amadey | 62bdf7c8bc61b7d1bd73ccc8685e220edf33b9a5ba1ab3c192a61c31da9b1a9f

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe
Size

514KB
MD5

66f54ffe709bab07100af569ead4119a
SHA1

1cb8a599e4e929dd6a1b918a8b67a8febc8a0750
SHA256

349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666
SHA512

6636bf298a646868b20110f1b4c43ab4e3f68a3d4cc667edf2baf1c757e320164a65e749eef096ae046344bbb9942e2f1b73ac7835c87a28e298d7307612d5fa
SSDEEP

12288:6Mrby90AubVaRq5diuRCH+QykIb80gtid1ZUcTL/:JyjZuRCH+Qy73gtiD7

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral5/files/0x0008000000023480-20.dat	healer
behavioral5/memory/2820-22-0x0000000000F20000-0x0000000000F2A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4079614.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a4079614.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4079614.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4079614.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4079614.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4079614.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x000700000002347a-43.dat	family_redline
behavioral5/memory/4956-45-0x00000000006E0000-0x0000000000710000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	b2744914.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 10 IoCs

pid	Process
1080	v5387046.exe
2596	v7754411.exe
2820	a4079614.exe
3284	b2744914.exe
2308	pdates.exe
4768	c7542534.exe
5016	pdates.exe
4956	d4141905.exe
2028	pdates.exe
868	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4079614.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5387046.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7754411.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7542534.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7542534.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7542534.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	a4079614.exe
2820	a4079614.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	a4079614.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1080	2800	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe	83
PID 2800 wrote to memory of 1080	2800	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe	83
PID 2800 wrote to memory of 1080	2800	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe	83
PID 1080 wrote to memory of 2596	1080	v5387046.exe	84
PID 1080 wrote to memory of 2596	1080	v5387046.exe	84
PID 1080 wrote to memory of 2596	1080	v5387046.exe	84
PID 2596 wrote to memory of 2820	2596	v7754411.exe	85
PID 2596 wrote to memory of 2820	2596	v7754411.exe	85
PID 2596 wrote to memory of 3284	2596	v7754411.exe	93
PID 2596 wrote to memory of 3284	2596	v7754411.exe	93
PID 2596 wrote to memory of 3284	2596	v7754411.exe	93
PID 3284 wrote to memory of 2308	3284	b2744914.exe	94
PID 3284 wrote to memory of 2308	3284	b2744914.exe	94
PID 3284 wrote to memory of 2308	3284	b2744914.exe	94
PID 1080 wrote to memory of 4768	1080	v5387046.exe	95
PID 1080 wrote to memory of 4768	1080	v5387046.exe	95
PID 1080 wrote to memory of 4768	1080	v5387046.exe	95
PID 2308 wrote to memory of 2208	2308	pdates.exe	96
PID 2308 wrote to memory of 2208	2308	pdates.exe	96
PID 2308 wrote to memory of 2208	2308	pdates.exe	96
PID 2308 wrote to memory of 828	2308	pdates.exe	98
PID 2308 wrote to memory of 828	2308	pdates.exe	98
PID 2308 wrote to memory of 828	2308	pdates.exe	98
PID 828 wrote to memory of 748	828	cmd.exe	100
PID 828 wrote to memory of 748	828	cmd.exe	100
PID 828 wrote to memory of 748	828	cmd.exe	100
PID 828 wrote to memory of 2604	828	cmd.exe	101
PID 828 wrote to memory of 2604	828	cmd.exe	101
PID 828 wrote to memory of 2604	828	cmd.exe	101
PID 828 wrote to memory of 1500	828	cmd.exe	102
PID 828 wrote to memory of 1500	828	cmd.exe	102
PID 828 wrote to memory of 1500	828	cmd.exe	102
PID 828 wrote to memory of 2316	828	cmd.exe	103
PID 828 wrote to memory of 2316	828	cmd.exe	103
PID 828 wrote to memory of 2316	828	cmd.exe	103
PID 828 wrote to memory of 4140	828	cmd.exe	104
PID 828 wrote to memory of 4140	828	cmd.exe	104
PID 828 wrote to memory of 4140	828	cmd.exe	104
PID 828 wrote to memory of 4512	828	cmd.exe	105
PID 828 wrote to memory of 4512	828	cmd.exe	105
PID 828 wrote to memory of 4512	828	cmd.exe	105
PID 2800 wrote to memory of 4956	2800	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe	111
PID 2800 wrote to memory of 4956	2800	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe	111
PID 2800 wrote to memory of 4956	2800	349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe	111

