amadey | 7575b6a7ca1e6aeecfc397511f1b32b4a78d90e4766e4942510517290d09a617

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
Size

515KB
MD5

d9913d9f643c9aaedccb2c7e055ed031
SHA1

f9812f588b1a16b6d292bd553695404858dae7b6
SHA256

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab
SHA512

51ce523840bec8f71baaab82b7841abbb825276280142cb67a84276558bb640a5fee511c865862868cd1f15ecddaeaf6e4c0feacf826751d37229577384dae00
SSDEEP

12288:KMrxy907uK8EElOOinxnMP+vIPGBEARwMrXu72wuL:TyquPo/nZ4LPGBEAdrXu7bo

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe	healer
behavioral2/memory/2756-21-0x0000000000890000-0x000000000089A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a8390704.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8390704.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe	family_redline
behavioral2/memory/736-44-0x0000000000290000-0x00000000002C0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

danke.exeb7079007.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	danke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	b7079007.exe

Executes dropped EXE 9 IoCs

Processes:

v7044475.exev4811916.exea8390704.exeb7079007.exedanke.exec6028004.exed6888003.exedanke.exedanke.exe

pid process

3764 v7044475.exe
3564 v4811916.exe
2756 a8390704.exe
636 b7079007.exe
3952 danke.exe
3776 c6028004.exe
736 d6888003.exe
2388 danke.exe
4464 danke.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a8390704.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a8390704.exe

pid	process
3764	v7044475.exe
3564	v4811916.exe
2756	a8390704.exe
636	b7079007.exe
3952	danke.exe
3776	c6028004.exe
736	d6888003.exe
2388	danke.exe
4464	danke.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8390704.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v7044475.exev4811916.exe1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7044475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4811916.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c6028004.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2152 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a8390704.exe

pid process

2756 a8390704.exe
2756 a8390704.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a8390704.exe

description pid process

Token: SeDebugPrivilege 2756 a8390704.exe

pid	process
2152	schtasks.exe

pid	process
2756	a8390704.exe
2756	a8390704.exe

description	pid	process
Token: SeDebugPrivilege	2756	a8390704.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exev7044475.exev4811916.exeb7079007.exedanke.execmd.exe

description	pid	process	target process
PID 984 wrote to memory of 3764	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	v7044475.exe
PID 984 wrote to memory of 3764	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	v7044475.exe
PID 984 wrote to memory of 3764	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	v7044475.exe
PID 3764 wrote to memory of 3564	3764	v7044475.exe	v4811916.exe
PID 3764 wrote to memory of 3564	3764	v7044475.exe	v4811916.exe
PID 3764 wrote to memory of 3564	3764	v7044475.exe	v4811916.exe
PID 3564 wrote to memory of 2756	3564	v4811916.exe	a8390704.exe
PID 3564 wrote to memory of 2756	3564	v4811916.exe	a8390704.exe
PID 3564 wrote to memory of 636	3564	v4811916.exe	b7079007.exe
PID 3564 wrote to memory of 636	3564	v4811916.exe	b7079007.exe
PID 3564 wrote to memory of 636	3564	v4811916.exe	b7079007.exe
PID 636 wrote to memory of 3952	636	b7079007.exe	danke.exe
PID 636 wrote to memory of 3952	636	b7079007.exe	danke.exe
PID 636 wrote to memory of 3952	636	b7079007.exe	danke.exe
PID 3764 wrote to memory of 3776	3764	v7044475.exe	c6028004.exe
PID 3764 wrote to memory of 3776	3764	v7044475.exe	c6028004.exe
PID 3764 wrote to memory of 3776	3764	v7044475.exe	c6028004.exe
PID 984 wrote to memory of 736	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	d6888003.exe
PID 984 wrote to memory of 736	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	d6888003.exe
PID 984 wrote to memory of 736	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	d6888003.exe
PID 3952 wrote to memory of 2152	3952	danke.exe	schtasks.exe
PID 3952 wrote to memory of 2152	3952	danke.exe	schtasks.exe
PID 3952 wrote to memory of 2152	3952	danke.exe	schtasks.exe
PID 3952 wrote to memory of 2092	3952	danke.exe	cmd.exe
PID 3952 wrote to memory of 2092	3952	danke.exe	cmd.exe
PID 3952 wrote to memory of 2092	3952	danke.exe	cmd.exe
PID 2092 wrote to memory of 4608	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 4608	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 4608	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 2972	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 2972	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 2972	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 4136	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 4136	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 4136	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 1172	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 1172	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 1172	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 1896	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 1896	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 1896	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 3580	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 3580	2092	cmd.exe	cacls.exe
PID 2092 wrote to memory of 3580	2092	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
"C:\Users\Admin\AppData\Local\Temp\1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:984

