amadey | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe
Size

514KB
MD5

05b1bd5fc4cfbb5ac811b1085e421a0e
SHA1

cc9da7c9ffe07eac65e1c6b57d62f820a9b75e99
SHA256

27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f
SHA512

8b84c660b2a8819f5bf546405f63c359e9836fba5d4145878afbe02c98a1d30d6380df9e70a9f819494a89f6c3a5f3fd1b86ea2e1218ab5834490ef790d41c65
SSDEEP

12288:bMrFy90nQ3cYBUovwEOAjj3pvqur9J1VpR8/G98aYE03ZoRU:iyBsOUovwsjjMupbR2GSVlJoe

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8274244.exe	healer
behavioral8/memory/4616-21-0x0000000000E40000-0x0000000000E4A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a8274244.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8274244.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8274244.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8274244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8274244.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8274244.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8274244.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4707782.exe	family_redline
behavioral8/memory/1532-46-0x0000000000E60000-0x0000000000E90000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b8596918.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	b8596918.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v4549806.exev1515895.exea8274244.exeb8596918.exepdates.exec9178124.exepdates.exed4707782.exepdates.exe

pid process

3620 v4549806.exe
5004 v1515895.exe
4616 a8274244.exe
884 b8596918.exe
1616 pdates.exe
3024 c9178124.exe
4752 pdates.exe
1532 d4707782.exe
4044 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a8274244.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a8274244.exe

pid	process
3620	v4549806.exe
5004	v1515895.exe
4616	a8274244.exe
884	b8596918.exe
1616	pdates.exe
3024	c9178124.exe
4752	pdates.exe
1532	d4707782.exe
4044	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8274244.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v1515895.exe27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exev4549806.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1515895.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4549806.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c9178124.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9178124.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9178124.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9178124.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a8274244.exe

pid process

4616 a8274244.exe
4616 a8274244.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a8274244.exe

description pid process

Token: SeDebugPrivilege 4616 a8274244.exe

pid	process
4800	schtasks.exe

pid	process
4616	a8274244.exe
4616	a8274244.exe

description	pid	process
Token: SeDebugPrivilege	4616	a8274244.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exev4549806.exev1515895.exeb8596918.exepdates.execmd.exe

description	pid	process	target process
PID 464 wrote to memory of 3620	464	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe	v4549806.exe
PID 464 wrote to memory of 3620	464	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe	v4549806.exe
PID 464 wrote to memory of 3620	464	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe	v4549806.exe
PID 3620 wrote to memory of 5004	3620	v4549806.exe	v1515895.exe
PID 3620 wrote to memory of 5004	3620	v4549806.exe	v1515895.exe
PID 3620 wrote to memory of 5004	3620	v4549806.exe	v1515895.exe
PID 5004 wrote to memory of 4616	5004	v1515895.exe	a8274244.exe
PID 5004 wrote to memory of 4616	5004	v1515895.exe	a8274244.exe
PID 5004 wrote to memory of 884	5004	v1515895.exe	b8596918.exe
PID 5004 wrote to memory of 884	5004	v1515895.exe	b8596918.exe
PID 5004 wrote to memory of 884	5004	v1515895.exe	b8596918.exe
PID 884 wrote to memory of 1616	884	b8596918.exe	pdates.exe
PID 884 wrote to memory of 1616	884	b8596918.exe	pdates.exe
PID 884 wrote to memory of 1616	884	b8596918.exe	pdates.exe
PID 3620 wrote to memory of 3024	3620	v4549806.exe	c9178124.exe
PID 3620 wrote to memory of 3024	3620	v4549806.exe	c9178124.exe
PID 3620 wrote to memory of 3024	3620	v4549806.exe	c9178124.exe
PID 1616 wrote to memory of 4800	1616	pdates.exe	schtasks.exe
PID 1616 wrote to memory of 4800	1616	pdates.exe	schtasks.exe
PID 1616 wrote to memory of 4800	1616	pdates.exe	schtasks.exe
PID 1616 wrote to memory of 3196	1616	pdates.exe	cmd.exe
PID 1616 wrote to memory of 3196	1616	pdates.exe	cmd.exe
PID 1616 wrote to memory of 3196	1616	pdates.exe	cmd.exe
PID 3196 wrote to memory of 4580	3196	cmd.exe	cmd.exe
PID 3196 wrote to memory of 4580	3196	cmd.exe	cmd.exe
PID 3196 wrote to memory of 4580	3196	cmd.exe	cmd.exe
PID 3196 wrote to memory of 2372	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 2372	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 2372	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 3368	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 3368	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 3368	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 216	3196	cmd.exe	cmd.exe
PID 3196 wrote to memory of 216	3196	cmd.exe	cmd.exe
PID 3196 wrote to memory of 216	3196	cmd.exe	cmd.exe
PID 3196 wrote to memory of 5080	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 5080	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 5080	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 1916	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 1916	3196	cmd.exe	cacls.exe
PID 3196 wrote to memory of 1916	3196	cmd.exe	cacls.exe
PID 464 wrote to memory of 1532	464	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe	d4707782.exe
PID 464 wrote to memory of 1532	464	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe	d4707782.exe
PID 464 wrote to memory of 1532	464	27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe	d4707782.exe

