amadey | f6a395732f5dfe45c1b53e1a544f31826d5f310499de2170e9064ac9605a913e

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
Size

390KB
MD5

2115f838100aacbc3124baa1083c9d98
SHA1

7eb9e1272fdcbc6deec8fbdc06d609c69a0a88fc
SHA256

ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c
SHA512

7a8645ad4437cfa1833f826b9ed83dc329ecf14ceed774d5aea2982f305ee3c89cb69f4a72e31e4d78bc8ecb70937198a732c36e5b0914cce9f42fcf18bfd8d2
SSDEEP

6144:Kwy+bnr+Qp0yN90QEHQvEyqANvRS5KRQrw6kd7lmm39LBGGHlXve5oGvAe:wMr8y90QEyqANc6Qr5KAm9HFXaone

Score

10^/10

amadey healer redline roma dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

roma

77.91.68.56:19071

Attributes

auth_value
f099c2cf92834dbc554a94e1456cf576

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral20/files/0x00070000000235d6-26.dat	healer
behavioral20/memory/4552-27-0x0000000000940000-0x000000000094A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h4931381.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h4931381.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral20/files/0x00070000000235d3-30.dat	family_redline
behavioral20/memory/3356-32-0x00000000005A0000-0x00000000005D0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	g9963861.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

pid	Process
2044	x3731075.exe
3236	g9963861.exe
392	danke.exe
4552	h4931381.exe
3356	j2624853.exe
4156	danke.exe
436	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	h4931381.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x3731075.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4552	h4931381.exe
4552	h4931381.exe
4552	h4931381.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	h4931381.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2044	3372	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	89
PID 3372 wrote to memory of 2044	3372	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	89
PID 3372 wrote to memory of 2044	3372	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	89
PID 2044 wrote to memory of 3236	2044	x3731075.exe	90
PID 2044 wrote to memory of 3236	2044	x3731075.exe	90
PID 2044 wrote to memory of 3236	2044	x3731075.exe	90
PID 3236 wrote to memory of 392	3236	g9963861.exe	92
PID 3236 wrote to memory of 392	3236	g9963861.exe	92
PID 3236 wrote to memory of 392	3236	g9963861.exe	92
PID 2044 wrote to memory of 4552	2044	x3731075.exe	93
PID 2044 wrote to memory of 4552	2044	x3731075.exe	93
PID 392 wrote to memory of 1884	392	danke.exe	95
PID 392 wrote to memory of 1884	392	danke.exe	95
PID 392 wrote to memory of 1884	392	danke.exe	95
PID 392 wrote to memory of 4476	392	danke.exe	97
PID 392 wrote to memory of 4476	392	danke.exe	97
PID 392 wrote to memory of 4476	392	danke.exe	97
PID 4476 wrote to memory of 1012	4476	cmd.exe	99
PID 4476 wrote to memory of 1012	4476	cmd.exe	99
PID 4476 wrote to memory of 1012	4476	cmd.exe	99
PID 4476 wrote to memory of 4952	4476	cmd.exe	100
PID 4476 wrote to memory of 4952	4476	cmd.exe	100
PID 4476 wrote to memory of 4952	4476	cmd.exe	100
PID 4476 wrote to memory of 2772	4476	cmd.exe	101
PID 4476 wrote to memory of 2772	4476	cmd.exe	101
PID 4476 wrote to memory of 2772	4476	cmd.exe	101
PID 4476 wrote to memory of 4376	4476	cmd.exe	102
PID 4476 wrote to memory of 4376	4476	cmd.exe	102
PID 4476 wrote to memory of 4376	4476	cmd.exe	102
PID 4476 wrote to memory of 4284	4476	cmd.exe	103
PID 4476 wrote to memory of 4284	4476	cmd.exe	103
PID 4476 wrote to memory of 4284	4476	cmd.exe	103
PID 4476 wrote to memory of 2972	4476	cmd.exe	104
PID 4476 wrote to memory of 2972	4476	cmd.exe	104
PID 4476 wrote to memory of 2972	4476	cmd.exe	104
PID 3372 wrote to memory of 3356	3372	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	110
PID 3372 wrote to memory of 3356	3372	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	110
PID 3372 wrote to memory of 3356	3372	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	110

C:\Users\Admin\AppData\Local\Temp\ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
"C:\Users\Admin\AppData\Local\Temp\ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3731075.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3731075.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9963861.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9963861.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
      "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1884
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1012
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        6⤵
        
        PID:2772
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4376
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        6⤵
        
        PID:4284
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        6⤵
        
        PID:2972
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4931381.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4931381.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2624853.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2624853.exe
  2⤵
  - Executes dropped EXE
  PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4368,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
1⤵
PID:428

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2624853.exe

Filesize
175KB

MD5
79d695993551d95d1dc462067311249d

SHA1
a09b6be89d4cb4d0e77d654b80bf73871fc5ae90

SHA256
9da891fbecacaf934f0e24ed59d13540062b32165dd914857a8af4109cc6340b

SHA512
9e53d532febd0221c9ec9720b2ffa3ef3ec59db0c1d7894d3d071fc3a1725255031225420d718427ac17e56e4fcfa46f66468d4976a160a371f41e20ab61b891

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3731075.exe

Filesize
234KB

MD5
0a0078e9aa75b182d33076182db21f09

SHA1
dc45a8085f53e9ceac803650b69f3858467db64e

SHA256
1ccaf92b146c89c824046a4bf8a94ba1646e425ecf6432de085cc96358a7db9c

SHA512
49efd218d098b555d962d2ec90907540c9c36d012e2dab87b72760660ec6dff9f95aea84c82d8bb1f4c6535bae2d2566d51638e15f864c6621d63ad42c935d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9963861.exe

Filesize
224KB

MD5
8c6b79ec436d7cf6950a804c1ec7d3e9

SHA1
4a589d5605d8ef785fdc78b0bf64e769e3a21ad6

SHA256
4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d

SHA512
06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4931381.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/3356-32-0x00000000005A0000-0x00000000005D0000-memory.dmp

Filesize
192KB

Download
memory/3356-33-0x0000000004E80000-0x0000000004E86000-memory.dmp

Filesize
24KB

Download
memory/3356-34-0x000000000A8E0000-0x000000000AEF8000-memory.dmp

Filesize
6.1MB

Download
memory/3356-35-0x000000000A410000-0x000000000A51A000-memory.dmp

Filesize
1.0MB

Download
memory/3356-36-0x000000000A350000-0x000000000A362000-memory.dmp

Filesize
72KB

Download
memory/3356-37-0x000000000A3B0000-0x000000000A3EC000-memory.dmp

Filesize
240KB

Download
memory/3356-38-0x0000000002760000-0x00000000027AC000-memory.dmp

Filesize
304KB

Download
memory/4552-27-0x0000000000940000-0x000000000094A000-memory.dmp

Filesize
40KB

Download