amadey | 292b6242a8248f18030260bd0c373ec14be1362f7f7494bca33e42fcc97580b0

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe
Size

515KB
MD5

c138f8ea750795895b64bd99b1fcd8da
SHA1

b815664dadb4d1ff91862b2af099b84b230e1aeb
SHA256

6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625
SHA512

d6056b12443f399230bc7a469f11ae18fbe83915ac64966d4650ebeade16f6ae5033a7dc66415bbdc4e5f740a7568b1ee18dafb4ded14bee85b3c40e3350a6ee
SSDEEP

12288:kMr2y90vRliN0WXndhbap8sQM9oVgswQWT3l:Kygi0andh08sQM9oVbol

Score

10^/10

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

news

77.91.68.68:19071

Attributes

auth_value
99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral13/files/0x0008000000023441-19.dat	healer
behavioral13/memory/4372-21-0x0000000000FF0000-0x0000000000FFA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0144100.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral13/files/0x000700000002343c-44.dat	family_redline
behavioral13/memory/2200-46-0x0000000000E60000-0x0000000000E90000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	b6446034.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

pid	Process
2488	v0977630.exe
1056	v7545579.exe
4372	a0144100.exe
1964	b6446034.exe
2976	danke.exe
808	c4034930.exe
1400	danke.exe
2200	d5914663.exe
3944	danke.exe
3472	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0144100.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0977630.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7545579.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4034930.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4034930.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4034930.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4372	a0144100.exe
4372	a0144100.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	a0144100.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2488	2432	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	83
PID 2432 wrote to memory of 2488	2432	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	83
PID 2432 wrote to memory of 2488	2432	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	83
PID 2488 wrote to memory of 1056	2488	v0977630.exe	85
PID 2488 wrote to memory of 1056	2488	v0977630.exe	85
PID 2488 wrote to memory of 1056	2488	v0977630.exe	85
PID 1056 wrote to memory of 4372	1056	v7545579.exe	86
PID 1056 wrote to memory of 4372	1056	v7545579.exe	86
PID 1056 wrote to memory of 1964	1056	v7545579.exe	87
PID 1056 wrote to memory of 1964	1056	v7545579.exe	87
PID 1056 wrote to memory of 1964	1056	v7545579.exe	87
PID 1964 wrote to memory of 2976	1964	b6446034.exe	88
PID 1964 wrote to memory of 2976	1964	b6446034.exe	88
PID 1964 wrote to memory of 2976	1964	b6446034.exe	88
PID 2488 wrote to memory of 808	2488	v0977630.exe	89
PID 2488 wrote to memory of 808	2488	v0977630.exe	89
PID 2488 wrote to memory of 808	2488	v0977630.exe	89
PID 2976 wrote to memory of 3620	2976	danke.exe	90
PID 2976 wrote to memory of 3620	2976	danke.exe	90
PID 2976 wrote to memory of 3620	2976	danke.exe	90
PID 2976 wrote to memory of 760	2976	danke.exe	92
PID 2976 wrote to memory of 760	2976	danke.exe	92
PID 2976 wrote to memory of 760	2976	danke.exe	92
PID 760 wrote to memory of 2472	760	cmd.exe	94
PID 760 wrote to memory of 2472	760	cmd.exe	94
PID 760 wrote to memory of 2472	760	cmd.exe	94
PID 760 wrote to memory of 1176	760	cmd.exe	95
PID 760 wrote to memory of 1176	760	cmd.exe	95
PID 760 wrote to memory of 1176	760	cmd.exe	95
PID 760 wrote to memory of 4472	760	cmd.exe	96
PID 760 wrote to memory of 4472	760	cmd.exe	96
PID 760 wrote to memory of 4472	760	cmd.exe	96
PID 760 wrote to memory of 5012	760	cmd.exe	97
PID 760 wrote to memory of 5012	760	cmd.exe	97
PID 760 wrote to memory of 5012	760	cmd.exe	97
PID 760 wrote to memory of 4624	760	cmd.exe	98
PID 760 wrote to memory of 4624	760	cmd.exe	98
PID 760 wrote to memory of 4624	760	cmd.exe	98
PID 760 wrote to memory of 3632	760	cmd.exe	99
PID 760 wrote to memory of 3632	760	cmd.exe	99
PID 760 wrote to memory of 3632	760	cmd.exe	99
PID 2432 wrote to memory of 2200	2432	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	103
PID 2432 wrote to memory of 2200	2432	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	103
PID 2432 wrote to memory of 2200	2432	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	103