C:\Users\Admin\AppData\Local\Temp\27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe
"C:\Users\Admin\AppData\Local\Temp\27bf431b08d40bcbf5b763154e97f70f0745d6072ffe1d77d49e6cc8d3181c9f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4549806.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4549806.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3620

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1515895.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1515895.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5004

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8274244.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8274244.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8596918.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8596918.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
6⤵
- Creates scheduled task(s)
PID:4800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:3196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4580

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:N"
7⤵
PID:2372

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:R" /E
7⤵
PID:3368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:216

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:N"
7⤵
PID:5080

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:R" /E
7⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9178124.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9178124.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3024

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4707782.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4707782.exe
2⤵
- Executes dropped EXE
PID:1532

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4707782.exe
Filesize
172KB

MD5
324b9c52a440df10451ea56cddbb933f

SHA1
79a4aac847a6e13f4309434507cf418d1db1a0be

SHA256
ebdd5ae808c56954a715afbc029e8d8c58ee33b8a9351d83031a9a7cef0441e4

SHA512
881f26d3c69f4dde394ce450c9ec742f8a90932430bdf69986fdf72fd48bdea9e786272a0acd5ba24e1904d0f434e93794fdf3145ff5104c8e37f083e79c373f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4549806.exe
Filesize
359KB

MD5
9687f62b277e9e4c38388e52a3914ca6

SHA1
a9cd5f4023526c8df5d9442244133c8c5471d057

SHA256
daa2762feeb31382796706720fe749e99ab594f942baf09480423a79c3c6d383

SHA512
58560f27f3ed5040564a8d270fd67dbe0c3212649e3c46df89b89516e140a6f88c4a4f000562cdb02607b777ed86cc0a6207980e46530ba689bb0d27f9f9df9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9178124.exe
Filesize
35KB

MD5
25142518552111557da73643ef6ace9e

SHA1
505a10b7ad3556ef3af75354a2aae0a061e19a0a

SHA256
dea04fdae7f23df334a0481f22f9fdb14ca4b9c99cfacbca80d160ac1ec05927

SHA512
44cdfdb33a767bdcc14c1fcb0e251332fa48d929b47244536adcd5b2ee596bf017fd9b802684b7e8d9102c0094453c291b72238260acb013b46e17e9ad6440dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1515895.exe
Filesize
234KB

MD5
a7fff079383e825173137379ab670cd5

SHA1
1fc0bf08810633f1e20c0c350ba50042e95bf6ec

SHA256
21854cd5d1a30272f224300bcd8b41a10c020cd805952a6fa59d6e97d7052294

SHA512
4371434fbc5f814d7c93ad3b7506f6b9d95aeabb7923bbb7739daa97a3d54e3ebe4dfecb92cc5eeca8750c5bc60c3fecabe73dece70feb0142118af2a50109d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8274244.exe
Filesize
12KB

MD5
dd8411c84825addf4c2fb62ea2de05e7

SHA1
94eee2c85a6cf96bac81febe04a23f0d4996d87a

SHA256
03e09dd7805602f105f3744033d0db0937e6f08145c0245c916d5fd1ddec18b2

SHA512
3a78176b1214c2af3bedb1822c6da3874d5d50e1a00efc40e220f77cfd79b42cb402e4162af05b8d1b805188f6eb57843863403256a218c978d91d9442d7fd2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8596918.exe
Filesize
224KB

MD5
0c18ddfc5cf775eb6ac1c62de1fedc90

SHA1
da280fea7c358272c21dc5c5372e32454ef99b0d

SHA256
4986eb6b0771f1600534231e29d7dad8f1a124763664535c485fe2db4ab8f403

SHA512
a3c8e5f994c4ff4bbb9f46c57fd8118fc69ce41f6c4f7c91d04fb06ffd31f9c5452a6734f6c1c45513c89f4cf89e97d3bdb63468033c100ee87213627a7f8afa

Download Submit
memory/1532-52-0x0000000003120000-0x000000000316C000-memory.dmp

Filesize
304KB

Download
memory/1532-51-0x000000000ADB0000-0x000000000ADEC000-memory.dmp

Filesize
240KB

Download
memory/1532-49-0x000000000AE10000-0x000000000AF1A000-memory.dmp

Filesize
1.0MB

Download
memory/1532-50-0x000000000AD50000-0x000000000AD62000-memory.dmp

Filesize
72KB

Download
memory/1532-46-0x0000000000E60000-0x0000000000E90000-memory.dmp

Filesize
192KB

Download
memory/1532-47-0x0000000005740000-0x0000000005746000-memory.dmp

Filesize
24KB

Download
memory/1532-48-0x000000000B290000-0x000000000B8A8000-memory.dmp

Filesize
6.1MB

Download
memory/3024-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4616-21-0x0000000000E40000-0x0000000000E4A000-memory.dmp

Filesize
40KB

Download
memory/4616-22-0x00007FF991D43000-0x00007FF991D45000-memory.dmp

Filesize
8KB

Download