amadey | e6564b70fa3d9a9e989ad7c1bb2b027f2e5447273c0bb64f84c7940828ecb0ed

Analysis

max time kernel
159s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
Size

515KB
MD5

3133d51b9cb5dff2ffb1eb479a3a8197
SHA1

c7751780b417509447b6374f2044c4a70bd3aea2
SHA256

6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3
SHA512

4d0249966b11f4933be1aa3126d2ebd6d93700ff22f858457c0cde49a6e691f89d6480068f00d26b5aaa07b48f71ec0ec67f6ad6951d92815777801153789ae2
SSDEEP

12288:2Mr3y90Mp419rk/h+B4egjTgl+ZP3SFgHEgD/r17DZ:ByDp4vg+uegjTgl6PQeESr91

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral12/files/0x0008000000023281-19.dat	healer
behavioral12/memory/5048-22-0x0000000000240000-0x000000000024A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6050394.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6050394.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	b5038122.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 6 IoCs

pid	Process
1196	v2439283.exe
1188	v6626793.exe
5048	a6050394.exe
3176	b5038122.exe
2184	danke.exe
4208	c9387752.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6050394.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2439283.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6626793.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9387752.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9387752.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9387752.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5048	a6050394.exe
5048	a6050394.exe
4208	c9387752.exe
4208	c9387752.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	a6050394.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3176	b5038122.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1196	3800	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	93
PID 3800 wrote to memory of 1196	3800	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	93
PID 3800 wrote to memory of 1196	3800	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	93
PID 1196 wrote to memory of 1188	1196	v2439283.exe	94
PID 1196 wrote to memory of 1188	1196	v2439283.exe	94
PID 1196 wrote to memory of 1188	1196	v2439283.exe	94
PID 1188 wrote to memory of 5048	1188	v6626793.exe	95
PID 1188 wrote to memory of 5048	1188	v6626793.exe	95
PID 1188 wrote to memory of 3176	1188	v6626793.exe	96
PID 1188 wrote to memory of 3176	1188	v6626793.exe	96
PID 1188 wrote to memory of 3176	1188	v6626793.exe	96
PID 3176 wrote to memory of 2184	3176	b5038122.exe	97
PID 3176 wrote to memory of 2184	3176	b5038122.exe	97
PID 3176 wrote to memory of 2184	3176	b5038122.exe	97
PID 1196 wrote to memory of 4208	1196	v2439283.exe	98
PID 1196 wrote to memory of 4208	1196	v2439283.exe	98
PID 1196 wrote to memory of 4208	1196	v2439283.exe	98
PID 2184 wrote to memory of 1088	2184	danke.exe	99
PID 2184 wrote to memory of 1088	2184	danke.exe	99
PID 2184 wrote to memory of 1088	2184	danke.exe	99

C:\Users\Admin\AppData\Local\Temp\6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
"C:\Users\Admin\AppData\Local\Temp\6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2439283.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2439283.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6626793.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6626793.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5038122.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5038122.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2184
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1088
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:1112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9387752.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9387752.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2439283.exe

Filesize
359KB

MD5
1867f755c2e50bec05eb667e0d0a1184

SHA1
8fb81278c740f702f51a45a067b28c2b2564e2ed

SHA256
f34e8c5cb56f19f07740954bfbda5b828aec62e6cb8d7cadbf1354b3f811c2d2

SHA512
30148c0a3b0fc230fa4f455493319343186b7f9d71b33388133ab772ea0a10460d40514bda15486591f0da714904f7a1239c40274fd18fd19b8eb872c4be0cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9387752.exe

Filesize
32KB

MD5
df6d3dd8d25c7c1afe3a7756ed9e9ecc

SHA1
a66f386ff69133f8ba6478ae69d56b7880ac0177

SHA256
9916aae975cc1b7af1360bc7de341ddc914a619eeb9cb468cc713147ca4e95f8

SHA512
4c6ec99bd9b06fc4723aefd5a7a637f641aba4fca5d40ae89555a52ec286557675335f2d22ab83710c07a0cd93bbbbcb55614288b4a3cb436c484b7ba173d59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6626793.exe

Filesize
235KB

MD5
f4707a9db7540780ee9da722fde3e0d8

SHA1
38c1069235780f3b2132f28cf526557d418b62b5

SHA256
cb1f767773f8b86ba74d1fac8848b3130be3bc93cc3930e1d123abe7d9329de9

SHA512
1e61b996234ad10e82753fdd995d3a87781b57585e4e24ea8bd11b506541bf57e2f4915f6ea6d8ed0665d23920a0e556723143cb0a4986a46c637f1d02431290

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe

Filesize
14KB

MD5
a74dd029101a25504d8fc7ca33c1adc2

SHA1
22cc29079d98d3ff79f13b8ebf9a27c67757594e

SHA256
1361d5cc17da4688d29e0a60cdb9fe1669d80f3c999292e2467969cf898f3f84

SHA512
2a6bb5b8fe48c838d9af2c95a32b69729e32ee0d2ce1fe35d281b286e910657a8792037d3a52b825d24d7e69730eff09f99ec549ecd3da6e4cb69a277a81f5d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5038122.exe

Filesize
227KB

MD5
787410f258f680e28c135ac0ecc645ca

SHA1
06505649a3c2729796b57e7de0869c8b5a2fd84c

SHA256
064ca5e3fc52bd168e29697fc755b7310781344cafad50e1cd14555e7255641e

SHA512
3c5c3d74569766c30fabe448ec04e1560de75ba10244c4179b0b19deda31ecf5207b7545b6e1c8411e2587409f7d5ca54f35cb04f2bcba109239f83d48294580

Download Submit
memory/4208-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5048-21-0x00007FFE6D0C3000-0x00007FFE6D0C5000-memory.dmp

Filesize
8KB

Download
memory/5048-22-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download