amadey | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
Size

359KB
MD5

082931c582b6984be9ecf0b9a10d3a97
SHA1

b54ae43dca0f037b8d859239e1e395bc574d750b
SHA256

13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f
SHA512

1f5ec57654b837da94d5ac211b9560b4adf15c40da8a0b8d8694383af7f9aa9c523e110cd5274873b20fae90b9448567863d0a14a40e90ca1ce4ca860f046c7e
SSDEEP

6144:Kry+bnr+qp0yN90QEJGvSQG82CRZn4ERr7UXYfoi2vT7hQrFvCqfuln45:BMrey903GV2K17UXYAi5rlCqfulM

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral5/files/0x000800000002344b-13.dat	healer
behavioral5/memory/4136-14-0x0000000000070000-0x000000000007A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2105606.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2105606.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2105606.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	b0579240.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

pid	Process
3128	v4031479.exe
4136	a2105606.exe
4708	b0579240.exe
2144	danke.exe
3572	c1909896.exe
216	danke.exe
2620	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2105606.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4031479.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1909896.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	a2105606.exe
4136	a2105606.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	a2105606.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3128	1392	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	83
PID 1392 wrote to memory of 3128	1392	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	83
PID 1392 wrote to memory of 3128	1392	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	83
PID 3128 wrote to memory of 4136	3128	v4031479.exe	84
PID 3128 wrote to memory of 4136	3128	v4031479.exe	84
PID 3128 wrote to memory of 4708	3128	v4031479.exe	96
PID 3128 wrote to memory of 4708	3128	v4031479.exe	96
PID 3128 wrote to memory of 4708	3128	v4031479.exe	96
PID 4708 wrote to memory of 2144	4708	b0579240.exe	97
PID 4708 wrote to memory of 2144	4708	b0579240.exe	97
PID 4708 wrote to memory of 2144	4708	b0579240.exe	97
PID 1392 wrote to memory of 3572	1392	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	98
PID 1392 wrote to memory of 3572	1392	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	98
PID 1392 wrote to memory of 3572	1392	13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe	98
PID 2144 wrote to memory of 772	2144	danke.exe	99
PID 2144 wrote to memory of 772	2144	danke.exe	99
PID 2144 wrote to memory of 772	2144	danke.exe	99
PID 2144 wrote to memory of 1892	2144	danke.exe	101
PID 2144 wrote to memory of 1892	2144	danke.exe	101
PID 2144 wrote to memory of 1892	2144	danke.exe	101
PID 1892 wrote to memory of 3212	1892	cmd.exe	103
PID 1892 wrote to memory of 3212	1892	cmd.exe	103
PID 1892 wrote to memory of 3212	1892	cmd.exe	103
PID 1892 wrote to memory of 1852	1892	cmd.exe	104
PID 1892 wrote to memory of 1852	1892	cmd.exe	104
PID 1892 wrote to memory of 1852	1892	cmd.exe	104
PID 1892 wrote to memory of 3944	1892	cmd.exe	105
PID 1892 wrote to memory of 3944	1892	cmd.exe	105
PID 1892 wrote to memory of 3944	1892	cmd.exe	105
PID 1892 wrote to memory of 3632	1892	cmd.exe	106
PID 1892 wrote to memory of 3632	1892	cmd.exe	106
PID 1892 wrote to memory of 3632	1892	cmd.exe	106
PID 1892 wrote to memory of 3512	1892	cmd.exe	107
PID 1892 wrote to memory of 3512	1892	cmd.exe	107
PID 1892 wrote to memory of 3512	1892	cmd.exe	107
PID 1892 wrote to memory of 3596	1892	cmd.exe	108
PID 1892 wrote to memory of 3596	1892	cmd.exe	108
PID 1892 wrote to memory of 3596	1892	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe
"C:\Users\Admin\AppData\Local\Temp\13ca0bbb3221adeaf830fc435756121e64e03f342fec62e30bcd13f7d5c1083f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
      "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:772
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1892
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3212
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        6⤵
        
        PID:1852
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        6⤵
        
        PID:3944
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3632
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        6⤵
        
        PID:3512
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        6⤵
        
        PID:3596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:3572

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:216

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c1909896.exe

Filesize
35KB

MD5
c1ca03861c05e415f889876efdc23a29

SHA1
cca730bd7ccf37922e32f24dd9cf0760ab36cb4c

SHA256
a85a9d3a94aee89882a39d62896f65b0c55c227bf9d0037fa22772e1a228e041

SHA512
8797c876ac03222f09240e0b4e9f133a515e5203e3bea9b11c515483ca6a31ce1e40a87657e8f5d90b9174644b26b5aa176b03e3b7348a03e89994dfc8f54227

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4031479.exe

Filesize
235KB

MD5
d288727843b47d19343f9ddd1c19b5b8

SHA1
8894bba26077430a1a8b1abac8c8cc64ab6152a3

SHA256
24686872945ec4ee8a449870510b06baceabd4bdbb5e1ee548e25df8b6866e33

SHA512
e7f792c5a1946077cb756895642d769f14f6a20dd8438b948cdaa6d86f32a8a0c7c02cb357601b34d7bed9ec3b3b052942096103933ca043dde1f263dd43ee1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2105606.exe

Filesize
13KB

MD5
efda7dedc4ae060004ed85426e7e75e4

SHA1
f024ccc9afe9864fda74b1582b0e7a5da8726615

SHA256
d896f9758fc3b328a0d0dc46f4d687772389a6d9600ebc99fad37822e88fc3ea

SHA512
0bca35f62887c908b721cec5f7b3fc27459fb2547e3c7cafb9a8cdb59f0cd63efab7929c0afe7988ce7d48e4227f775e65d212e59154daaba530954a125a1d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0579240.exe

Filesize
230KB

MD5
9d3cc6c5347481c56a87e7b75b204c49

SHA1
7a4aab48fca250c6e3ae8e7addfeae33f1cd83d9

SHA256
7a5781640086b621d579df2b22d112c5825cb23e2f4609014061b2dcf521cf26

SHA512
eb03867e03ef70be053428313e1f6411ff2a346364c88214bbc331e4ae20bc0debf61507cc44c5e21bab8d6ccb10757d79f1c1ee10b5f830f5f035445a85c072

Download Submit
memory/3572-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4136-15-0x00007FFC27123000-0x00007FFC27125000-memory.dmp

Filesize
8KB

Download
memory/4136-14-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download