amadey | d3b7e5cbe2980cd2fb6f7f30eaade26a956ec4a02e71ed37c80b263166b40ef2

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe
Size

514KB
MD5

0c314c3384c85c50e9da541ac5b0893f
SHA1

efd1f83a21c41e8a55d9a13e4ed57ea2a7cb7d9a
SHA256

3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571
SHA512

70e9b01358106c18fb9553957838b26dbe75e914dd84e062c77ceb7b35820d32e5a3f1be000eeb86a91c432774de8c99ff13a2c77b4ac788ab7c2a978ebe935f
SSDEEP

12288:mMrXy90Wc0SidpHIxieOutu7FyVekPhbiAMd1Juj:5yXc9idN5eOuc72vbi9d1Ja

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3864613.exe	healer
behavioral3/memory/3992-21-0x0000000000E90000-0x0000000000E9A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a3864613.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3864613.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3864613.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3864613.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3864613.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3864613.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3864613.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0287623.exe	family_redline
behavioral3/memory/2608-45-0x0000000000990000-0x00000000009C0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0194772.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	b0194772.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

Processes:

v9845214.exev9681722.exea3864613.exeb0194772.exedanke.exec1633986.exedanke.exed0287623.exedanke.exedanke.exe

pid	process
3420	v9845214.exe
2296	v9681722.exe
3992	a3864613.exe
4048	b0194772.exe
2336	danke.exe
1620	c1633986.exe
3500	danke.exe
2608	d0287623.exe
1140	danke.exe
2908	danke.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a3864613.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3864613.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3864613.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v9845214.exev9681722.exe3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9845214.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9681722.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c1633986.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1633986.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1633986.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1633986.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4544 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3864613.exe

pid process

3992 a3864613.exe
3992 a3864613.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3864613.exe

description pid process

Token: SeDebugPrivilege 3992 a3864613.exe

pid	process
4544	schtasks.exe

pid	process
3992	a3864613.exe
3992	a3864613.exe

description	pid	process
Token: SeDebugPrivilege	3992	a3864613.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exev9845214.exev9681722.exeb0194772.exedanke.execmd.exe

description	pid	process	target process
PID 3532 wrote to memory of 3420	3532	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe	v9845214.exe
PID 3532 wrote to memory of 3420	3532	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe	v9845214.exe
PID 3532 wrote to memory of 3420	3532	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe	v9845214.exe
PID 3420 wrote to memory of 2296	3420	v9845214.exe	v9681722.exe
PID 3420 wrote to memory of 2296	3420	v9845214.exe	v9681722.exe
PID 3420 wrote to memory of 2296	3420	v9845214.exe	v9681722.exe
PID 2296 wrote to memory of 3992	2296	v9681722.exe	a3864613.exe
PID 2296 wrote to memory of 3992	2296	v9681722.exe	a3864613.exe
PID 2296 wrote to memory of 4048	2296	v9681722.exe	b0194772.exe
PID 2296 wrote to memory of 4048	2296	v9681722.exe	b0194772.exe
PID 2296 wrote to memory of 4048	2296	v9681722.exe	b0194772.exe
PID 4048 wrote to memory of 2336	4048	b0194772.exe	danke.exe
PID 4048 wrote to memory of 2336	4048	b0194772.exe	danke.exe
PID 4048 wrote to memory of 2336	4048	b0194772.exe	danke.exe
PID 3420 wrote to memory of 1620	3420	v9845214.exe	c1633986.exe
PID 3420 wrote to memory of 1620	3420	v9845214.exe	c1633986.exe
PID 3420 wrote to memory of 1620	3420	v9845214.exe	c1633986.exe
PID 2336 wrote to memory of 4544	2336	danke.exe	schtasks.exe
PID 2336 wrote to memory of 4544	2336	danke.exe	schtasks.exe
PID 2336 wrote to memory of 4544	2336	danke.exe	schtasks.exe
PID 2336 wrote to memory of 4332	2336	danke.exe	cmd.exe
PID 2336 wrote to memory of 4332	2336	danke.exe	cmd.exe
PID 2336 wrote to memory of 4332	2336	danke.exe	cmd.exe
PID 4332 wrote to memory of 1556	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 1556	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 1556	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 1756	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 1756	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 1756	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3836	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3836	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3836	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 824	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 824	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 824	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 4348	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 4348	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 4348	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3244	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3244	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3244	4332	cmd.exe	cacls.exe
PID 3532 wrote to memory of 2608	3532	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe	d0287623.exe
PID 3532 wrote to memory of 2608	3532	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe	d0287623.exe
PID 3532 wrote to memory of 2608	3532	3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe	d0287623.exe

C:\Users\Admin\AppData\Local\Temp\3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe
"C:\Users\Admin\AppData\Local\Temp\3b8cd7306bcee474040656c20f071e99345caea6d53f3bae9bb55dfbe680b571.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3532

