8438b948cdaa6d86f32a8a0c7c02cb357601b34d7bed9ec3b3b052942096103933ca043dde1f263dd43ee1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe

Filesize
13KB

MD5
efda7dedc4ae060004ed85426e7e75e4

SHA1
f024ccc9afe9864fda74b1582b0e7a5da8726615

SHA256
d896f9758fc3b328a0d0dc46f4d687772389a6d9600ebc99fad37822e88fc3ea

SHA512
0bca35f62887c908b721cec5f7b3fc27459fb2547e3c7cafb9a8cdb59f0cd63efab7929c0afe7988ce7d48e4227f775e65d212e59154daaba530954a125a1d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe

Filesize
230KB

MD5
9d3cc6c5347481c56a87e7b75b204c49

SHA1
7a4aab48fca250c6e3ae8e7addfeae33f1cd83d9

SHA256
7a5781640086b621d579df2b22d112c5825cb23e2f4609014061b2dcf521cf26

SHA512
eb03867e03ef70be053428313e1f6411ff2a346364c88214bbc331e4ae20bc0debf61507cc44c5e21bab8d6ccb10757d79f1c1ee10b5f830f5f035445a85c072

Download Submit
memory/1832-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2928-14-0x00007FFA6A013000-0x00007FFA6A015000-memory.dmp

Filesize
8KB

Download
memory/2928-15-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download