amadey | df50e88cdc283283db23658c52adb6d37e55d4a38da81d63be2c23c190e6d979

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe
Size

514KB
MD5

a5906f38456848691daa7ad90e16383b
SHA1

5eed856722109411b99eb607e5bbe4f4dc1537d8
SHA256

30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a
SHA512

ab8d1c01d7de39c82df4db1f704c0ae70d907c32dbf96bf9482d08ff4de06c7afb0636ba770b67b34af76fa848b6391b3b97a9aa6fa09bd993033b691b2c114c
SSDEEP

12288:QMrZy90Xngq0rDJXt+/xLRjDd2zMpoCGmhF631xFKrn+CjYd:Zy60Pq/xFAwFGNFxFw+4k

Score

10^/10

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral8/files/0x0008000000023412-20.dat	healer
behavioral8/memory/2660-22-0x0000000000680000-0x000000000068A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9367414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9367414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9367414.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a9367414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9367414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9367414.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000700000002340d-43.dat	family_redline
behavioral8/memory/2588-45-0x00000000003B0000-0x00000000003E0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	b4433481.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 10 IoCs

pid	Process
4192	v3609919.exe
4380	v0894618.exe
2660	a9367414.exe
1876	b4433481.exe
5088	pdates.exe
5020	c5001555.exe
3208	pdates.exe
2588	d0447810.exe
2608	pdates.exe
4572	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9367414.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3609919.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0894618.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5001555.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5001555.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5001555.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2660	a9367414.exe
2660	a9367414.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	a9367414.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4192	4884	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe	84
PID 4884 wrote to memory of 4192	4884	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe	84
PID 4884 wrote to memory of 4192	4884	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe	84
PID 4192 wrote to memory of 4380	4192	v3609919.exe	85
PID 4192 wrote to memory of 4380	4192	v3609919.exe	85
PID 4192 wrote to memory of 4380	4192	v3609919.exe	85
PID 4380 wrote to memory of 2660	4380	v0894618.exe	87
PID 4380 wrote to memory of 2660	4380	v0894618.exe	87
PID 4380 wrote to memory of 1876	4380	v0894618.exe	90
PID 4380 wrote to memory of 1876	4380	v0894618.exe	90
PID 4380 wrote to memory of 1876	4380	v0894618.exe	90
PID 1876 wrote to memory of 5088	1876	b4433481.exe	91
PID 1876 wrote to memory of 5088	1876	b4433481.exe	91
PID 1876 wrote to memory of 5088	1876	b4433481.exe	91
PID 4192 wrote to memory of 5020	4192	v3609919.exe	92
PID 4192 wrote to memory of 5020	4192	v3609919.exe	92
PID 4192 wrote to memory of 5020	4192	v3609919.exe	92
PID 5088 wrote to memory of 4360	5088	pdates.exe	93
PID 5088 wrote to memory of 4360	5088	pdates.exe	93
PID 5088 wrote to memory of 4360	5088	pdates.exe	93
PID 5088 wrote to memory of 2092	5088	pdates.exe	95
PID 5088 wrote to memory of 2092	5088	pdates.exe	95
PID 5088 wrote to memory of 2092	5088	pdates.exe	95
PID 2092 wrote to memory of 2652	2092	cmd.exe	97
PID 2092 wrote to memory of 2652	2092	cmd.exe	97
PID 2092 wrote to memory of 2652	2092	cmd.exe	97
PID 2092 wrote to memory of 1404	2092	cmd.exe	98
PID 2092 wrote to memory of 1404	2092	cmd.exe	98
PID 2092 wrote to memory of 1404	2092	cmd.exe	98
PID 2092 wrote to memory of 3252	2092	cmd.exe	99
PID 2092 wrote to memory of 3252	2092	cmd.exe	99
PID 2092 wrote to memory of 3252	2092	cmd.exe	99
PID 2092 wrote to memory of 4136	2092	cmd.exe	100
PID 2092 wrote to memory of 4136	2092	cmd.exe	100
PID 2092 wrote to memory of 4136	2092	cmd.exe	100
PID 2092 wrote to memory of 2504	2092	cmd.exe	101
PID 2092 wrote to memory of 2504	2092	cmd.exe	101
PID 2092 wrote to memory of 2504	2092	cmd.exe	101
PID 2092 wrote to memory of 3340	2092	cmd.exe	102
PID 2092 wrote to memory of 3340	2092	cmd.exe	102
PID 2092 wrote to memory of 3340	2092	cmd.exe	102
PID 4884 wrote to memory of 2588	4884	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe	106
PID 4884 wrote to memory of 2588	4884	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe	106
PID 4884 wrote to memory of 2588	4884	30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe	106

