amadey | 82d1eca76037f568efb55ba04db39dbaad07d12a6fe618a601317562ac1dbdfe

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe
Size

514KB
MD5

83901ef0a5b975b100a0dabfb11c7cea
SHA1

34a15996b4f2d4bcbdd398658f85eb07e1c90345
SHA256

4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5
SHA512

8bfdc76b1f5abeee4a9043b60adc7992262f980ede10a4ab3c4202f088c4f906aafa70a6da1ec7e729018276d84b8cfe8fff70880bf09488baec63619284893e
SSDEEP

12288:rMrXy90YS+RDQE4GGAqO6wSgaqsoCpAPiFT1lg:Ey5SjvGEOJu5g

Score

10^/10

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

news

77.91.68.68:19071

Attributes

auth_value
99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral4/files/0x000800000002342b-20.dat	healer
behavioral4/memory/1176-21-0x0000000000CF0000-0x0000000000CFA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3588610.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3588610.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3588610.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3588610.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3588610.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3588610.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/files/0x0007000000023426-43.dat	family_redline
behavioral4/memory/388-45-0x0000000000050000-0x0000000000080000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	b6542666.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

pid	Process
1520	v4832294.exe
3348	v2938738.exe
1176	a3588610.exe
3592	b6542666.exe
3212	danke.exe
1724	c1964322.exe
4684	danke.exe
388	d5591518.exe
1176	danke.exe
3220	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3588610.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4832294.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2938738.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1964322.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1964322.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1964322.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	a3588610.exe
1176	a3588610.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	a3588610.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1520	4524	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe	83
PID 4524 wrote to memory of 1520	4524	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe	83
PID 4524 wrote to memory of 1520	4524	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe	83
PID 1520 wrote to memory of 3348	1520	v4832294.exe	84
PID 1520 wrote to memory of 3348	1520	v4832294.exe	84
PID 1520 wrote to memory of 3348	1520	v4832294.exe	84
PID 3348 wrote to memory of 1176	3348	v2938738.exe	85
PID 3348 wrote to memory of 1176	3348	v2938738.exe	85
PID 3348 wrote to memory of 3592	3348	v2938738.exe	96
PID 3348 wrote to memory of 3592	3348	v2938738.exe	96
PID 3348 wrote to memory of 3592	3348	v2938738.exe	96
PID 3592 wrote to memory of 3212	3592	b6542666.exe	97
PID 3592 wrote to memory of 3212	3592	b6542666.exe	97
PID 3592 wrote to memory of 3212	3592	b6542666.exe	97
PID 1520 wrote to memory of 1724	1520	v4832294.exe	98
PID 1520 wrote to memory of 1724	1520	v4832294.exe	98
PID 1520 wrote to memory of 1724	1520	v4832294.exe	98
PID 3212 wrote to memory of 3076	3212	danke.exe	99
PID 3212 wrote to memory of 3076	3212	danke.exe	99
PID 3212 wrote to memory of 3076	3212	danke.exe	99
PID 3212 wrote to memory of 4580	3212	danke.exe	101
PID 3212 wrote to memory of 4580	3212	danke.exe	101
PID 3212 wrote to memory of 4580	3212	danke.exe	101
PID 4580 wrote to memory of 1316	4580	cmd.exe	103
PID 4580 wrote to memory of 1316	4580	cmd.exe	103
PID 4580 wrote to memory of 1316	4580	cmd.exe	103
PID 4580 wrote to memory of 524	4580	cmd.exe	104
PID 4580 wrote to memory of 524	4580	cmd.exe	104
PID 4580 wrote to memory of 524	4580	cmd.exe	104
PID 4580 wrote to memory of 4272	4580	cmd.exe	105
PID 4580 wrote to memory of 4272	4580	cmd.exe	105
PID 4580 wrote to memory of 4272	4580	cmd.exe	105
PID 4580 wrote to memory of 3832	4580	cmd.exe	106
PID 4580 wrote to memory of 3832	4580	cmd.exe	106
PID 4580 wrote to memory of 3832	4580	cmd.exe	106
PID 4580 wrote to memory of 432	4580	cmd.exe	107
PID 4580 wrote to memory of 432	4580	cmd.exe	107
PID 4580 wrote to memory of 432	4580	cmd.exe	107
PID 4580 wrote to memory of 3988	4580	cmd.exe	108
PID 4580 wrote to memory of 3988	4580	cmd.exe	108
PID 4580 wrote to memory of 3988	4580	cmd.exe	108
PID 4524 wrote to memory of 388	4524	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe	114
PID 4524 wrote to memory of 388	4524	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe	114
PID 4524 wrote to memory of 388	4524	4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe	114

