amadey | fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7

General

Target

fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe
Size

424KB
MD5

993609639c915d36f2821bad869a17d4
SHA1

899988523cc0bde90c28889a5e32b273757915ac
SHA256

fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7
SHA512

147b9272265b9a5edea8b1f54b37dd95e8380ba461233bb476612ff48016ae752b2cbfa31d3bf87a6f404469eae6c90392c652f19720b4531b78e648b7b58f32
SSDEEP

6144:6O1rkNbOFsBuztTfSoRgxX+j14TGYoij7aR1XPQg9TU5YGmvST3h68BoKupOdCHU:axBuBTExX+AoLzTUKdvST/BoKupOjHz

Score

10^/10

amadey smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://movlat.com/tmp/

http://llcbc.org/tmp/

http://lindex24.ru/tmp/

http://qeqei.xyz/tmp/

rc4.i32

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Hkbsse.exe1.exe

pid process

3020 Hkbsse.exe
2564 1.exe
Loads dropped DLL 3 IoCs

Processes:

fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exeHkbsse.exe

pid process

2360 fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe
3020 Hkbsse.exe
3020 Hkbsse.exe
Drops file in Windows directory 1 IoCs

Processes:

fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe

description ioc process

File created C:\Windows\Tasks\Hkbsse.job fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3020	Hkbsse.exe
2564	1.exe

pid	process
2360	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe
3020	Hkbsse.exe
3020	Hkbsse.exe

description	ioc	process
File created	C:\Windows\Tasks\Hkbsse.job	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1.exe

pid	process
2564	1.exe
2564	1.exe
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1.exe

pid process

2564 1.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe

pid process

2360 fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe

pid	process
2360	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exeHkbsse.exe

description	pid	process	target process
PID 2360 wrote to memory of 3020	2360	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe	Hkbsse.exe
PID 2360 wrote to memory of 3020	2360	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe	Hkbsse.exe
PID 2360 wrote to memory of 3020	2360	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe	Hkbsse.exe
PID 2360 wrote to memory of 3020	2360	fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe	Hkbsse.exe
PID 3020 wrote to memory of 2564	3020	Hkbsse.exe	1.exe
PID 3020 wrote to memory of 2564	3020	Hkbsse.exe	1.exe
PID 3020 wrote to memory of 2564	3020	Hkbsse.exe	1.exe
PID 3020 wrote to memory of 2564	3020	Hkbsse.exe	1.exe

C:\Users\Admin\AppData\Local\Temp\fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe
"C:\Users\Admin\AppData\Local\Temp\fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2360

C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\1000012001\1.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\1.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000012001\1.exe

Filesize
239KB

MD5
e0a475f2ac0e9c3dad905d8ce84f62cb

SHA1
6b789faafed3e4e2d318c9ec9300f9ba3c865374

SHA256
b59e52b83b0a0cde0085b3ba306316a86a845a974cbeaf45da905476b6db53bb

SHA512
a23d30a9fc9d2560fe37b6d9ab334576e956412ca7841f63f051a54aa77a4e3bcf6b1b5e4e28304b06fde02028b20c6ff1297f750c4735281168164d3397cf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe

Filesize
424KB

MD5
993609639c915d36f2821bad869a17d4

SHA1
899988523cc0bde90c28889a5e32b273757915ac

SHA256
fa6aa0dd992228ace8364ddfe1df64c539ee82217fe36710e5882f62dc9868d7

SHA512
147b9272265b9a5edea8b1f54b37dd95e8380ba461233bb476612ff48016ae752b2cbfa31d3bf87a6f404469eae6c90392c652f19720b4531b78e648b7b58f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\721934792624

Filesize
63KB

MD5
ba4eb32e188b1fac5fffd3a8e54d08bb

SHA1
e94fad83a607835f444fa3fe8dc95f69015b3787

SHA256
40be03cfbc92ba03cf021b95cbe8ab100ff7383eaa3ce6fa30f45409a43fd932

SHA512
9e942c151617651cef0255016d10ac493b10966b479617e88201fa7c36ff91228226c1b093c5221aedb82c6eae9effff0d2bae15d856c2b022f76ce91293a651

Download Submit
memory/1224-40-0x0000000002D60000-0x0000000002D76000-memory.dmp

Filesize
88KB

Download
memory/2360-1-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2564-37-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/2564-38-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2564-39-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2564-43-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2564-42-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads