amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Size

515KB
MD5

1b6ca4b3887874447697d2dac0664cf5
SHA1

0b2ef46a6bd9883b04ecaf8ae6fc47df13e2f8f2
SHA256

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41
SHA512

4435a0bfc90dd2574a28ce91d519a4566ff85413fb13b5c6690d2e868410abda41ebd05e4129f20fdfafb989d5f2bf424ef84234925ebb33123e0a434a4d6a5d
SSDEEP

12288:XMrfy90fa+YaQ3g3aNwmYu4neyzKmErzq93TU1cFdsJ:4y0a+YahqJYuGey2HAEJ

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral27/files/0x0008000000023438-19.dat	healer
behavioral27/memory/3504-21-0x0000000000E30000-0x0000000000E3A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6513102.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6513102.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral27/files/0x0007000000023432-43.dat	family_redline
behavioral27/memory/3476-45-0x0000000000810000-0x0000000000840000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	b1736941.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

pid	Process
3000	v9071750.exe
1924	v1399127.exe
3504	a6513102.exe
2028	b1736941.exe
1644	pdates.exe
4292	c2251742.exe
4280	pdates.exe
3476	d4275669.exe
3504	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6513102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9071750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1399127.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4332	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2251742.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2251742.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2251742.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3504	a6513102.exe
3504	a6513102.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	a6513102.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3000	4176	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	82
PID 4176 wrote to memory of 3000	4176	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	82
PID 4176 wrote to memory of 3000	4176	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	82
PID 3000 wrote to memory of 1924	3000	v9071750.exe	83
PID 3000 wrote to memory of 1924	3000	v9071750.exe	83
PID 3000 wrote to memory of 1924	3000	v9071750.exe	83
PID 1924 wrote to memory of 3504	1924	v1399127.exe	85
PID 1924 wrote to memory of 3504	1924	v1399127.exe	85
PID 1924 wrote to memory of 2028	1924	v1399127.exe	95
PID 1924 wrote to memory of 2028	1924	v1399127.exe	95
PID 1924 wrote to memory of 2028	1924	v1399127.exe	95
PID 2028 wrote to memory of 1644	2028	b1736941.exe	96
PID 2028 wrote to memory of 1644	2028	b1736941.exe	96
PID 2028 wrote to memory of 1644	2028	b1736941.exe	96
PID 3000 wrote to memory of 4292	3000	v9071750.exe	97
PID 3000 wrote to memory of 4292	3000	v9071750.exe	97
PID 3000 wrote to memory of 4292	3000	v9071750.exe	97
PID 1644 wrote to memory of 4744	1644	pdates.exe	98
PID 1644 wrote to memory of 4744	1644	pdates.exe	98
PID 1644 wrote to memory of 4744	1644	pdates.exe	98
PID 1644 wrote to memory of 1744	1644	pdates.exe	100
PID 1644 wrote to memory of 1744	1644	pdates.exe	100
PID 1644 wrote to memory of 1744	1644	pdates.exe	100
PID 1744 wrote to memory of 3776	1744	cmd.exe	102
PID 1744 wrote to memory of 3776	1744	cmd.exe	102
PID 1744 wrote to memory of 3776	1744	cmd.exe	102
PID 1744 wrote to memory of 3172	1744	cmd.exe	103
PID 1744 wrote to memory of 3172	1744	cmd.exe	103
PID 1744 wrote to memory of 3172	1744	cmd.exe	103
PID 1744 wrote to memory of 4824	1744	cmd.exe	104
PID 1744 wrote to memory of 4824	1744	cmd.exe	104
PID 1744 wrote to memory of 4824	1744	cmd.exe	104
PID 1744 wrote to memory of 1200	1744	cmd.exe	105
PID 1744 wrote to memory of 1200	1744	cmd.exe	105
PID 1744 wrote to memory of 1200	1744	cmd.exe	105
PID 1744 wrote to memory of 832	1744	cmd.exe	106
PID 1744 wrote to memory of 832	1744	cmd.exe	106
PID 1744 wrote to memory of 832	1744	cmd.exe	106
PID 1744 wrote to memory of 3288	1744	cmd.exe	107
PID 1744 wrote to memory of 3288	1744	cmd.exe	107
PID 1744 wrote to memory of 3288	1744	cmd.exe	107
PID 4176 wrote to memory of 3476	4176	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	113
PID 4176 wrote to memory of 3476	4176	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	113
PID 4176 wrote to memory of 3476	4176	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	113

