amadey | f6a395732f5dfe45c1b53e1a544f31826d5f310499de2170e9064ac9605a913e

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
Size

515KB
MD5

2154ece6d371bfbe7b76969405904f7e
SHA1

39f7c2f9abe69a8dc9b42853d10e330b93c9858d
SHA256

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f
SHA512

da64833b8c9a80598631242e5649164230f586d26e6171af7fac767496319a2e7147df082f7294a7faeb6e97843c03f4031ebfac1244ffab3804102e293a857f
SSDEEP

12288:ZMr7y90W5WJa5xOzgYAkrlzdEEcjXAyEc6hoMzR3VFKTv2h:uyfxOpRzKEOAyEphtzhrKTg

Score

10^/10

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe	healer
behavioral11/memory/3184-21-0x0000000000680000-0x000000000068A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a1921299.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1921299.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1921299.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe	family_redline
behavioral11/memory/2096-44-0x0000000000D40000-0x0000000000D70000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b6797687.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b6797687.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v8037124.exev6090559.exea1921299.exeb6797687.exepdates.exec1730609.exed2034385.exepdates.exepdates.exe

pid process

5016 v8037124.exe
368 v6090559.exe
3184 a1921299.exe
1504 b6797687.exe
5000 pdates.exe
556 c1730609.exe
2096 d2034385.exe
3104 pdates.exe
1060 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a1921299.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1921299.exe

pid	process
5016	v8037124.exe
368	v6090559.exe
3184	a1921299.exe
1504	b6797687.exe
5000	pdates.exe
556	c1730609.exe
2096	d2034385.exe
3104	pdates.exe
1060	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1921299.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v6090559.exe764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exev8037124.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6090559.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8037124.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c1730609.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1730609.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1730609.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1730609.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2544 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1921299.exe

pid process

3184 a1921299.exe
3184 a1921299.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a1921299.exe

description pid process

Token: SeDebugPrivilege 3184 a1921299.exe

pid	process
2544	schtasks.exe

pid	process
3184	a1921299.exe
3184	a1921299.exe

description	pid	process
Token: SeDebugPrivilege	3184	a1921299.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exev8037124.exev6090559.exeb6797687.exepdates.execmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 5016	4940	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	v8037124.exe
PID 4940 wrote to memory of 5016	4940	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	v8037124.exe
PID 4940 wrote to memory of 5016	4940	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	v8037124.exe
PID 5016 wrote to memory of 368	5016	v8037124.exe	v6090559.exe
PID 5016 wrote to memory of 368	5016	v8037124.exe	v6090559.exe
PID 5016 wrote to memory of 368	5016	v8037124.exe	v6090559.exe
PID 368 wrote to memory of 3184	368	v6090559.exe	a1921299.exe
PID 368 wrote to memory of 3184	368	v6090559.exe	a1921299.exe
PID 368 wrote to memory of 1504	368	v6090559.exe	b6797687.exe
PID 368 wrote to memory of 1504	368	v6090559.exe	b6797687.exe
PID 368 wrote to memory of 1504	368	v6090559.exe	b6797687.exe
PID 1504 wrote to memory of 5000	1504	b6797687.exe	pdates.exe
PID 1504 wrote to memory of 5000	1504	b6797687.exe	pdates.exe
PID 1504 wrote to memory of 5000	1504	b6797687.exe	pdates.exe
PID 5016 wrote to memory of 556	5016	v8037124.exe	c1730609.exe
PID 5016 wrote to memory of 556	5016	v8037124.exe	c1730609.exe
PID 5016 wrote to memory of 556	5016	v8037124.exe	c1730609.exe
PID 5000 wrote to memory of 2544	5000	pdates.exe	schtasks.exe
PID 5000 wrote to memory of 2544	5000	pdates.exe	schtasks.exe
PID 5000 wrote to memory of 2544	5000	pdates.exe	schtasks.exe
PID 5000 wrote to memory of 1712	5000	pdates.exe	cmd.exe
PID 5000 wrote to memory of 1712	5000	pdates.exe	cmd.exe
PID 5000 wrote to memory of 1712	5000	pdates.exe	cmd.exe
PID 1712 wrote to memory of 2552	1712	cmd.exe	cmd.exe
PID 1712 wrote to memory of 2552	1712	cmd.exe	cmd.exe
PID 1712 wrote to memory of 2552	1712	cmd.exe	cmd.exe
PID 1712 wrote to memory of 1528	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1528	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1528	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1376	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1376	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1376	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 864	1712	cmd.exe	cmd.exe
PID 1712 wrote to memory of 864	1712	cmd.exe	cmd.exe
PID 1712 wrote to memory of 864	1712	cmd.exe	cmd.exe
PID 1712 wrote to memory of 1200	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1200	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 1200	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 3712	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 3712	1712	cmd.exe	cacls.exe
PID 1712 wrote to memory of 3712	1712	cmd.exe	cacls.exe
PID 4940 wrote to memory of 2096	4940	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	d2034385.exe
PID 4940 wrote to memory of 2096	4940	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	d2034385.exe
PID 4940 wrote to memory of 2096	4940	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	d2034385.exe

