amadey | f6a395732f5dfe45c1b53e1a544f31826d5f310499de2170e9064ac9605a913e

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe
Size

514KB
MD5

21d5e26d80e17d90723eafe2e81f0380
SHA1

8cf32bcc5746e7097e8457cb8072e6af5c3cc078
SHA256

03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25
SHA512

265217e57e46b8e9df248deda746bb21b96a1a07b5feb70f5b117c3495f106fabc1e68db9f79097532065a4f6466eee397b8f7062f9d6b452e7395394371822c
SSDEEP

12288:UMrvy90+M2xY8uiV4qLx52eJe9d/Z3Of0c:TysoVp3zov/Z3Of3

Score

10^/10

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8974094.exe	healer
behavioral1/memory/2564-21-0x0000000000330000-0x000000000033A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a8974094.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8974094.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8974094.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8974094.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8974094.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8974094.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8974094.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7161703.exe	family_redline
behavioral1/memory/5112-44-0x0000000000D30000-0x0000000000D60000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4798339.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b4798339.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v5599934.exev9509668.exea8974094.exeb4798339.exepdates.exec4011866.exed7161703.exepdates.exepdates.exe

pid process

4468 v5599934.exe
2484 v9509668.exe
2564 a8974094.exe
2852 b4798339.exe
4796 pdates.exe
3496 c4011866.exe
5112 d7161703.exe
3096 pdates.exe
2256 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a8974094.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a8974094.exe

pid	process
4468	v5599934.exe
2484	v9509668.exe
2564	a8974094.exe
2852	b4798339.exe
4796	pdates.exe
3496	c4011866.exe
5112	d7161703.exe
3096	pdates.exe
2256	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8974094.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v9509668.exe03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exev5599934.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9509668.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5599934.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c4011866.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4011866.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4011866.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4011866.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4560 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a8974094.exe

pid process

2564 a8974094.exe
2564 a8974094.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a8974094.exe

description pid process

Token: SeDebugPrivilege 2564 a8974094.exe

pid	process
4560	schtasks.exe

pid	process
2564	a8974094.exe
2564	a8974094.exe

description	pid	process
Token: SeDebugPrivilege	2564	a8974094.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exev5599934.exev9509668.exeb4798339.exepdates.execmd.exe

description	pid	process	target process
PID 2392 wrote to memory of 4468	2392	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe	v5599934.exe
PID 2392 wrote to memory of 4468	2392	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe	v5599934.exe
PID 2392 wrote to memory of 4468	2392	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe	v5599934.exe
PID 4468 wrote to memory of 2484	4468	v5599934.exe	v9509668.exe
PID 4468 wrote to memory of 2484	4468	v5599934.exe	v9509668.exe
PID 4468 wrote to memory of 2484	4468	v5599934.exe	v9509668.exe
PID 2484 wrote to memory of 2564	2484	v9509668.exe	a8974094.exe
PID 2484 wrote to memory of 2564	2484	v9509668.exe	a8974094.exe
PID 2484 wrote to memory of 2852	2484	v9509668.exe	b4798339.exe
PID 2484 wrote to memory of 2852	2484	v9509668.exe	b4798339.exe
PID 2484 wrote to memory of 2852	2484	v9509668.exe	b4798339.exe
PID 2852 wrote to memory of 4796	2852	b4798339.exe	pdates.exe
PID 2852 wrote to memory of 4796	2852	b4798339.exe	pdates.exe
PID 2852 wrote to memory of 4796	2852	b4798339.exe	pdates.exe
PID 4468 wrote to memory of 3496	4468	v5599934.exe	c4011866.exe
PID 4468 wrote to memory of 3496	4468	v5599934.exe	c4011866.exe
PID 4468 wrote to memory of 3496	4468	v5599934.exe	c4011866.exe
PID 4796 wrote to memory of 4560	4796	pdates.exe	schtasks.exe
PID 4796 wrote to memory of 4560	4796	pdates.exe	schtasks.exe
PID 4796 wrote to memory of 4560	4796	pdates.exe	schtasks.exe
PID 4796 wrote to memory of 4656	4796	pdates.exe	cmd.exe
PID 4796 wrote to memory of 4656	4796	pdates.exe	cmd.exe
PID 4796 wrote to memory of 4656	4796	pdates.exe	cmd.exe
PID 4656 wrote to memory of 1720	4656	cmd.exe	cmd.exe
PID 4656 wrote to memory of 1720	4656	cmd.exe	cmd.exe
PID 4656 wrote to memory of 1720	4656	cmd.exe	cmd.exe
PID 4656 wrote to memory of 5104	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 5104	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 5104	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 2932	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 2932	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 2932	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 4072	4656	cmd.exe	cmd.exe
PID 4656 wrote to memory of 4072	4656	cmd.exe	cmd.exe
PID 4656 wrote to memory of 4072	4656	cmd.exe	cmd.exe
PID 4656 wrote to memory of 4860	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 4860	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 4860	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 3536	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 3536	4656	cmd.exe	cacls.exe
PID 4656 wrote to memory of 3536	4656	cmd.exe	cacls.exe
PID 2392 wrote to memory of 5112	2392	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe	d7161703.exe
PID 2392 wrote to memory of 5112	2392	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe	d7161703.exe
PID 2392 wrote to memory of 5112	2392	03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe	d7161703.exe