C:\Users\Admin\AppData\Local\Temp\30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe
"C:\Users\Admin\AppData\Local\Temp\30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3609919.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3609919.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0894618.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0894618.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9367414.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9367414.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4433481.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4433481.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4360
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:3340
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001555.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001555.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:5020
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0447810.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0447810.exe
  2⤵
  - Executes dropped EXE
  PID:2588

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0447810.exe

Filesize
173KB

MD5
2acc7e0eca74e876fe15968fd10b279f

SHA1
1ae1ab5bc231b65153785e235c967d8f3a991eeb

SHA256
e5b1e991267996348b3e8165a7b5c8f64e5471a6e9e93b320fa568bc32aeb4c0

SHA512
a076fddd05bb7c0d432a67d9b8e0ef027b511eaee129d8e570f5e20f5f1183e1acb6e35d2812047f4ca1539530fd066ef5416290e85047b0c9e29d59790d70d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3609919.exe

Filesize
359KB

MD5
51509d219b0e1c5395babdd64a3f4bd7

SHA1
5ab5e02c8934575730f0859e3c9f6afb41137117

SHA256
d0b47dca6326a02d2774b4f6fb86bfabe0900177b7cab1991fb5cb69fafffa2d

SHA512
66245ec54e6c2d46374658132515ea8579e38d5d650ff9fa30f41f46ee7564216a88dcffe6a6b064312112117647981946e7b4b4b9ba8984555a7069db03ecc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001555.exe

Filesize
35KB

MD5
b0198ef9b43eeb67df0b78fe1384dfb8

SHA1
8b1f10f004e8e76ad4d6863c21d3e19dfc286f05

SHA256
654e0218d8752068b3b8ac0cc139cefbbb88114c3b85841ae560fea6a1e3090e

SHA512
ce2fecbb84cdd6339fc4292ef411f6a7500ad307b84b8b5f58f8a5ac8a9733b4f870fa6cc107fcce1313aa3bb2f2653a8dbe7fa08e1c6e5a178d9e27fb7038f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0894618.exe

Filesize
234KB

MD5
2efe5b8b0ae9eaf208d4b9ffe8224884

SHA1
43b7829006b3e5e82ce8b7d99715edcfe4692bb8

SHA256
f727ea3944553963f5b160dc0d1aef6003df28b825d2e460421f07e3a3829226

SHA512
3aa322c1b6a587f3b480d7b0ea38b3401661727e4e874a084f71a180078a33400b8eb1d51d9480b24e56b7e84612efa902fdd5db31b1175f034b8ed17439abd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9367414.exe

Filesize
11KB

MD5
48fd367a88cdb2ee5a1d99d40ced959e

SHA1
8df5da820dd441a7be594edb686f0c0fa5ea08c8

SHA256
e052a7ccb41484e447d5a213cb3b04b59f11c0c566fa4ed3a3d035962aa41240

SHA512
26e2a559de44f37ccba660b3dddef8438f71c659b05f49c692221708afe1f0a8c81b8d828d8b3d67da53b176175ba9f4591dfd1e0e9aa74a66ccb2811d8adcdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4433481.exe

Filesize
224KB

MD5
c6972d6e45ff06793d554d266422c551

SHA1
87891786fe8bfccded55428b91f0dd92d65c3604

SHA256
0e920bba4e991813234708263a8de6d75bc4bf1615aa84c211b480b0f3d84796

SHA512
033ea9cce2084387d12f51b25161da05c0521383b9623d485730abd2f7e868a0a17406068a17e190df17bf1698314dcaefc46f72fc25bf5d9cac49b19c341746

Download Submit
memory/2588-48-0x000000000A360000-0x000000000A46A000-memory.dmp

Filesize
1.0MB

Download
memory/2588-45-0x00000000003B0000-0x00000000003E0000-memory.dmp

Filesize
192KB

Download
memory/2588-46-0x00000000025B0000-0x00000000025B6000-memory.dmp

Filesize
24KB

Download
memory/2588-47-0x000000000A870000-0x000000000AE88000-memory.dmp

Filesize
6.1MB

Download
memory/2588-49-0x000000000A2A0000-0x000000000A2B2000-memory.dmp

Filesize
72KB

Download
memory/2588-50-0x000000000A300000-0x000000000A33C000-memory.dmp

Filesize
240KB

Download
memory/2588-51-0x0000000002530000-0x000000000257C000-memory.dmp

Filesize
304KB

Download
memory/2660-22-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/2660-21-0x00007FFDEB533000-0x00007FFDEB535000-memory.dmp

Filesize
8KB

Download
memory/5020-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download