amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
155s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Size

515KB
MD5

1b6ca4b3887874447697d2dac0664cf5
SHA1

0b2ef46a6bd9883b04ecaf8ae6fc47df13e2f8f2
SHA256

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41
SHA512

4435a0bfc90dd2574a28ce91d519a4566ff85413fb13b5c6690d2e868410abda41ebd05e4129f20fdfafb989d5f2bf424ef84234925ebb33123e0a434a4d6a5d
SSDEEP

12288:XMrfy90fa+YaQ3g3aNwmYu4neyzKmErzq93TU1cFdsJ:4y0a+YahqJYuGey2HAEJ

Score

10^/10

amadey healer dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe	healer
behavioral27/memory/3572-22-0x0000000000580000-0x000000000058A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a6513102.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6513102.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6513102.exe

Executes dropped EXE 4 IoCs

Processes:

v9071750.exev1399127.exea6513102.exeb1736941.exe

pid process

3464 v9071750.exe
4924 v1399127.exe
3572 a6513102.exe
4984 b1736941.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a6513102.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6513102.exe

pid	process
3464	v9071750.exe
4924	v1399127.exe
3572	a6513102.exe
4984	b1736941.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6513102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exev9071750.exev1399127.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9071750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1399127.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

a6513102.exe

pid process

3572 a6513102.exe
3572 a6513102.exe
3572 a6513102.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6513102.exe

description pid process

Token: SeDebugPrivilege 3572 a6513102.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b1736941.exe

pid process

4984 b1736941.exe

pid	process
3572	a6513102.exe
3572	a6513102.exe
3572	a6513102.exe

description	pid	process
Token: SeDebugPrivilege	3572	a6513102.exe

pid	process
4984	b1736941.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exev9071750.exev1399127.exe

description	pid	process	target process
PID 1720 wrote to memory of 3464	1720	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	v9071750.exe
PID 1720 wrote to memory of 3464	1720	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	v9071750.exe
PID 1720 wrote to memory of 3464	1720	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	v9071750.exe
PID 3464 wrote to memory of 4924	3464	v9071750.exe	v1399127.exe
PID 3464 wrote to memory of 4924	3464	v9071750.exe	v1399127.exe
PID 3464 wrote to memory of 4924	3464	v9071750.exe	v1399127.exe
PID 4924 wrote to memory of 3572	4924	v1399127.exe	a6513102.exe
PID 4924 wrote to memory of 3572	4924	v1399127.exe	a6513102.exe
PID 4924 wrote to memory of 4984	4924	v1399127.exe	b1736941.exe
PID 4924 wrote to memory of 4984	4924	v1399127.exe	b1736941.exe
PID 4924 wrote to memory of 4984	4924	v1399127.exe	b1736941.exe

C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
"C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4200 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe

Filesize
359KB

MD5
88bee46f431c014c1e45417f6b13e124

SHA1
07588e0723944e251a6a2d9db4ed8e45d5f563f1

SHA256
f4dfc88066f344cec64c3c5076b4e1e051af9f333c455aa2f96daacc1d732999

SHA512
5a0c53df34632e2d21c12e572460d54bfe7de21035d44bc36764ed3c6410d661ee50c758366cc8b86c2447b54efab7c41479fb04468afee6b70b9cbbaf55e79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe

Filesize
234KB

MD5
8f620f99bbeba489fc4bddc2af02f9b8

SHA1
2e97752a24581dd229306cfad5763cf82f9c4f96

SHA256
26a1717813eedfd0569c474064d1e14eeba61b97bb26866c53a19428a448a3f5

SHA512
b5065ed02a3bdcb68461265bb56f9173a7f9a1c75d12cf1ae53c43224cf2aada5586a4ee122779d7c83b8e8130cc6a980080cd03c2cc751ce19ac5ea3b2caa03

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe

Filesize
13KB

MD5
12803f40ef0b813626de6e5eb0ec05b2

SHA1
27e32adac36ba9f4d54ecbf53e112158d4e988b5

SHA256
d320fcef46ae85d5f06133a3b8d4f5a7d2dff0886a86d981f3186f464fbb7abb

SHA512
84d7c28b03fdceb94e00fbcc838f203f6cd9e091b67b7ea8dad577a529a0d96eecf3b246a8548c9b7bef1e063aa96525f6b2148b5d0bb79b32a3415e9f151e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe

Filesize
225KB

MD5
2b7ed1055ddd27afe675dd11da92357a

SHA1
3809cb22cbdda5ba5707892163217563020df5ca

SHA256
9d69e620d8bb7cb24c7d4831312351d09872badc8331594ce05afe46ff56ab3d

SHA512
549602e7e10ae1b006fafe9d6c1c09d35280a3af8815157dfa9b7664f16bf1682cc782585a24202dd150955073b5e648f0ad8a39add3f95ceeb51a5eb26fc641

Download Submit
memory/3572-21-0x00007FF983FC3000-0x00007FF983FC5000-memory.dmp

Filesize
8KB

Download
memory/3572-22-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download