amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Size

359KB
MD5

18eaeff3ae40e541cbd0cdfdc2298885
SHA1

2fe4663c9d407d97bebcd035d901321dd1d9ef3e
SHA256

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c
SHA512

83c4ef016804df631b4169aac8ff88210d74017b8b19afa7e791bbf9e6c852de2ce64482ce6c29530b4557e75c40f84a827993b3d0f414a0d3306890652bfd16
SSDEEP

6144:Kmy+bnr+Lp0yN90QEjHCyMnb6yUchr1x18mlQVMhyoVAWgWMvmy:aMrzy905Ob79hdEmJYvmy

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral11/files/0x0008000000023426-12.dat	healer
behavioral11/memory/1000-14-0x0000000000870000-0x000000000087A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7507750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7507750.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7507750.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b3281386.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

pid	Process
4804	v4192759.exe
1000	a7507750.exe
8	b3281386.exe
2656	danke.exe
3676	c8559996.exe
4284	danke.exe
3256	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7507750.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4192759.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8559996.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8559996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8559996.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1000	a7507750.exe
1000	a7507750.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	a7507750.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
8	b3281386.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 4804	528	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	83
PID 528 wrote to memory of 4804	528	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	83
PID 528 wrote to memory of 4804	528	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	83
PID 4804 wrote to memory of 1000	4804	v4192759.exe	84
PID 4804 wrote to memory of 1000	4804	v4192759.exe	84
PID 4804 wrote to memory of 8	4804	v4192759.exe	89
PID 4804 wrote to memory of 8	4804	v4192759.exe	89
PID 4804 wrote to memory of 8	4804	v4192759.exe	89
PID 8 wrote to memory of 2656	8	b3281386.exe	90
PID 8 wrote to memory of 2656	8	b3281386.exe	90
PID 8 wrote to memory of 2656	8	b3281386.exe	90
PID 528 wrote to memory of 3676	528	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	91
PID 528 wrote to memory of 3676	528	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	91
PID 528 wrote to memory of 3676	528	6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe	91
PID 2656 wrote to memory of 2836	2656	danke.exe	92
PID 2656 wrote to memory of 2836	2656	danke.exe	92
PID 2656 wrote to memory of 2836	2656	danke.exe	92
PID 2656 wrote to memory of 3596	2656	danke.exe	94
PID 2656 wrote to memory of 3596	2656	danke.exe	94
PID 2656 wrote to memory of 3596	2656	danke.exe	94
PID 3596 wrote to memory of 2216	3596	cmd.exe	96
PID 3596 wrote to memory of 2216	3596	cmd.exe	96
PID 3596 wrote to memory of 2216	3596	cmd.exe	96
PID 3596 wrote to memory of 4308	3596	cmd.exe	97
PID 3596 wrote to memory of 4308	3596	cmd.exe	97
PID 3596 wrote to memory of 4308	3596	cmd.exe	97
PID 3596 wrote to memory of 860	3596	cmd.exe	98
PID 3596 wrote to memory of 860	3596	cmd.exe	98
PID 3596 wrote to memory of 860	3596	cmd.exe	98
PID 3596 wrote to memory of 4692	3596	cmd.exe	99
PID 3596 wrote to memory of 4692	3596	cmd.exe	99
PID 3596 wrote to memory of 4692	3596	cmd.exe	99
PID 3596 wrote to memory of 3420	3596	cmd.exe	100
PID 3596 wrote to memory of 3420	3596	cmd.exe	100
PID 3596 wrote to memory of 3420	3596	cmd.exe	100
PID 3596 wrote to memory of 4512	3596	cmd.exe	101
PID 3596 wrote to memory of 4512	3596	cmd.exe	101
PID 3596 wrote to memory of 4512	3596	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
"C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
      "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2216
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        6⤵
        
        PID:4308
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        6⤵
        
        PID:860
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4692
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        6⤵
        
        PID:3420
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        6⤵
        
        PID:4512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:3676

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe

Filesize
32KB

MD5
499339c2340f225b81aa84b57a06c69f

SHA1
602c6e3a1ca624caa1ec4cc92dfd62ebde523033

SHA256
31c962983a5dcb34c366ea726a6e4defcf6db78d259516edcc1b6336a297bbba

SHA512
a60cedbdb39bec49434526a46369199fa6e41cec24c30764821818e1335fc107123430c61190a265747118e54de289691912c1fa89fc89a79e350813e419838e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe

Filesize
235KB

MD5
f6c9e67f472f01eccc2c794be5bc61cf

SHA1
65ca30935f69dd98e136485fa24ecd00dd2afdef

SHA256
079faabeddf8ac54de6accc9d09b63bf543afdcaf395234f1dbfcf46c5d56d99

SHA512
ba9c4a04454db187a5fbfd64068729523b364bf72085e6b08607970e4cad972691dafc125981b52178f4fd8ea0d5314e42e61d7852ed4c912521a5a4809bfac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe

Filesize
13KB

MD5
f5773b2b65f54e39abe894025d6c9885

SHA1
3f9d26e35dff7640478119ff8550b6ad5363dfde

SHA256
9788cb0fcb4b0bb8086babe2cf499aec511ce0a867ad0c79e79c5c9d9a57d561

SHA512
27a9015725854d7740536c7d403bd4b01f1baa4e4d6bf195f6b25e9055d58b397303d8aef8d833d761eb1ed62563fe4b7c7a12af0edbf80ba1dea3eb24dfb016

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe

Filesize
226KB

MD5
1ff19e67a2ae75ad45eebf9693ec503d

SHA1
3f3da59265845f64d1f29c92706acf35fb4ab1b5

SHA256
d0ecd3340d3c57da9d342be0aef3027e74adbb8834be7d05c28942eda33f8708

SHA512
9810192a9a0b4410edb1726150f94fdb9091889b656a79cdbe8bb78d2b041c0a173c8f36baa7e52b1d0bb4731fe3a749bc84b3b671a425a0f905a3707f0e9571

Download Submit
memory/1000-14-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download
memory/1000-15-0x00007FFE57533000-0x00007FFE57535000-memory.dmp

Filesize
8KB

Download
memory/3676-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3676-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download