Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 15:27

General

  • Target

    10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe

  • Size

    235KB

  • MD5

    ee5e79d00a13fde9e96a1f9953f35fea

  • SHA1

    788be8b6304f138f5c7bdf00fe98562de6f2790d

  • SHA256

    10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837

  • SHA512

    26b1209bb16d6e5ed3dabe6fc18e6ec425197ecfd26f2038d9d796cff93d25597c774ca01fec5d975457ef7e544b9d7f7d09372e391c1823b4a7e3bcf94d0c49

  • SSDEEP

    6144:KCy+bnr+0p0yN90QEdHyEL9MR1SKgfYLNYs1Ul8C2N:6Mrcy90zgoYLWs6l8V

Malware Config

Extracted

Family

amadey

Version

3.85

C2

http://77.91.68.3

Attributes
  • install_dir

    3ec1f323b5

  • install_file

    danke.exe

  • strings_key

    827021be90f1e85ab27949ea7e9347e8

  • url_paths

    /home/love/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe
    "C:\Users\Admin\AppData\Local\Temp\10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4284
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2404
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:652
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:5044
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "danke.exe" /P "Admin:N"
              5⤵
                PID:4972
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "danke.exe" /P "Admin:R" /E
                5⤵
                  PID:3024
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:232
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\3ec1f323b5" /P "Admin:N"
                    5⤵
                      PID:4748
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\3ec1f323b5" /P "Admin:R" /E
                      5⤵
                        PID:5072
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:220
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:1552

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe

                Filesize

                13KB

                MD5

                84bab76f53d09527ab0783ba2ece2e2e

                SHA1

                bfdc2db1addb613025d32d8a288fc7b70b8b22ee

                SHA256

                8f1eae62ef850d5a0a78054f853cbbe4c3b547bfc34ee890746405cee8bbfe95

                SHA512

                45f0fa0cf107c116e6bd6e8145cfa5580cc007c3755e5b290f5aede15e195c83e296b90d4a6bbbbd619dfdb98168569c2efe8f2e4c9c5a7083a849ed65c670c9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • memory/4284-7-0x0000000000350000-0x000000000035A000-memory.dmp

                Filesize

                40KB

              • memory/4284-8-0x00007FFB81C23000-0x00007FFB81C25000-memory.dmp

                Filesize

                8KB