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3764

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
6⤵
- Creates scheduled task(s)
PID:2152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4608

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:N"
7⤵
PID:2972

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:R" /E
7⤵
PID:4136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1172

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:N"
7⤵
PID:1896

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:R" /E
7⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3776

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
2⤵
- Executes dropped EXE
PID:736

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
Filesize
173KB

MD5
dc51fd06c4c11e328b3bbebe4a5e3b1a

SHA1
8801e69f81e62172416c44fbb0e7ad3f7c7da060

SHA256
2fca2e995466e6580daffec9deb1e14968ee0d18dd6bd67a43726ff1ffcab97e

SHA512
0235cce4966e4220b0f7e5835629f186247048bc124a64224b5836ed3b69dbd2b26ef00e924d9c788d5b131a93d5b1b46c64af494cc7a9dc678922634910816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
Filesize
359KB

MD5
2aec1b9778e7ab934eb8f482cd5348c8

SHA1
4cbe9b809e9078ccb733078b6cf0c26c8332db01

SHA256
35b0a82941fcf9428dec41ecae6a486fbeaae5972700d2b8012911bc3db032d9

SHA512
d4608974600ed0854341eb733a406f319c2471e2d3b85c7a19b56806244663f90f6bea390896b6c34fae95aa0d90b2e47454427a43e5d00feaa18857f3d95140

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
Filesize
32KB

MD5
b4e06a9b1b9ee7ab12f4e6d095116573

SHA1
65345bf69da2a27bd02e357766eabf0662b9d20d

SHA256
5f959a2842a4a6fe579e5d8ce1295c060597b82bc58a3e70e5bd329c9c3edbf8

SHA512
cc660fd5ad640cf41f548355022b4f0f087c8866c7cdc637948bf20cccf9846d961082f6a3cef10b8bb439f80b2658ffd7a7a1f310575e688455786c0e315949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
Filesize
234KB

MD5
7f521795c493f40b5675b6a506a5b3de

SHA1
6f2bcf31a86152fb0ae5e4c8ff216d4020014fb8

SHA256
75c3f68ed606787effbe57ad37d444610af3400509491497dbcc28b58a8b16f3

SHA512
7e54657247c50044816573dc242503d4b2275924813b4bccb866710089b0b96b7292fa744f42e4aa329498c264f57bbc3d0675122ebccc6298d811b87875b469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
Filesize
14KB

MD5
cf00d02aceeb4224969efc47fe25c140

SHA1
dfabd48292f691f2784e682cea4178d408c525e6

SHA256
592a3bcb0985f4b4d4a3e77a2f2aa52818c1f88c529c74aac70b0d8af1daf011

SHA512
676cc3aeb9c9683c4f243b04ee86894e9f74b526212331f30f7c15595b16a238ca27144e84161d904964ded6f7fbd88a109b7ad35727b0b2f670f8f30847ff80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
Filesize
227KB

MD5
ac6a3d2e01d97ef4adffa6b0c5e5efeb

SHA1
d5bb7aaad36ed2176246608875c6c46617a0e731

SHA256
12ff593e0cf7a829535ae891138dc92d3c3487fa831b1c8c122c3c726e7e91a9

SHA512
7f7165c35f53ec935db001541ad19769b45ab71011d2271af026dddff7886f1ba704e866efa295b57c9079bfad75be031ea4676c24fc783a1ef0d1e63ab1caec

Download Submit
memory/736-47-0x0000000004E60000-0x0000000004F6A000-memory.dmp

Filesize
1.0MB

Download
memory/736-44-0x0000000000290000-0x00000000002C0000-memory.dmp

Filesize
192KB

Download
memory/736-45-0x0000000002620000-0x0000000002626000-memory.dmp

Filesize
24KB

Download
memory/736-46-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/736-48-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/736-49-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

Filesize
240KB

Download
memory/736-50-0x0000000004E10000-0x0000000004E5C000-memory.dmp

Filesize
304KB

Download
memory/2756-21-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/2756-22-0x00007FFC65B03000-0x00007FFC65B05000-memory.dmp

Filesize
8KB

Download
memory/3776-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download