C:\Users\Admin\AppData\Local\Temp\764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
"C:\Users\Admin\AppData\Local\Temp\764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8037124.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8037124.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6090559.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6090559.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6797687.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6797687.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2544
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:864
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:3712
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1730609.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1730609.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe
  2⤵
  - Executes dropped EXE
  PID:2096

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe

Filesize
173KB

MD5
478907e21056ec954863f744923d66ef

SHA1
0bd7b9905cfd5135324811c1cf6f587a8d65f638

SHA256
56b21151da3b7f5420f855668581bad6e5e1659306970372320fa453c517fd66

SHA512
7e558a09ad8905a60a30b4c3898b6a96a2dade191697b4c95ef10a57a6ecacd5d55bea551b088b81a9888de5ae2593b7099efb38dd9f5898e9056c61ffc6439c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8037124.exe

Filesize
359KB

MD5
6ffe220ea983dfad338a1f8c7a434df5

SHA1
defc72a496e79f1bdda7a9f356c65b8e2b0e0a26

SHA256
9467f8fedaa618469c91fed1e5980a9e1a7a2b22bc456b95d3a338242b3b6477

SHA512
4f8cf2f175e6706a4828a9c7537735406bd5b7d66a4a85428f69bd1f2362a0ed58707e8d0d193bd8079dbdca3f4a71f14fa34b8624f64f3d725acbe7df86fce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1730609.exe

Filesize
35KB

MD5
8fe35219f258d8bacb6bf8edc682fb2c

SHA1
979535596ea208d403d8e0e300f832a1c0a9e06c

SHA256
ef9b2cc544302f2f7afdf5f6c1d66971d65f87d3345fd763896c23b17d028981

SHA512
3e4aa30325b00ec24b2a208a39e69055b795c9f7a244d0fc49eb87c5a71b7455a0c9eedb26bbb32feaf7a7e56e79d8c6de5c775f5af84b70408fb7368d1a5f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6090559.exe

Filesize
234KB

MD5
d4e21fb6881ef1240b6fcb1807e33437

SHA1
15f7ddcc15e2d6f2a95d2f07dbd8cfa0d0f56d24

SHA256
a22a82487193ae5ea533fff71a88bdbcd42304c451d2d2383a162ea797633798

SHA512
507295973be41a82625f53301208403c817c1de7fb8a7f787d1647cbf8310e32ff88b84b330205429c0557a568bee0187fdea3c2c66bbcdbc55e44783e841844

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe

Filesize
11KB

MD5
0af4983d266a8beca186f2982f93571e

SHA1
d23d7260618685b821d0c5d9b112b4caed4be12a

SHA256
acc3723f02d21434a6ccb2bb8ca36f7aca96cab06c9ea4c9e6a0fc0e87343066

SHA512
730ff4561382d9cde738d63d144cec4b7c205af289334b777982d3c24d698697252631eacdcfbca6bc627c2551eef8ae49878a135449299dce308b078eadd054

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6797687.exe

Filesize
223KB

MD5
92ecd63689689187a0300452da216546

SHA1
baca2601fe1323617cae2a8bc3c539be38fa0eea

SHA256
1559281dca2533a4ba1904bf90518c75008214a273e24384bbe277af03553e80

SHA512
f6759c316d6cfb393fd347ddf107052c6a02cd8f500d3b321a80d09d3446005093d01f1498c3c2535022dd3077312cebbf1f29d210ddd8e61ab2b91439360f2b

Download Submit
memory/556-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-47-0x000000000ABB0000-0x000000000ACBA000-memory.dmp

Filesize
1.0MB

Download
memory/2096-44-0x0000000000D40000-0x0000000000D70000-memory.dmp

Filesize
192KB

Download
memory/2096-45-0x0000000002F30000-0x0000000002F36000-memory.dmp

Filesize
24KB

Download
memory/2096-46-0x000000000B050000-0x000000000B668000-memory.dmp

Filesize
6.1MB

Download
memory/2096-48-0x000000000AAF0000-0x000000000AB02000-memory.dmp

Filesize
72KB

Download
memory/2096-49-0x000000000AB50000-0x000000000AB8C000-memory.dmp

Filesize
240KB

Download
memory/2096-50-0x0000000005070000-0x00000000050BC000-memory.dmp

Filesize
304KB

Download
memory/3184-21-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/3184-22-0x00007FFDADD53000-0x00007FFDADD55000-memory.dmp

Filesize
8KB

Download