amadey | dc3a1c0a9e91f9db2fff71c534b9b0e94067f24c7823bdabecfbdb495e4fe76a

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe
Size

514KB
MD5

33aca759fc7ddd2c0ba87b20d2cf8986
SHA1

f4e5f0de1188385931c81c61229f03c508e29fc7
SHA256

617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f
SHA512

3da9c1afa7ac424395afc2e2f512ca900218a7b4f353ff2708b9760fbceee45a37ff7d34fd1332c63e9570b0ba90131f18235c7ff0f76b5f6ab5a0484a9720af
SSDEEP

12288:EMrYy90ZQGHay0dMZCvYOiGRD/qYR+J8gDSMuUCyjylEsCmjt:EykHaHdMZmYwIlJ13uUCyjylEhit

Score

10^/10

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral5/files/0x00080000000235cd-19.dat	healer
behavioral5/memory/212-21-0x0000000000E10000-0x0000000000E1A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2236406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2236406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2236406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2236406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2236406.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2236406.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x00070000000235c8-43.dat	family_redline
behavioral5/memory/1288-45-0x0000000000620000-0x0000000000650000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	b0839738.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

pid	Process
4980	v9668283.exe
3760	v6794516.exe
212	a2236406.exe
2280	b0839738.exe
4200	pdates.exe
1892	c5355716.exe
4240	pdates.exe
1288	d2038758.exe
1380	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2236406.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9668283.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6794516.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5355716.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5355716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5355716.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
212	a2236406.exe
212	a2236406.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	a2236406.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4980	2748	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe	93
PID 2748 wrote to memory of 4980	2748	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe	93
PID 2748 wrote to memory of 4980	2748	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe	93
PID 4980 wrote to memory of 3760	4980	v9668283.exe	94
PID 4980 wrote to memory of 3760	4980	v9668283.exe	94
PID 4980 wrote to memory of 3760	4980	v9668283.exe	94
PID 3760 wrote to memory of 212	3760	v6794516.exe	95
PID 3760 wrote to memory of 212	3760	v6794516.exe	95
PID 3760 wrote to memory of 2280	3760	v6794516.exe	97
PID 3760 wrote to memory of 2280	3760	v6794516.exe	97
PID 3760 wrote to memory of 2280	3760	v6794516.exe	97
PID 2280 wrote to memory of 4200	2280	b0839738.exe	98
PID 2280 wrote to memory of 4200	2280	b0839738.exe	98
PID 2280 wrote to memory of 4200	2280	b0839738.exe	98
PID 4980 wrote to memory of 1892	4980	v9668283.exe	99
PID 4980 wrote to memory of 1892	4980	v9668283.exe	99
PID 4980 wrote to memory of 1892	4980	v9668283.exe	99
PID 4200 wrote to memory of 2824	4200	pdates.exe	100
PID 4200 wrote to memory of 2824	4200	pdates.exe	100
PID 4200 wrote to memory of 2824	4200	pdates.exe	100
PID 4200 wrote to memory of 4576	4200	pdates.exe	102
PID 4200 wrote to memory of 4576	4200	pdates.exe	102
PID 4200 wrote to memory of 4576	4200	pdates.exe	102
PID 4576 wrote to memory of 4984	4576	cmd.exe	104
PID 4576 wrote to memory of 4984	4576	cmd.exe	104
PID 4576 wrote to memory of 4984	4576	cmd.exe	104
PID 4576 wrote to memory of 1684	4576	cmd.exe	105
PID 4576 wrote to memory of 1684	4576	cmd.exe	105
PID 4576 wrote to memory of 1684	4576	cmd.exe	105
PID 4576 wrote to memory of 3120	4576	cmd.exe	106
PID 4576 wrote to memory of 3120	4576	cmd.exe	106
PID 4576 wrote to memory of 3120	4576	cmd.exe	106
PID 4576 wrote to memory of 2940	4576	cmd.exe	107
PID 4576 wrote to memory of 2940	4576	cmd.exe	107
PID 4576 wrote to memory of 2940	4576	cmd.exe	107
PID 4576 wrote to memory of 224	4576	cmd.exe	108
PID 4576 wrote to memory of 224	4576	cmd.exe	108
PID 4576 wrote to memory of 224	4576	cmd.exe	108
PID 4576 wrote to memory of 3604	4576	cmd.exe	109
PID 4576 wrote to memory of 3604	4576	cmd.exe	109
PID 4576 wrote to memory of 3604	4576	cmd.exe	109
PID 2748 wrote to memory of 1288	2748	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe	113
PID 2748 wrote to memory of 1288	2748	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe	113
PID 2748 wrote to memory of 1288	2748	617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe	113

