Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 15:28

General

  • Target

    e6baad5a7e5385bc92311bc785faeabed25354b22d90f6422ffc65d07a913c5c.exe

  • Size

    1.7MB

  • MD5

    76a7b68916d548824e6317f882b287f9

  • SHA1

    4ff4c13e51d3e57b4acf61ba6b2f3a65cde312d7

  • SHA256

    e6baad5a7e5385bc92311bc785faeabed25354b22d90f6422ffc65d07a913c5c

  • SHA512

    3deff527545ff0645e3e7b71c04534e1dca51d0e77b100530cfd0560dee5cc9a216fb35e0ef9e7820fb31588cc8c188284fc1472c98357b141e7381719ea0806

  • SSDEEP

    49152:VaVPPvlrtRgaEQ7fYFGtVzvhIpHkL9yR/qC:ulrtRgaE5EVzvgELsc

Malware Config

Extracted

Family

amadey

Version

3.85

C2

http://77.91.68.3

Attributes
  • install_dir

    3ec1f323b5

  • install_file

    danke.exe

  • strings_key

    827021be90f1e85ab27949ea7e9347e8

  • url_paths

    /home/love/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6baad5a7e5385bc92311bc785faeabed25354b22d90f6422ffc65d07a913c5c.exe
    "C:\Users\Admin\AppData\Local\Temp\e6baad5a7e5385bc92311bc785faeabed25354b22d90f6422ffc65d07a913c5c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0356475.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0356475.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:264
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0049823.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0049823.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6232922.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6232922.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1772
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3037363.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3037363.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1888
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7830559.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7830559.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1964
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8174554.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8174554.exe
          4⤵
          • Executes dropped EXE
          PID:1652
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 136
            5⤵
            • Program crash
            PID:2412
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d7235466.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d7235466.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
          "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4312
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2064
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3464
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "danke.exe" /P "Admin:N"
                6⤵
                  PID:2792
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "danke.exe" /P "Admin:R" /E
                  6⤵
                    PID:2324
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:1940
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\3ec1f323b5" /P "Admin:N"
                      6⤵
                        PID:2828
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\3ec1f323b5" /P "Admin:R" /E
                        6⤵
                          PID:4032
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5765358.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5765358.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:4608
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1652 -ip 1652
                1⤵
                  PID:3484
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4300
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3124

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5765358.exe

                  Filesize

                  30KB

                  MD5

                  35a15fad3767597b01a20d75c3c6889a

                  SHA1

                  eef19e2757667578f73c4b5720cf94c2ab6e60c8

                  SHA256

                  90ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc

                  SHA512

                  c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0356475.exe

                  Filesize

                  1.5MB

                  MD5

                  f382efdfc967e54ad6d69d654a1f6dbd

                  SHA1

                  a658e94051eff667f98b7bb3490d84f663d4d225

                  SHA256

                  522d181c4776d45f68a55cb460a37e655b2aceefce4f3008e6a7310bb940cfb9

                  SHA512

                  d882b887c13a8b07ff67f041ebede7d436701e950ad089e1ad9e196f90ca45cb03d0599ce8ad3cb177243e76f85b9e022d202f3dc67ab78c812e20a9c7ef021f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d7235466.exe

                  Filesize

                  224KB

                  MD5

                  8c6b79ec436d7cf6950a804c1ec7d3e9

                  SHA1

                  4a589d5605d8ef785fdc78b0bf64e769e3a21ad6

                  SHA256

                  4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d

                  SHA512

                  06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0049823.exe

                  Filesize

                  1.4MB

                  MD5

                  07e1bbd66441aa75478099202da495db

                  SHA1

                  22fccd9668ec761dc23a0718b69709fba1be9f29

                  SHA256

                  25bda4872402b7cfc2bdea4230b3b812ef40966bf1c036b75d83ad8fc7b8a822

                  SHA512

                  717957d512f226d7e5724688b19880653dd68cc468337163436c8a3315940cf9c3045b5332996a158205e8307a1974508b1a60ab0c0ecd67811afceb2b841d40

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8174554.exe

                  Filesize

                  1.7MB

                  MD5

                  d640ffc91c33fe1ca15aadd7c5e4a247

                  SHA1

                  a89733a4c9e64cc2fe281b441f093a09444326bf

                  SHA256

                  7ffcb35638bf8d254780433c98684c16a1a063aeab92014256802d20c8feff6a

                  SHA512

                  5ec3532d3dd62810d06453d0ad394613d07e4118719b0f7d8dd58822cbbd76721696c8a7d18a08942fff523253d7ea39473aeead659d567996d8b523c1d14be9

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6232922.exe

                  Filesize

                  653KB

                  MD5

                  6f9872b9ee277485776014b2ae724bf8

                  SHA1

                  4fd191fdb208519b10f91057ea10bb0508a08a8e

                  SHA256

                  3c7191c67465c0d47fa12894187819a08cc1f99661d5d6e223beac8bbc17efdc

                  SHA512

                  426c890041e088afb012efd7d8188632c1831d24f8755575c1f20ed21fc70ace742dcd8baa98ae2504e93a5837a70bf762dee2894705f3b9ba47d623fb629639

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3037363.exe

                  Filesize

                  640KB

                  MD5

                  2c0ec464007c2e5047ac97046169069a

                  SHA1

                  b80ac13ca4381cf9508e7ed9089200b769e5c233

                  SHA256

                  7461bee1038fcaf654fa8fcb046fb22259bb71b17dd6b89acc130803a910cebc

                  SHA512

                  6766d09e99452a0bee7c52b106f8b5bbc8505b78834cec02f8677228581025d23d9f637782b9ac84b9df9055c2969e8486608f93616384188317132b9a97b55a

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7830559.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • memory/1888-28-0x0000000000500000-0x000000000050A000-memory.dmp

                  Filesize

                  40KB

                • memory/1964-37-0x00000000009D0000-0x00000000009DA000-memory.dmp

                  Filesize

                  40KB

                • memory/4608-58-0x0000000000400000-0x0000000000409000-memory.dmp

                  Filesize

                  36KB