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9845214.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9845214.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3420

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9681722.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9681722.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2296

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3864613.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3864613.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0194772.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0194772.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
6⤵
- Creates scheduled task(s)
PID:4544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1556

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:N"
7⤵
PID:1756

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:R" /E
7⤵
PID:3836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:824

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:N"
7⤵
PID:4348

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:R" /E
7⤵
PID:3244

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1633986.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1633986.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1620

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0287623.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0287623.exe
2⤵
- Executes dropped EXE
PID:2608

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3500

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0287623.exe
Filesize
173KB

MD5
cf45b941e3ed7d9ca42bf6b416b2ad98

SHA1
f64c8b08eaa3883021afdd4103b8ef178c4afd47

SHA256
8f7c10902c052c8ab3ae56a0e082a784518017019416f598ad255949dce48fb0

SHA512
11486c360657bcf363cf10efc35bdfea0c0477927274cc492aa9a2e10aabaf2533c555c0dbf4e35046026c6e873a3aa7e48a4f4d56b4a6db56f6d89261321a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9845214.exe
Filesize
359KB

MD5
89a9f2210a41c41e73468243aafe7ce0

SHA1
876015cb4aa5fa59f834557eec21f9e9ff71171c

SHA256
3c2caa36eae05ef361fc9c6eea23ff221c0a0e4f51b56c32eec059cde5de848f

SHA512
fa56caff7e81916deee34218daaec74acab8e94945cb5541b341f954e137725663e77fec26591f8ec705bff405f62f085d9e7adb783d1163bf0458e587606404

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1633986.exe
Filesize
32KB

MD5
254fa0abe1f76f20e10a1dc009280971

SHA1
ec57a1f39a4fe1c1e09fc4eca62604e51538b517

SHA256
4f2f9163b5811ffe45585cc8731f380f7cae91a97a565f08e5e47454b030646c

SHA512
d33950c3fce6b64057527a90465674ad334ea46f83250c4293b41f0c48479d563be16f063b8446c6af7b6c0528b5869d8793bd75bed8bb4a12f0e352d74574dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9681722.exe
Filesize
235KB

MD5
b80c73707e7ee97621ab0bec7cadc344

SHA1
3438fef840e2b7a311d86a10c01595ac5ce91095

SHA256
26da8507f7687477b1bd17eca7d62575eb23c2f2f4cb1823392540fed9bea888

SHA512
dee7011a57ead8cdc26745862d868929fabdddeed3c7ed54b0053d50d9c3f90b328faa9b093e5ef575299958e8afcdb08819bd634af4933b2b4ce93cc0c9c2b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3864613.exe
Filesize
14KB

MD5
3fd53ec59642118b77772907ed0d4655

SHA1
cbdc0d9ba299b8ac2a8858d6067f942f043fa5bb

SHA256
1693df72caf6205a729eb607574ef81a8ad454b2db4a774c8f8b7d949564e082

SHA512
398c4fe14c49665bfebfe1850c4debd77511c1fda87cdfd6659d5dd37b4e1715f02ea87ffc419a9cdc76c07cc421dbe6ea8c1e5615a0f1b8e33ead976b45d304

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0194772.exe
Filesize
227KB

MD5
e5c89f82237e81a362f2fa532e9a8579

SHA1
0336cee2fdb31b0454e93238d5e948c9a36d233f

SHA256
c424989204e88bdb5c0219ed1427cb0ea405f95cb3328994c234ba340f1264ab

SHA512
c5ca1aa06868399fab3a6e4909c29e754341b117d97b877af27647a8bea4e7c734f4b538782cd4766ca02afc2358d1b9141874a01820f7ac1f66665a2c7e4ac1

Download Submit
memory/1620-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2608-48-0x000000000A820000-0x000000000A92A000-memory.dmp

Filesize
1.0MB

Download
memory/2608-45-0x0000000000990000-0x00000000009C0000-memory.dmp

Filesize
192KB

Download
memory/2608-46-0x0000000002D10000-0x0000000002D16000-memory.dmp

Filesize
24KB

Download
memory/2608-47-0x000000000AD30000-0x000000000B348000-memory.dmp

Filesize
6.1MB

Download
memory/2608-49-0x000000000A740000-0x000000000A752000-memory.dmp

Filesize
72KB

Download
memory/2608-50-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

Filesize
240KB

Download
memory/2608-51-0x0000000002C90000-0x0000000002CDC000-memory.dmp

Filesize
304KB

Download
memory/3992-22-0x00007FFF8C9E3000-0x00007FFF8C9E5000-memory.dmp

Filesize
8KB

Download
memory/3992-21-0x0000000000E90000-0x0000000000E9A000-memory.dmp

Filesize
40KB

Download