C:\Users\Admin\AppData\Local\Temp\617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe
"C:\Users\Admin\AppData\Local\Temp\617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9668283.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9668283.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6794516.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6794516.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2236406.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2236406.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:212
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0839738.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0839738.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2824
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:224
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:3604
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5355716.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5355716.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1892
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2038758.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2038758.exe
  2⤵
  - Executes dropped EXE
  PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
1⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4240

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2038758.exe

Filesize
173KB

MD5
6a8cc5e017cb0eb900292da23eb5ebae

SHA1
90b02dd2ef5e7b6d78050af6637df3fb9312ecac

SHA256
ec4419032350df60c94cc4c6da38e5f0e353c5382dd782800b07a031efe5af23

SHA512
38344907d3f519f318c9b5684b75b7217878a3060fbb424bc9f8800d34f107d47f2eb675a587e9654a99010e6afd50a809210e0092daecf1498ab69e76979644

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9668283.exe

Filesize
359KB

MD5
1c8226a52d0ac47e1a6326c24f70d6ab

SHA1
5ccf3aaa14338e29022903feb5dd2941b25c5fa6

SHA256
da9c9df115044e0b11a35f53f64ac5edb1673447e3b7bc68875892abb056366f

SHA512
80f9f608e4fc7b684ba10c2b2ef2b14150a7d8b210c02db4f5ed9897c49799e8d0c2420704bf83b1455911b61f7a70cce64d02f1e5472b6ba4565669360faaf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5355716.exe

Filesize
35KB

MD5
71fef25c46415692b392d100ae97e1b0

SHA1
f06ab9b468b036a6a0348dc4ba5f54ba387d5b72

SHA256
68caaa916d4e3019a4bdb948e49b549d92b8825923ca4f6fbc66244fe424da7b

SHA512
56213dc992e727c489446bcca96ce4c92ebb6bcb01726a01267c9f438c314dc76a4c585674baf034041cfe42b980e3b070a663b0647da8d4ebab3ea339694db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6794516.exe

Filesize
234KB

MD5
35b7c3cd1b1fedf0934b9f92a74be9f1

SHA1
b9b5d486597ea2453aec873167b29be5b012d343

SHA256
39b70cbe2d586c2aa07d140908c4f78b416c1725e96ae8ae66832e6088f80385

SHA512
bb6393c12178fd96f3c22e3c2a24bec82fbca3dc15cf62d23d09488f4a68f03ba529a68d38b1e8be26d4a393f8284f772ceaa944ec8eb5a7bd943ac2d38c2a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2236406.exe

Filesize
11KB

MD5
68aab4bc8dbb25defdeab2faefdb87de

SHA1
5086c566bc0468041cf5f1a95789407d7271b112

SHA256
19f47e802ae35eb0dfed1e712105fb2d2abdd05d567a0cb18e02a17173a2f988

SHA512
4e7292aeaf1c320c100ce620125a7e4f1e5f51baecedd014c48e921a2c3f0adcbe3d6cf4afd911ea3a37ab19f88f662820494befbac7fb09e7d12ef1d1167299

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0839738.exe

Filesize
224KB

MD5
d2b47284c2966c20e24fdfc256d58481

SHA1
e6eaf8171003ab990af8d6b5088fb364d50a0011

SHA256
4542f254afadc9ffbba4727ad4661855cb0f54562205e356568f44e09b58a4b9

SHA512
8c4990d0dedd04ad1b74e87c5270628d97e55c981d3f1c626c8bc085cd526d612ad9e2ea9150e8af26278aba57f105439319dabc071b896435130a91d5a87f2b

Download Submit
memory/212-22-0x00007FF9919F3000-0x00007FF9919F5000-memory.dmp

Filesize
8KB

Download
memory/212-21-0x0000000000E10000-0x0000000000E1A000-memory.dmp

Filesize
40KB

Download
memory/1288-45-0x0000000000620000-0x0000000000650000-memory.dmp

Filesize
192KB

Download
memory/1288-46-0x0000000000E10000-0x0000000000E16000-memory.dmp

Filesize
24KB

Download
memory/1288-47-0x000000000A990000-0x000000000AFA8000-memory.dmp

Filesize
6.1MB

Download
memory/1288-48-0x000000000A490000-0x000000000A59A000-memory.dmp

Filesize
1.0MB

Download
memory/1288-49-0x000000000A3D0000-0x000000000A3E2000-memory.dmp

Filesize
72KB

Download
memory/1288-50-0x000000000A430000-0x000000000A46C000-memory.dmp

Filesize
240KB

Download
memory/1288-51-0x0000000002820000-0x000000000286C000-memory.dmp

Filesize
304KB

Download
memory/1892-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download