C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe
"C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3076
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:524
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:3988
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1724
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe
  2⤵
  - Executes dropped EXE
  PID:388

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe

Filesize
174KB

MD5
31df0894347caaaef259e2e74c3273ca

SHA1
61b731be9911b72c2e25367e276409efa7729911

SHA256
bd52ad8d28113281760dad60a2dc8a80c4dbd355b5fc99fd6683da38458e2562

SHA512
31d78f923d89b65363679c8693707f41fea3a58a5f87fc87d01829c9202825d6c41eb9278d01a4ae64989cdd7cac708f64dffdf3e25a3a1a679f53286c271a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe

Filesize
359KB

MD5
c8b837d87424640f379241af42394991

SHA1
8be0131290c7a0ff0492eb154662a2ab0eead141

SHA256
361030ee64076cbd0a45dfd2b842caa68e89a2ed513db0c428148672e0aa4161

SHA512
2d420050100972abd2a39802b9a60fef7854fac1a55667cee6d335db50501e058f0c9fb6940b0a088961e286940ebcf061976b13ed7b6bb943c822090a6693b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe

Filesize
34KB

MD5
3802989e409dbf4ae29081fe55df7e25

SHA1
2335b8445d874ef1471ab98c51f8a5e327c47bcc

SHA256
ef9af28db9eb7e1030ebfd255f0294c5515d3af2432b4374346e2f839de26b90

SHA512
4afabcbe96c7edb6b850685aa4a9d295900df9b986622d482106c2e297c11a8d87bcd4b778f7173570a2021263b4cf59c2790268c36600a97150b4167dab257d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe

Filesize
234KB

MD5
a6cf36ef0cb936be2e48b770ffaa692a

SHA1
c852ab2016c488531c2360ccb45100d41d27087a

SHA256
350b02638361c39cdfc97bdcd6aa8da65ada1391d622ccbf771876cb1907071c

SHA512
58786472efff11a8883ca0567a43075d8ebe7d639fd13d6d131b5b10fbb5dcceaa6ae2907d8baadadf71dd72df233f9e09434c812b45000e7e8699a4e08717bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe

Filesize
12KB

MD5
f42c5e225d737b9c3fee86c53fcde9e1

SHA1
194f0b1858498d790ffc30a750e689f8677a76e2

SHA256
d3362dd3c549e8bf353de30125a3730b33efac4e127bd0eb24eb66a197ec09e0

SHA512
6b0560f2b4e11bf154311db52d8cb4e04b8d2ee21fd26d1cefece829d13541fa0c3194115175a8d65c1c3f9fe86eb68b5eb74ec6bf374ca3aa5b87b4b8c90a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe

Filesize
230KB

MD5
89d742e7e14729b64f3789a49431df00

SHA1
a62b8f96272e8762500c43a76fb2d39bf6b0ad28

SHA256
e2cd2b696d33cfc0738eded231b9f1d67a0cc77bcaea5fb5c88998eadc737829

SHA512
b8375f5c0648b5606d89e894485312cdb39becbf433a6983e8868effe660d856907a1d1379af985f5f8769b8c695461519c34f47d2ca620a50d17ee77193992e

Download Submit
memory/388-48-0x000000000A000000-0x000000000A10A000-memory.dmp

Filesize
1.0MB

Download
memory/388-45-0x0000000000050000-0x0000000000080000-memory.dmp

Filesize
192KB

Download
memory/388-46-0x0000000004970000-0x0000000004976000-memory.dmp

Filesize
24KB

Download
memory/388-47-0x000000000A480000-0x000000000AA98000-memory.dmp

Filesize
6.1MB

Download
memory/388-49-0x0000000009F40000-0x0000000009F52000-memory.dmp

Filesize
72KB

Download
memory/388-50-0x0000000009FA0000-0x0000000009FDC000-memory.dmp

Filesize
240KB

Download
memory/388-51-0x0000000004470000-0x00000000044BC000-memory.dmp

Filesize
304KB

Download
memory/1176-21-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

Filesize
40KB

Download
memory/1176-22-0x00007FF98D293000-0x00007FF98D295000-memory.dmp

Filesize
8KB

Download
memory/1724-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download