amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Size

514KB
MD5

1942d1d3d93833f0a1d4f5381ce33a23
SHA1

4056636db4625bb6b3fee03b4c1be992681affa9
SHA256

1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e
SHA512

a9569c93345b4565b8e9bd30a1b09400eaba1ddeb3fbcf00d53563d1ba34d4d6f4f5bba9ffe6852ff699de66e8177eab35ffc771741fd9d528e6802726aa3a6c
SSDEEP

12288:SMrqy908fsn+JqW9WsGJPMj1kn4tBA6jmcRyqBq08:4yIEqwWsKmy4YikWJ8

Score

10^/10

amadey healer redline smokeloader roma backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

roma

77.91.68.56:19071

Attributes

auth_value
f099c2cf92834dbc554a94e1456cf576

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe	healer
behavioral5/memory/832-22-0x0000000000F00000-0x0000000000F0A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a7008015.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7008015.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe	family_redline
behavioral5/memory/4132-45-0x00000000004E0000-0x0000000000510000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b7865879.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	b7865879.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

Processes:

v5770759.exev1936485.exea7008015.exeb7865879.exedanke.exec5034781.exedanke.exed3489522.exedanke.exedanke.exe

pid	process
2456	v5770759.exe
3596	v1936485.exe
832	a7008015.exe
2584	b7865879.exe
2600	danke.exe
232	c5034781.exe
1948	danke.exe
4132	d3489522.exe
3720	danke.exe
4760	danke.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a7008015.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7008015.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7008015.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exev5770759.exev1936485.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5770759.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1936485.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c5034781.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5034781.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5034781.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5034781.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3916 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a7008015.exe

pid process

832 a7008015.exe
832 a7008015.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7008015.exe

description pid process

Token: SeDebugPrivilege 832 a7008015.exe

pid	process
3916	schtasks.exe

pid	process
832	a7008015.exe
832	a7008015.exe

description	pid	process
Token: SeDebugPrivilege	832	a7008015.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exev5770759.exev1936485.exeb7865879.exedanke.execmd.exe

description	pid	process	target process
PID 2440 wrote to memory of 2456	2440	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	v5770759.exe
PID 2440 wrote to memory of 2456	2440	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	v5770759.exe
PID 2440 wrote to memory of 2456	2440	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	v5770759.exe
PID 2456 wrote to memory of 3596	2456	v5770759.exe	v1936485.exe
PID 2456 wrote to memory of 3596	2456	v5770759.exe	v1936485.exe
PID 2456 wrote to memory of 3596	2456	v5770759.exe	v1936485.exe
PID 3596 wrote to memory of 832	3596	v1936485.exe	a7008015.exe
PID 3596 wrote to memory of 832	3596	v1936485.exe	a7008015.exe
PID 3596 wrote to memory of 2584	3596	v1936485.exe	b7865879.exe
PID 3596 wrote to memory of 2584	3596	v1936485.exe	b7865879.exe
PID 3596 wrote to memory of 2584	3596	v1936485.exe	b7865879.exe
PID 2584 wrote to memory of 2600	2584	b7865879.exe	danke.exe
PID 2584 wrote to memory of 2600	2584	b7865879.exe	danke.exe
PID 2584 wrote to memory of 2600	2584	b7865879.exe	danke.exe
PID 2456 wrote to memory of 232	2456	v5770759.exe	c5034781.exe
PID 2456 wrote to memory of 232	2456	v5770759.exe	c5034781.exe
PID 2456 wrote to memory of 232	2456	v5770759.exe	c5034781.exe
PID 2600 wrote to memory of 3916	2600	danke.exe	schtasks.exe
PID 2600 wrote to memory of 3916	2600	danke.exe	schtasks.exe
PID 2600 wrote to memory of 3916	2600	danke.exe	schtasks.exe
PID 2600 wrote to memory of 3888	2600	danke.exe	cmd.exe
PID 2600 wrote to memory of 3888	2600	danke.exe	cmd.exe
PID 2600 wrote to memory of 3888	2600	danke.exe	cmd.exe
PID 3888 wrote to memory of 1608	3888	cmd.exe	cmd.exe
PID 3888 wrote to memory of 1608	3888	cmd.exe	cmd.exe
PID 3888 wrote to memory of 1608	3888	cmd.exe	cmd.exe
PID 3888 wrote to memory of 4324	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 4324	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 4324	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 508	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 508	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 508	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 2964	3888	cmd.exe	cmd.exe
PID 3888 wrote to memory of 2964	3888	cmd.exe	cmd.exe
PID 3888 wrote to memory of 2964	3888	cmd.exe	cmd.exe
PID 3888 wrote to memory of 1696	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 1696	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 1696	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 2368	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 2368	3888	cmd.exe	cacls.exe
PID 3888 wrote to memory of 2368	3888	cmd.exe	cacls.exe
PID 2440 wrote to memory of 4132	2440	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	d3489522.exe
PID 2440 wrote to memory of 4132	2440	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	d3489522.exe
PID 2440 wrote to memory of 4132	2440	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	d3489522.exe

