amadey | 7575b6a7ca1e6aeecfc397511f1b32b4a78d90e4766e4942510517290d09a617

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
Size

515KB
MD5

d9913d9f643c9aaedccb2c7e055ed031
SHA1

f9812f588b1a16b6d292bd553695404858dae7b6
SHA256

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab
SHA512

51ce523840bec8f71baaab82b7841abbb825276280142cb67a84276558bb640a5fee511c865862868cd1f15ecddaeaf6e4c0feacf826751d37229577384dae00
SSDEEP

12288:KMrxy907uK8EElOOinxnMP+vIPGBEARwMrXu72wuL:TyquPo/nZ4LPGBEAdrXu7bo

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023408-19.dat	healer
behavioral2/memory/2756-21-0x0000000000890000-0x000000000089A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8390704.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023403-42.dat	family_redline
behavioral2/memory/736-44-0x0000000000290000-0x00000000002C0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	danke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	b7079007.exe

Executes dropped EXE 9 IoCs

pid	Process
3764	v7044475.exe
3564	v4811916.exe
2756	a8390704.exe
636	b7079007.exe
3952	danke.exe
3776	c6028004.exe
736	d6888003.exe
2388	danke.exe
4464	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8390704.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7044475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4811916.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2756	a8390704.exe
2756	a8390704.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	a8390704.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3764	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	82
PID 984 wrote to memory of 3764	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	82
PID 984 wrote to memory of 3764	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	82
PID 3764 wrote to memory of 3564	3764	v7044475.exe	84
PID 3764 wrote to memory of 3564	3764	v7044475.exe	84
PID 3764 wrote to memory of 3564	3764	v7044475.exe	84
PID 3564 wrote to memory of 2756	3564	v4811916.exe	85
PID 3564 wrote to memory of 2756	3564	v4811916.exe	85
PID 3564 wrote to memory of 636	3564	v4811916.exe	88
PID 3564 wrote to memory of 636	3564	v4811916.exe	88
PID 3564 wrote to memory of 636	3564	v4811916.exe	88
PID 636 wrote to memory of 3952	636	b7079007.exe	89
PID 636 wrote to memory of 3952	636	b7079007.exe	89
PID 636 wrote to memory of 3952	636	b7079007.exe	89
PID 3764 wrote to memory of 3776	3764	v7044475.exe	90
PID 3764 wrote to memory of 3776	3764	v7044475.exe	90
PID 3764 wrote to memory of 3776	3764	v7044475.exe	90
PID 984 wrote to memory of 736	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	91
PID 984 wrote to memory of 736	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	91
PID 984 wrote to memory of 736	984	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	91
PID 3952 wrote to memory of 2152	3952	danke.exe	92
PID 3952 wrote to memory of 2152	3952	danke.exe	92
PID 3952 wrote to memory of 2152	3952	danke.exe	92
PID 3952 wrote to memory of 2092	3952	danke.exe	94
PID 3952 wrote to memory of 2092	3952	danke.exe	94
PID 3952 wrote to memory of 2092	3952	danke.exe	94
PID 2092 wrote to memory of 4608	2092	cmd.exe	96
PID 2092 wrote to memory of 4608	2092	cmd.exe	96
PID 2092 wrote to memory of 4608	2092	cmd.exe	96
PID 2092 wrote to memory of 2972	2092	cmd.exe	97
PID 2092 wrote to memory of 2972	2092	cmd.exe	97
PID 2092 wrote to memory of 2972	2092	cmd.exe	97
PID 2092 wrote to memory of 4136	2092	cmd.exe	98
PID 2092 wrote to memory of 4136	2092	cmd.exe	98
PID 2092 wrote to memory of 4136	2092	cmd.exe	98
PID 2092 wrote to memory of 1172	2092	cmd.exe	99
PID 2092 wrote to memory of 1172	2092	cmd.exe	99
PID 2092 wrote to memory of 1172	2092	cmd.exe	99
PID 2092 wrote to memory of 1896	2092	cmd.exe	100
PID 2092 wrote to memory of 1896	2092	cmd.exe	100
PID 2092 wrote to memory of 1896	2092	cmd.exe	100
PID 2092 wrote to memory of 3580	2092	cmd.exe	101
PID 2092 wrote to memory of 3580	2092	cmd.exe	101
PID 2092 wrote to memory of 3580	2092	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
"C:\Users\Admin\AppData\Local\Temp\1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2152
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:3580
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3776
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
  2⤵
  - Executes dropped EXE
  PID:736