C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe
"C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2208
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:4512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4768
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe
  2⤵
  - Executes dropped EXE
  PID:4956

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe

Filesize
173KB

MD5
e340fad4dd399e544a644571b66aca10

SHA1
71d1cbc808265a352ce63bd74a9b25abb12cf5c0

SHA256
dc992ad80deb9bfa48b0ff758d0c52b32549a7652b41f0df9c414139d72f52ae

SHA512
bdd68036e5485aecaf15fa305665eaa9ad68c7f81eb94ec976db10358b7971d7537bd094d1cc10f7f01b25145b3c94c287075bb22df439e7f885360f6bccf74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe

Filesize
359KB

MD5
f5502d1fd0d40c98c45d2ee9da187c62

SHA1
e3b3c127ee3eef836c1cdbbd78c856e119dc6835

SHA256
18ddce55ed9d55c6768e99919ee48b16a52f74f47d442d21dc356287f48ce580

SHA512
1a9095764b6e160d4d556fe4fa152c4d1e9ce879667afe965db7e456efb864953230ba93d6b94505e23a3cdb2b832f75a28bde2c302490a88e44081a81068401

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe

Filesize
36KB

MD5
e597a3d07e6903050787f1072f10a6dc

SHA1
8ea85d67ed2403911daf281ff95baa0572260184

SHA256
7238a50b59ebc1fe90886a612a4656b6ea163404857953fea445fd6673465d44

SHA512
e043e951feaf6fee2fdf42664cb18d378930ad863e602f38b44d21a69b71cad3f4a3bf236570eb5a4dafeafd89c6c5b7e49316365c51c703875deca5c50c69ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe

Filesize
234KB

MD5
32a9d9cb6eaa27a01e00d1e599e4d8eb

SHA1
4deaac4ec28b0b16e62ad3351a8ef94e2262aeb2

SHA256
9ce254fdb9957862f3772db8ecdd9de9ad812a445429b17e67966d3b0df75bdf

SHA512
82da9b57e04db90518285bcd5a048bedb55a00060221cbb9472ac6e70d6adc49edfbdcc495bc7a5eb8f085cd72d8ab91ca474b3966eb5457062791e3e94e5b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe

Filesize
12KB

MD5
df7d3ca01950e6fc969bb6a665bfa3da

SHA1
47edb3679e09562e022bcf0e53daa9a6a1632e87

SHA256
e84f4b87c97d69e76f2cb2265722ef05ee17c09e4a4d93f4653ec1db103b55de

SHA512
e1b5edadca2aec99c0f18339ae101b303d7e5ad0946e127b146ce8439ffd02418617b0814923a0993f444495829ca462a4968826511b9312a74e9ec55342f732

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe

Filesize
225KB

MD5
640540ca721f898b80351f6728cdcc76

SHA1
3b98fae8f749c66250aa45ccc340bdf1c371e034

SHA256
02bfcdf7cef126b21bf5180d103a2c9e9780a56be4098455e5f1dff9244c3bf1

SHA512
989c2deaf1da5cbd98747c218a1752f1e939cc4515e8755edf403f4fef8a235eb76e28f300e27969592e4f5811360843c13c8a9b00776cdbf82cd8d4f222c67c

Download Submit
memory/2820-21-0x00007FFD9E1F3000-0x00007FFD9E1F5000-memory.dmp

Filesize
8KB

Download
memory/2820-22-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Filesize
40KB

Download
memory/4768-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4956-45-0x00000000006E0000-0x0000000000710000-memory.dmp

Filesize
192KB

Download
memory/4956-46-0x0000000005000000-0x0000000005006000-memory.dmp

Filesize
24KB

Download
memory/4956-47-0x000000000AA40000-0x000000000B058000-memory.dmp

Filesize
6.1MB

Download
memory/4956-48-0x000000000A550000-0x000000000A65A000-memory.dmp

Filesize
1.0MB

Download
memory/4956-49-0x000000000A490000-0x000000000A4A2000-memory.dmp

Filesize
72KB

Download
memory/4956-50-0x000000000A4F0000-0x000000000A52C000-memory.dmp

Filesize
240KB

Download
memory/4956-51-0x0000000004A00000-0x0000000004A4C000-memory.dmp

Filesize
304KB

Download