C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
"C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:832
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3916
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:2368
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:232
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
  2⤵
  - Executes dropped EXE
  PID:4132

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe

Filesize
174KB

MD5
fd61776b34b5a58e732533da17d122d0

SHA1
336015c059047a658ea57b6ebe49418d23a65593

SHA256
64faeec435f51816cff0efdacc9e777d677400fd7a59bc1e037a24ec7ae7cb4b

SHA512
afbd9465a721b8e447359c88451f9525ecc5f3aedf79be424b49d4a93d5921797854471257fb1f1ea7d967e56d54aec7b712773875f92fd4335e5a12afd4fc68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe

Filesize
359KB

MD5
e5fee7b57e9630eb6cbe1861cb6d1a82

SHA1
de69d6c77a4db78be5c7239199528da46bd4a9b9

SHA256
e7da30afc9870af8478dffe8cb7c3517dbcd725d83d3c9e7435cc5bcfaa1a76d

SHA512
c7af1fd9383094548929920e18b2adeb6d07fded702fc748f557d913ad8521c666e419aee611d994ec94154830967e39d797a98ba0cd18ab10548ce85f6a02ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe

Filesize
31KB

MD5
c4c414d786976435cb8561c43d8dc57d

SHA1
fd73133d3509d1a6982b000a75b9dbdc7769ec22

SHA256
129a6c5e5a8d98619b5be3818dfde6bab9c5345171d9d8401b886fed0660817a

SHA512
744106f95b8f57ea59e2906a7cbaf2e1a172cee013be12f0752b3308c428f92f9824a2497f3fced82d9124d3ab52448d3b240889fdad26925e710aa47f67b028

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe

Filesize
235KB

MD5
b3f0cfa1b2d4fab75074fe1a7b426ebb

SHA1
61d950a5d649826b8b646453df4398cdd56189b9

SHA256
0bd882b9fd1549e5b281cbaa19a8a2a2952a03219737db0af5cadf4e817c0561

SHA512
0141c9f835859df5fa0d8a04d010482961a693bada72d57e60677ee84b79bc86e59b523b3a4f9168fb240a815d9f80fbba05cc0d5f5a7f7d0415d0eabef699d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe

Filesize
13KB

MD5
c9767fb557c8496da35f32149019f254

SHA1
dc206616148aad4e06dd3fb380d34b4ba15a9c6d

SHA256
d039e2510d33b0cca9b9d06c2be8152c5e126660c7860649dd966e1a7b375e9c

SHA512
f9c225248b0a8f9766b936694f71b347a0f006110928d26717d886d6b78f1b9ea3b3518a3123004cb20c4d4ffa5eb394bd169641163b297046a967f1ac9c4445

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe

Filesize
225KB

MD5
9728e9852854da025b4314bd0fd3687c

SHA1
6a87c09c8e29b6ca1c336416088f12cce0c206f8

SHA256
2c0f306d091f752e409e8bcbe20934ffa23430a90dea79c62aff27ee1b3035cf

SHA512
23df44bd9f5ae665f2d4c320603162b1d98b30b5610e99b5a9082843d76f0a6444e83e1c1792c2febf20d771b297777af8faa0403ba80f2f3f8b1c487abf7144

Download Submit
memory/232-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/832-22-0x0000000000F00000-0x0000000000F0A000-memory.dmp

Filesize
40KB

Download
memory/832-21-0x00007FFA70A83000-0x00007FFA70A85000-memory.dmp

Filesize
8KB

Download
memory/4132-45-0x00000000004E0000-0x0000000000510000-memory.dmp

Filesize
192KB

Download
memory/4132-46-0x00000000027D0000-0x00000000027D6000-memory.dmp

Filesize
24KB

Download
memory/4132-47-0x000000000A910000-0x000000000AF28000-memory.dmp

Filesize
6.1MB

Download
memory/4132-48-0x000000000A490000-0x000000000A59A000-memory.dmp

Filesize
1.0MB

Download
memory/4132-49-0x000000000A3D0000-0x000000000A3E2000-memory.dmp

Filesize
72KB

Download
memory/4132-50-0x000000000A430000-0x000000000A46C000-memory.dmp

Filesize
240KB

Download
memory/4132-51-0x0000000004810000-0x000000000485C000-memory.dmp

Filesize
304KB

Download