amadey | 57a34a1caae7f0426b32bc71b73785f820451c97d3c5db368da479183b037629

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe
Size

514KB
MD5

59fb589e90a00ec0ccf1612f0dc2781c
SHA1

017a2f2c15e968b8c5ea36c9a853d5d77919fb82
SHA256

ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39
SHA512

3ab6ec4e8e968c478404f8a926e20d0ba1f1d223374358e048a8ac9b68148937d775679c3c2bd736409e604556a63620e30b4cf386b0f4eb6fe421602dd38f65
SSDEEP

12288:XMrHy90WBtd2hKp4mL7wQpgp0PkOV3q3RcSWjjXeJoGTvq:QypBtwhK1w308o3KSfPqoGbq

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral20/files/0x0008000000023264-19.dat	healer
behavioral20/memory/3380-22-0x0000000000950000-0x000000000095A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3381042.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral20/files/0x000700000002325f-46.dat	family_redline
behavioral20/memory/4684-48-0x00000000004D0000-0x0000000000500000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	b7149162.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

pid	Process
668	v1108511.exe
3500	v5947689.exe
3380	a3381042.exe
4512	b7149162.exe
4280	pdates.exe
4236	c9897645.exe
4684	d6847860.exe
5080	pdates.exe
4720	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3381042.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1108511.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5947689.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9897645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9897645.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9897645.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3380	a3381042.exe
3380	a3381042.exe
4236	c9897645.exe
4236	c9897645.exe
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found
3372	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4236	c9897645.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	a3381042.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4512	b7149162.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 668	452	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	91
PID 452 wrote to memory of 668	452	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	91
PID 452 wrote to memory of 668	452	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	91
PID 668 wrote to memory of 3500	668	v1108511.exe	92
PID 668 wrote to memory of 3500	668	v1108511.exe	92
PID 668 wrote to memory of 3500	668	v1108511.exe	92
PID 3500 wrote to memory of 3380	3500	v5947689.exe	93
PID 3500 wrote to memory of 3380	3500	v5947689.exe	93
PID 3500 wrote to memory of 4512	3500	v5947689.exe	94
PID 3500 wrote to memory of 4512	3500	v5947689.exe	94
PID 3500 wrote to memory of 4512	3500	v5947689.exe	94
PID 4512 wrote to memory of 4280	4512	b7149162.exe	96
PID 4512 wrote to memory of 4280	4512	b7149162.exe	96
PID 4512 wrote to memory of 4280	4512	b7149162.exe	96
PID 668 wrote to memory of 4236	668	v1108511.exe	97
PID 668 wrote to memory of 4236	668	v1108511.exe	97
PID 668 wrote to memory of 4236	668	v1108511.exe	97
PID 4280 wrote to memory of 3768	4280	pdates.exe	98
PID 4280 wrote to memory of 3768	4280	pdates.exe	98
PID 4280 wrote to memory of 3768	4280	pdates.exe	98
PID 4280 wrote to memory of 832	4280	pdates.exe	99
PID 4280 wrote to memory of 832	4280	pdates.exe	99
PID 4280 wrote to memory of 832	4280	pdates.exe	99
PID 832 wrote to memory of 2832	832	cmd.exe	102
PID 832 wrote to memory of 2832	832	cmd.exe	102
PID 832 wrote to memory of 2832	832	cmd.exe	102
PID 832 wrote to memory of 1664	832	cmd.exe	103
PID 832 wrote to memory of 1664	832	cmd.exe	103
PID 832 wrote to memory of 1664	832	cmd.exe	103
PID 832 wrote to memory of 2008	832	cmd.exe	104
PID 832 wrote to memory of 2008	832	cmd.exe	104
PID 832 wrote to memory of 2008	832	cmd.exe	104
PID 832 wrote to memory of 3544	832	cmd.exe	105
PID 832 wrote to memory of 3544	832	cmd.exe	105
PID 832 wrote to memory of 3544	832	cmd.exe	105
PID 832 wrote to memory of 688	832	cmd.exe	106
PID 832 wrote to memory of 688	832	cmd.exe	106
PID 832 wrote to memory of 688	832	cmd.exe	106
PID 832 wrote to memory of 4104	832	cmd.exe	107
PID 832 wrote to memory of 4104	832	cmd.exe	107
PID 832 wrote to memory of 4104	832	cmd.exe	107
PID 452 wrote to memory of 4684	452	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	108
PID 452 wrote to memory of 4684	452	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	108
PID 452 wrote to memory of 4684	452	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	108