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe

Filesize
173KB

MD5
dc51fd06c4c11e328b3bbebe4a5e3b1a

SHA1
8801e69f81e62172416c44fbb0e7ad3f7c7da060

SHA256
2fca2e995466e6580daffec9deb1e14968ee0d18dd6bd67a43726ff1ffcab97e

SHA512
0235cce4966e4220b0f7e5835629f186247048bc124a64224b5836ed3b69dbd2b26ef00e924d9c788d5b131a93d5b1b46c64af494cc7a9dc678922634910816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe

Filesize
359KB

MD5
2aec1b9778e7ab934eb8f482cd5348c8

SHA1
4cbe9b809e9078ccb733078b6cf0c26c8332db01

SHA256
35b0a82941fcf9428dec41ecae6a486fbeaae5972700d2b8012911bc3db032d9

SHA512
d4608974600ed0854341eb733a406f319c2471e2d3b85c7a19b56806244663f90f6bea390896b6c34fae95aa0d90b2e47454427a43e5d00feaa18857f3d95140

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe

Filesize
32KB

MD5
b4e06a9b1b9ee7ab12f4e6d095116573

SHA1
65345bf69da2a27bd02e357766eabf0662b9d20d

SHA256
5f959a2842a4a6fe579e5d8ce1295c060597b82bc58a3e70e5bd329c9c3edbf8

SHA512
cc660fd5ad640cf41f548355022b4f0f087c8866c7cdc637948bf20cccf9846d961082f6a3cef10b8bb439f80b2658ffd7a7a1f310575e688455786c0e315949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe

Filesize
234KB

MD5
7f521795c493f40b5675b6a506a5b3de

SHA1
6f2bcf31a86152fb0ae5e4c8ff216d4020014fb8

SHA256
75c3f68ed606787effbe57ad37d444610af3400509491497dbcc28b58a8b16f3

SHA512
7e54657247c50044816573dc242503d4b2275924813b4bccb866710089b0b96b7292fa744f42e4aa329498c264f57bbc3d0675122ebccc6298d811b87875b469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe

Filesize
14KB

MD5
cf00d02aceeb4224969efc47fe25c140

SHA1
dfabd48292f691f2784e682cea4178d408c525e6

SHA256
592a3bcb0985f4b4d4a3e77a2f2aa52818c1f88c529c74aac70b0d8af1daf011

SHA512
676cc3aeb9c9683c4f243b04ee86894e9f74b526212331f30f7c15595b16a238ca27144e84161d904964ded6f7fbd88a109b7ad35727b0b2f670f8f30847ff80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe

Filesize
227KB

MD5
ac6a3d2e01d97ef4adffa6b0c5e5efeb

SHA1
d5bb7aaad36ed2176246608875c6c46617a0e731

SHA256
12ff593e0cf7a829535ae891138dc92d3c3487fa831b1c8c122c3c726e7e91a9

SHA512
7f7165c35f53ec935db001541ad19769b45ab71011d2271af026dddff7886f1ba704e866efa295b57c9079bfad75be031ea4676c24fc783a1ef0d1e63ab1caec

Download Submit
memory/736-47-0x0000000004E60000-0x0000000004F6A000-memory.dmp

Filesize
1.0MB

Download
memory/736-44-0x0000000000290000-0x00000000002C0000-memory.dmp

Filesize
192KB

Download
memory/736-45-0x0000000002620000-0x0000000002626000-memory.dmp

Filesize
24KB

Download
memory/736-46-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/736-48-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/736-49-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

Filesize
240KB

Download
memory/736-50-0x0000000004E10000-0x0000000004E5C000-memory.dmp

Filesize
304KB

Download
memory/2756-21-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/2756-22-0x00007FFC65B03000-0x00007FFC65B05000-memory.dmp

Filesize
8KB

Download
memory/3776-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download