C:\Users\Admin\AppData\Local\Temp\03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe
"C:\Users\Admin\AppData\Local\Temp\03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5599934.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5599934.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4468

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9509668.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9509668.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2484

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8974094.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8974094.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4798339.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4798339.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
6⤵
- Creates scheduled task(s)
PID:4560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1720

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:N"
7⤵
PID:5104

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:R" /E
7⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4072

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:N"
7⤵
PID:4860

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:R" /E
7⤵
PID:3536

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4011866.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4011866.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3496

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7161703.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7161703.exe
2⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:3096

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7161703.exe
Filesize
173KB

MD5
aab0def2a86353a6d74109c9c44632e0

SHA1
fdc51fb836d578408f6c31deae5b6f287b36a7ff

SHA256
afdf274ba5396405f14b679e9a0899031bb58a46f43c480ab14e224d7fb970a8

SHA512
e80e35710e121b4483c12e51b974405c93c66c7872faccd4a0ab470c6d946b609391147a97d9626766da6e2626b5d117f0f3599288122c74c8c0ba255ede1ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5599934.exe
Filesize
359KB

MD5
e2116c026196d315939a8736a7a61122

SHA1
246b9905c09fb4781f7a0a3aa8cc9611e49e7f46

SHA256
480c3384fdf1f027df7124e4eab7fe01642aad4f29e15384b93ff055dcec40ed

SHA512
3f5d98bf74695cd3e1298e769ecfc80683c2d3be3fa14f16a419ecb9e62624cb874a83f332dd9007abf4f92dec1731f7643d9163b816ba44d66642d2750dba4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4011866.exe
Filesize
35KB

MD5
0b15c5f79423a010b087aa19b6604457

SHA1
5f355e77d7322ee3d3465811715ca0104e1f3abb

SHA256
6583ac24bc5d1786a84ba9909f97b5fc74817969b09fe0c1b9a7f5009c670ad2

SHA512
aa2f02202ca22d0f208d745b3484b065f2af9f9c5497597c843c1582928fa9ea30c4da535144e7af93625dd40bba90e5aa760cc32368e77b99ca0b0379c96d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9509668.exe
Filesize
234KB

MD5
a005f05d6e7a236325974473706f3ee3

SHA1
422323c3709a933014b331642f92981f7385d062

SHA256
d2219c8c28863ee4c6b2360a8183f024ac8dd384f982f92acca9b228850d1822

SHA512
d2cbc7d358e697028c9f0e3dcf42e9ae3cdad5cecf26d21f2b16deb7f5d70d3f82623db4f9c00fb9654554678391bcb43246c56e60b97796e14ecd2bb53d3112

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8974094.exe
Filesize
11KB

MD5
1886d988b8c7cf6414d2a88e6f75fcf3

SHA1
7d9c07d2cd93129ebc15294ccca13ee4ca114e6e

SHA256
6a65a9f53a204bee1d51c5dce1993e9be8ca96656acae214ac17669f5e4e2074

SHA512
f45b381eb493fea7531b77c3a159765bea70a6648f2e5d5f2a26f76adff5e5cd79d29df60db368d7ea0f84fc4c81807999bf106a2b53e0e4099d741d809055f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4798339.exe
Filesize
223KB

MD5
ff37af7d01d31a0fc45849ab228df098

SHA1
9f259a18e4347552576e31854c60d4ac99179405

SHA256
f27f1032600651aca749b05805e5b82a5ff1042d7b07a17ee59662f7588b07f5

SHA512
26c01b6668e01745ca29b5b61214961ad1602029b981316bcab6a77b878b5269692222228455d7838726d7a977ab9e118cafac2ab938a410ff21ad4971fe9cd0

Download Submit
memory/2564-22-0x00007FFE88EB3000-0x00007FFE88EB5000-memory.dmp

Filesize
8KB

Download
memory/2564-21-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/3496-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5112-44-0x0000000000D30000-0x0000000000D60000-memory.dmp

Filesize
192KB

Download
memory/5112-45-0x0000000002EE0000-0x0000000002EE6000-memory.dmp

Filesize
24KB

Download
memory/5112-46-0x000000000B160000-0x000000000B778000-memory.dmp

Filesize
6.1MB

Download
memory/5112-47-0x000000000ACE0000-0x000000000ADEA000-memory.dmp

Filesize
1.0MB

Download
memory/5112-48-0x000000000AC20000-0x000000000AC32000-memory.dmp

Filesize
72KB

Download
memory/5112-49-0x000000000AC80000-0x000000000ACBC000-memory.dmp

Filesize
240KB

Download
memory/5112-50-0x0000000005030000-0x000000000507C000-memory.dmp

Filesize
304KB

Download