C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
"C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4744
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:832
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:3288
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4292
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
  2⤵
  - Executes dropped EXE
  PID:3476

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe

Filesize
174KB

MD5
35c0945f8c70c870c070eb2261d6bc04

SHA1
bfc1ffae759330be5a50c22829fb342bfc644aab

SHA256
e296c73bc0d4abe0e58a2200d0c1839c210debd4deb8b26aa83abc5a2f0aaa1d

SHA512
8c9e5e646dfcd6b592d516524128d34af326c55a153d77d240ddbe6f418f01be473231e78a1707d72b0fbe3ad367085fc76ff329d8d80515ac07288b5eda73b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe

Filesize
359KB

MD5
88bee46f431c014c1e45417f6b13e124

SHA1
07588e0723944e251a6a2d9db4ed8e45d5f563f1

SHA256
f4dfc88066f344cec64c3c5076b4e1e051af9f333c455aa2f96daacc1d732999

SHA512
5a0c53df34632e2d21c12e572460d54bfe7de21035d44bc36764ed3c6410d661ee50c758366cc8b86c2447b54efab7c41479fb04468afee6b70b9cbbaf55e79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe

Filesize
36KB

MD5
88331cf94b56745070654ca04d4c7d98

SHA1
248ac76afce09c34082bad3fbd01ce73e4056f65

SHA256
32e850a828611bdf20e34f0ac6c397507ff4b140c2b13732b5bf389249693334

SHA512
a3173aaeb138cb46f951d1e6b103a424c91ee05b416cdc9080e3ac5ba6db33dd0431d1ba0b8228b379f6ea6631b5c6622a4875459ce1105a0b959722e7717f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe

Filesize
234KB

MD5
8f620f99bbeba489fc4bddc2af02f9b8

SHA1
2e97752a24581dd229306cfad5763cf82f9c4f96

SHA256
26a1717813eedfd0569c474064d1e14eeba61b97bb26866c53a19428a448a3f5

SHA512
b5065ed02a3bdcb68461265bb56f9173a7f9a1c75d12cf1ae53c43224cf2aada5586a4ee122779d7c83b8e8130cc6a980080cd03c2cc751ce19ac5ea3b2caa03

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe

Filesize
13KB

MD5
12803f40ef0b813626de6e5eb0ec05b2

SHA1
27e32adac36ba9f4d54ecbf53e112158d4e988b5

SHA256
d320fcef46ae85d5f06133a3b8d4f5a7d2dff0886a86d981f3186f464fbb7abb

SHA512
84d7c28b03fdceb94e00fbcc838f203f6cd9e091b67b7ea8dad577a529a0d96eecf3b246a8548c9b7bef1e063aa96525f6b2148b5d0bb79b32a3415e9f151e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe

Filesize
225KB

MD5
2b7ed1055ddd27afe675dd11da92357a

SHA1
3809cb22cbdda5ba5707892163217563020df5ca

SHA256
9d69e620d8bb7cb24c7d4831312351d09872badc8331594ce05afe46ff56ab3d

SHA512
549602e7e10ae1b006fafe9d6c1c09d35280a3af8815157dfa9b7664f16bf1682cc782585a24202dd150955073b5e648f0ad8a39add3f95ceeb51a5eb26fc641

Download Submit
memory/3476-48-0x000000000A7C0000-0x000000000A8CA000-memory.dmp

Filesize
1.0MB

Download
memory/3476-45-0x0000000000810000-0x0000000000840000-memory.dmp

Filesize
192KB

Download
memory/3476-46-0x0000000002BE0000-0x0000000002BE6000-memory.dmp

Filesize
24KB

Download
memory/3476-47-0x000000000ACD0000-0x000000000B2E8000-memory.dmp

Filesize
6.1MB

Download
memory/3476-49-0x000000000A700000-0x000000000A712000-memory.dmp

Filesize
72KB

Download
memory/3476-50-0x000000000A760000-0x000000000A79C000-memory.dmp

Filesize
240KB

Download
memory/3476-51-0x0000000002B50000-0x0000000002B9C000-memory.dmp

Filesize
304KB

Download
memory/3504-22-0x00007FFF9F6C3000-0x00007FFF9F6C5000-memory.dmp

Filesize
8KB

Download
memory/3504-21-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Filesize
40KB

Download
memory/4292-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download