amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Size

359KB
MD5

18eaeff3ae40e541cbd0cdfdc2298885
SHA1

2fe4663c9d407d97bebcd035d901321dd1d9ef3e
SHA256

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c
SHA512

83c4ef016804df631b4169aac8ff88210d74017b8b19afa7e791bbf9e6c852de2ce64482ce6c29530b4557e75c40f84a827993b3d0f414a0d3306890652bfd16
SSDEEP

6144:Kmy+bnr+Lp0yN90QEjHCyMnb6yUchr1x18mlQVMhyoVAWgWMvmy:aMrzy905Ob79hdEmJYvmy

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe	healer
behavioral11/memory/4592-15-0x0000000000630000-0x000000000063A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a7507750.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7507750.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b3281386.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	b3281386.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

Processes:

v4192759.exea7507750.exeb3281386.exedanke.exec8559996.exedanke.exedanke.exe

pid process

1004 v4192759.exe
4592 a7507750.exe
4352 b3281386.exe
1768 danke.exe
4228 c8559996.exe
4552 danke.exe
3092 danke.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a7507750.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7507750.exe

pid	process
1004	v4192759.exe
4592	a7507750.exe
4352	b3281386.exe
1768	danke.exe
4228	c8559996.exe
4552	danke.exe
3092	danke.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7507750.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exev4192759.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4192759.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c8559996.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8559996.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8559996.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8559996.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4792 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a7507750.exe

pid process

4592 a7507750.exe
4592 a7507750.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7507750.exe

description pid process

Token: SeDebugPrivilege 4592 a7507750.exe

pid	process
4792	schtasks.exe

pid	process
4592	a7507750.exe
4592	a7507750.exe

description	pid	process
Token: SeDebugPrivilege	4592	a7507750.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exev4192759.exeb3281386.exedanke.execmd.exe

description	pid	process	target process
PID 2268 wrote to memory of 1004	2268	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	v4192759.exe
PID 2268 wrote to memory of 1004	2268	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	v4192759.exe
PID 2268 wrote to memory of 1004	2268	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	v4192759.exe
PID 1004 wrote to memory of 4592	1004	v4192759.exe	a7507750.exe
PID 1004 wrote to memory of 4592	1004	v4192759.exe	a7507750.exe
PID 1004 wrote to memory of 4352	1004	v4192759.exe	b3281386.exe
PID 1004 wrote to memory of 4352	1004	v4192759.exe	b3281386.exe
PID 1004 wrote to memory of 4352	1004	v4192759.exe	b3281386.exe
PID 4352 wrote to memory of 1768	4352	b3281386.exe	danke.exe
PID 4352 wrote to memory of 1768	4352	b3281386.exe	danke.exe
PID 4352 wrote to memory of 1768	4352	b3281386.exe	danke.exe
PID 2268 wrote to memory of 4228	2268	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	c8559996.exe
PID 2268 wrote to memory of 4228	2268	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	c8559996.exe
PID 2268 wrote to memory of 4228	2268	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	c8559996.exe
PID 1768 wrote to memory of 4792	1768	danke.exe	schtasks.exe
PID 1768 wrote to memory of 4792	1768	danke.exe	schtasks.exe
PID 1768 wrote to memory of 4792	1768	danke.exe	schtasks.exe
PID 1768 wrote to memory of 2804	1768	danke.exe	cmd.exe
PID 1768 wrote to memory of 2804	1768	danke.exe	cmd.exe
PID 1768 wrote to memory of 2804	1768	danke.exe	cmd.exe
PID 2804 wrote to memory of 2692	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 2692	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 2692	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 4932	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 4932	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 4932	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 2556	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 2556	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 2556	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 4952	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 4952	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 4952	2804	cmd.exe	cmd.exe
PID 2804 wrote to memory of 5004	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 5004	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 5004	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 3628	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 3628	2804	cmd.exe	cacls.exe
PID 2804 wrote to memory of 3628	2804	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
"C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
5⤵
- Creates scheduled task(s)
PID:4792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2692

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:N"
6⤵
PID:4932

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:R" /E
6⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4952

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:N"
6⤵
PID:5004

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:R" /E
6⤵
PID:3628

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4228

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
Filesize
32KB

MD5
499339c2340f225b81aa84b57a06c69f

SHA1
602c6e3a1ca624caa1ec4cc92dfd62ebde523033

SHA256
31c962983a5dcb34c366ea726a6e4defcf6db78d259516edcc1b6336a297bbba

SHA512
a60cedbdb39bec49434526a46369199fa6e41cec24c30764821818e1335fc107123430c61190a265747118e54de289691912c1fa89fc89a79e350813e419838e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
Filesize
235KB

MD5
f6c9e67f472f01eccc2c794be5bc61cf

SHA1
65ca30935f69dd98e136485fa24ecd00dd2afdef

SHA256
079faabeddf8ac54de6accc9d09b63bf543afdcaf395234f1dbfcf46c5d56d99

SHA512
ba9c4a04454db187a5fbfd64068729523b364bf72085e6b08607970e4cad972691dafc125981b52178f4fd8ea0d5314e42e61d7852ed4c912521a5a4809bfac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
Filesize
13KB

MD5
f5773b2b65f54e39abe894025d6c9885

SHA1
3f9d26e35dff7640478119ff8550b6ad5363dfde

SHA256
9788cb0fcb4b0bb8086babe2cf499aec511ce0a867ad0c79e79c5c9d9a57d561

SHA512
27a9015725854d7740536c7d403bd4b01f1baa4e4d6bf195f6b25e9055d58b397303d8aef8d833d761eb1ed62563fe4b7c7a12af0edbf80ba1dea3eb24dfb016

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
Filesize
226KB

MD5
1ff19e67a2ae75ad45eebf9693ec503d

SHA1
3f3da59265845f64d1f29c92706acf35fb4ab1b5

SHA256
d0ecd3340d3c57da9d342be0aef3027e74adbb8834be7d05c28942eda33f8708

SHA512
9810192a9a0b4410edb1726150f94fdb9091889b656a79cdbe8bb78d2b041c0a173c8f36baa7e52b1d0bb4731fe3a749bc84b3b671a425a0f905a3707f0e9571

Download Submit
memory/4228-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4228-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4592-14-0x00007FFF0B0E3000-0x00007FFF0B0E5000-memory.dmp

Filesize
8KB

Download
memory/4592-15-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download