C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe
"C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3620
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:3632
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:808
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe
  2⤵
  - Executes dropped EXE
  PID:2200

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe

Filesize
173KB

MD5
89351eab443679ae0585e5d0c1515274

SHA1
7828c9bcd09ef64234b58c41e2ff15ffd08db306

SHA256
123f04ade0250cb30a448146ce4b74429ef38cd2811dce57126ef47db84f5bf6

SHA512
5983d02df411cf86d49e5a90b1f0d56200b3e31c187d3c36002f84657646950d1377f1fad039cc57df4757c524798d6d12c9df4633537438a55a75563f8ead8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe

Filesize
359KB

MD5
9b497b6b1e005de6a787c0bd9d1272fa

SHA1
10e84675f9eff72d4a99c1bf6110797dc5c69f0d

SHA256
13bbb6f14ebbd1a2b4a29fd6996f6ac546b555d0f8b264c0ad971466e4633ebe

SHA512
d8569d11f1c047baf36182282e32c0184bca286b7c40d2a1633fd876b635810d492ca4818c343d3b79e25dbda7dbbc38dc76b3bb40900e9be5b1b784dd188911

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe

Filesize
34KB

MD5
203da1f790ddfa54124b731334a820df

SHA1
4b8478a077b4053ff9f69705f888aaeecefc14dc

SHA256
47a99c2f3c457d009db77e5985d95a96dd4be2ab35d64c53516a196e5ed35d7f

SHA512
a631197e543edbeae0d256676513a2371f1ff539f26c102894d270bad9541624c0a15cac69e209d132b78af9e08e334a1dedcc660d7afcdd614793bd5babc989

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe

Filesize
234KB

MD5
86958943dd057021da6c771b6453b53a

SHA1
2738978ca7570c32c278b1d4010f39ac69e9fa8b

SHA256
3f700054b2901755279893023f905c92bbd13e4797f45cbcc0c3711aad4ffd78

SHA512
c4ef49c0462b4b9bce612d8f0c4f6be172159ebd58eb82c53963773a712fc297cd7cf67537a01040dc7c643eeae3c16fa0a3a5b36e0adecdfd790bc54054b94a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe

Filesize
12KB

MD5
3dee36b75657e42f643591ceac6af15a

SHA1
4c2de5072a1ca02bbc13d99e5be250807b3563fd

SHA256
d7a2203f9712448ce305e60cfdfdc8faa013fb121417a2ee41c676e49c3c87d9

SHA512
bcf1886345d8eccd330fa569f15b52be13b8f4a813a9d722c74b52cdf4c2c2d9611985fab51224f298f9554feeb24d3bfc92def9256258e1675567cdf96e928e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe

Filesize
229KB

MD5
1dc772e6085ff2515e39f3c9f98471ef

SHA1
6fb28af6f8bc753525323797c71a3598872a345e

SHA256
f5f062d5f2c9563dbaef81eda64958605b77ba1becbe272f1e8a1bff78e76cfe

SHA512
76ec2f514ba9290fc88ba22aec3bdfb0c93eda47bb038db0a37a05ff72fe62e33e08e8de0f1470399299397e894f6f3209e212690eaa076cf675d41aaa69f873

Download Submit
memory/808-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/808-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2200-48-0x000000000B290000-0x000000000B8A8000-memory.dmp

Filesize
6.1MB

Download
memory/2200-46-0x0000000000E60000-0x0000000000E90000-memory.dmp

Filesize
192KB

Download
memory/2200-47-0x0000000003170000-0x0000000003176000-memory.dmp

Filesize
24KB

Download
memory/2200-49-0x000000000AE10000-0x000000000AF1A000-memory.dmp

Filesize
1.0MB

Download
memory/2200-50-0x000000000AD50000-0x000000000AD62000-memory.dmp

Filesize
72KB

Download
memory/2200-51-0x000000000ADB0000-0x000000000ADEC000-memory.dmp

Filesize
240KB

Download
memory/2200-52-0x00000000030D0000-0x000000000311C000-memory.dmp

Filesize
304KB

Download
memory/4372-22-0x00007FFAE0BE3000-0x00007FFAE0BE5000-memory.dmp

Filesize
8KB

Download
memory/4372-21-0x0000000000FF0000-0x0000000000FFA000-memory.dmp

Filesize
40KB

Download