C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe
"C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3768
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:688
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:4104
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4236
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe
  2⤵
  - Executes dropped EXE
  PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4940

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe

Filesize
175KB

MD5
76fd4c1f0800f25cb42a8a93ecec5ea5

SHA1
fa04fc79678d76ba6c3ffcc7a2e6c85f001200c3

SHA256
c21aa80c72993dd20b1c80dc2d7b5562203df278b73f9954850d6138287b7dae

SHA512
c6aeeacf4ba2ae35db56636fb9ddfece96a3335ced296ffdb371655363a2479bad34591db4a5c6040d342922330c8b42fef2fdfe5877eccf889f48f5bc377437

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe

Filesize
358KB

MD5
805ee5f2e86db8dcb71c61419b97a7bc

SHA1
bcbb33987fbe58db70d9d4dd221964fceac8f7cb

SHA256
2050fbba411021855c095f57c2f1cbec51cb387c1a9bf17bc259a01d36e114e1

SHA512
255edb5fc9d1e60d49754873e9ca9178e83afcfe6195131006dee12ede6bc964496542af50cc0b0530d503b620494be3511aa350c7dd3ef6b94367c91ea55af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe

Filesize
36KB

MD5
ce200a9ed0fe11e70629c5b6e4928b1b

SHA1
a80222a3e8cbbe8e5ac7a112771e7931b58c5449

SHA256
a6b423fde242a000df9b139abf636287f453baefccc548d8974ffde03e41a0af

SHA512
9b0f9c19dadff0f1a147cd2ce2ced002111ee7c054a2165a1c89f13464f3ab4469ae086e74c4757df5eae4226201d9209408b743f5605f0c4a82134624089130

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe

Filesize
234KB

MD5
38d6de5de6f3d5129329821b43896fbd

SHA1
35865d4f70aae5517fc369240e7269dc2656d2c7

SHA256
a037df5465ec36876bf4352c82df9c9a0d707a76ab8e4cf78ca5d69d51fbc14d

SHA512
fb868def19fa175a1c9ba1df36b43d0a91927d9d76c9a0ddce7157a450d3eb622b5893be5f2ef62bd9a193adc3a60b28a2ee59b51f8e13d51e49d03543c0e629

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe

Filesize
13KB

MD5
e4986bd5697790b80b4718cdfd11beb9

SHA1
2b2a49129467f41c7f8cfd4a43919da6c464f5a3

SHA256
7bad585253f7cf153fccffe324cbe0bb30c1b9394b9d4092067f7c28de4cd1c4

SHA512
6ddbc098e8196df85e8f06d6e46a1b69db18d61a273a9564377b538b025066d29ddad3973e1f0bd4993d6d234e18357814dab9024ce51ec5c80024491a5d9edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe

Filesize
225KB

MD5
ff6a7e0ddd84a5af2afa7670fdc3ba5f

SHA1
8d320bcb6a8b10b9d1621f41c662c449a94377fe

SHA256
65f0d7f92c5a7ed0b29cc13718e3c57529b5d7819576f135229ab355eaf01a27

SHA512
43dd7ce467625b9329c46b4667b699ab2492d29971f2337e2a858ff01daefeb31ac012f31f00d982b9adb49123facce22209cfc5d0161b5c1bddef996b3726ac

Download Submit
memory/3372-41-0x00000000012B0000-0x00000000012C6000-memory.dmp

Filesize
88KB

Download
memory/3380-21-0x00007FF82D943000-0x00007FF82D945000-memory.dmp

Filesize
8KB

Download
memory/3380-22-0x0000000000950000-0x000000000095A000-memory.dmp

Filesize
40KB

Download
memory/4236-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4236-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4684-48-0x00000000004D0000-0x0000000000500000-memory.dmp

Filesize
192KB

Download
memory/4684-49-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Filesize
24KB

Download
memory/4684-51-0x000000000A840000-0x000000000AE58000-memory.dmp

Filesize
6.1MB

Download
memory/4684-52-0x000000000A340000-0x000000000A44A000-memory.dmp

Filesize
1.0MB

Download
memory/4684-53-0x000000000A280000-0x000000000A292000-memory.dmp

Filesize
72KB

Download
memory/4684-54-0x000000000A2E0000-0x000000000A31C000-memory.dmp

Filesize
240KB

Download
memory/4684-55-0x0000000004DA0000-0x0000000004DEC000-memory.dmp

Filesize
304KB

Download