amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Size 515KB
Sample240510-prnxbsef21
SHA256 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41
MD5 1b6ca4b3887874447697d2dac0664cf5
SHA1 0b2ef46a6bd9883b04ecaf8ae6fc47df13e2f8f2
SHA512 4435a0bfc90dd2574a28ce91d519a4566ff85413fb13b5c6690d2e868410abda41ebd05e4129f20fdfafb989d5f2bf424ef84234925ebb33123e0a434a4d6a5d
SSDEEP 12288:XMrfy90fa+YaQ3g3aNwmYu4neyzKmErzq93TU1cFdsJ:4y0a+YahqJYuGey2HAEJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral27/files/0x000800000002355a-19.dat	healer
behavioral27/memory/228-21-0x0000000000440000-0x000000000044A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6513102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6513102.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6513102.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral27/files/0x0007000000023555-43.dat	family_redline
behavioral27/memory/2080-45-0x0000000000840000-0x0000000000870000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	b1736941.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

pid	Process
536	v9071750.exe
3812	v1399127.exe
228	a6513102.exe
2832	b1736941.exe
2304	pdates.exe
3556	c2251742.exe
2080	d4275669.exe
1596	pdates.exe
2156	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6513102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9071750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1399127.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2251742.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2251742.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2251742.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	a6513102.exe
228	a6513102.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	a6513102.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 536	4852	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	89
PID 4852 wrote to memory of 536	4852	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	89
PID 4852 wrote to memory of 536	4852	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	89
PID 536 wrote to memory of 3812	536	v9071750.exe	91
PID 536 wrote to memory of 3812	536	v9071750.exe	91
PID 536 wrote to memory of 3812	536	v9071750.exe	91
PID 3812 wrote to memory of 228	3812	v1399127.exe	93
PID 3812 wrote to memory of 228	3812	v1399127.exe	93
PID 3812 wrote to memory of 2832	3812	v1399127.exe	98
PID 3812 wrote to memory of 2832	3812	v1399127.exe	98
PID 3812 wrote to memory of 2832	3812	v1399127.exe	98
PID 2832 wrote to memory of 2304	2832	b1736941.exe	99
PID 2832 wrote to memory of 2304	2832	b1736941.exe	99
PID 2832 wrote to memory of 2304	2832	b1736941.exe	99
PID 536 wrote to memory of 3556	536	v9071750.exe	100
PID 536 wrote to memory of 3556	536	v9071750.exe	100
PID 536 wrote to memory of 3556	536	v9071750.exe	100
PID 4852 wrote to memory of 2080	4852	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	101
PID 4852 wrote to memory of 2080	4852	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	101
PID 4852 wrote to memory of 2080	4852	f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe	101
PID 2304 wrote to memory of 2156	2304	pdates.exe	102
PID 2304 wrote to memory of 2156	2304	pdates.exe	102
PID 2304 wrote to memory of 2156	2304	pdates.exe	102
PID 2304 wrote to memory of 4688	2304	pdates.exe	104
PID 2304 wrote to memory of 4688	2304	pdates.exe	104
PID 2304 wrote to memory of 4688	2304	pdates.exe	104
PID 4688 wrote to memory of 2916	4688	cmd.exe	107
PID 4688 wrote to memory of 2916	4688	cmd.exe	107
PID 4688 wrote to memory of 2916	4688	cmd.exe	107
PID 4688 wrote to memory of 3928	4688	cmd.exe	108
PID 4688 wrote to memory of 3928	4688	cmd.exe	108
PID 4688 wrote to memory of 3928	4688	cmd.exe	108
PID 4688 wrote to memory of 1884	4688	cmd.exe	109
PID 4688 wrote to memory of 1884	4688	cmd.exe	109
PID 4688 wrote to memory of 1884	4688	cmd.exe	109
PID 4688 wrote to memory of 1424	4688	cmd.exe	110
PID 4688 wrote to memory of 1424	4688	cmd.exe	110
PID 4688 wrote to memory of 1424	4688	cmd.exe	110
PID 4688 wrote to memory of 3124	4688	cmd.exe	111
PID 4688 wrote to memory of 3124	4688	cmd.exe	111
PID 4688 wrote to memory of 3124	4688	cmd.exe	111
PID 4688 wrote to memory of 4232	4688	cmd.exe	112
PID 4688 wrote to memory of 4232	4688	cmd.exe	112
PID 4688 wrote to memory of 4232	4688	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
"C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:228
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2156
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:4232
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
  2⤵
  - Executes dropped EXE
  PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d4275669.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
Size 174KB
SHA256 e296c73bc0d4abe0e58a2200d0c1839c210debd4deb8b26aa83abc5a2f0aaa1d
MD5 35c0945f8c70c870c070eb2261d6bc04
SHA1 bfc1ffae759330be5a50c22829fb342bfc644aab
SHA512 8c9e5e646dfcd6b592d516524128d34af326c55a153d77d240ddbe6f418f01be473231e78a1707d72b0fbe3ad367085fc76ff329d8d80515ac07288b5eda73b7
SSDEEP 3072:vAiq5kdS1l/Z2LxNjMIt04TMWVr8e8hn:vAiT8OPy4TMWVr
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9071750.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
Size 359KB
SHA256 f4dfc88066f344cec64c3c5076b4e1e051af9f333c455aa2f96daacc1d732999
MD5 88bee46f431c014c1e45417f6b13e124
SHA1 07588e0723944e251a6a2d9db4ed8e45d5f563f1
SHA512 5a0c53df34632e2d21c12e572460d54bfe7de21035d44bc36764ed3c6410d661ee50c758366cc8b86c2447b54efab7c41479fb04468afee6b70b9cbbaf55e79e
SSDEEP 6144:KMy+bnr+Op0yN90QEcwHPxGNBpGUGJ4sdvpg4nDh6TVlFKbEr/zmTUWbrdV:IMrWy901PcZmHu4nkZzKbErz2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2251742.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
Size 36KB
SHA256 32e850a828611bdf20e34f0ac6c397507ff4b140c2b13732b5bf389249693334
MD5 88331cf94b56745070654ca04d4c7d98
SHA1 248ac76afce09c34082bad3fbd01ce73e4056f65
SHA512 a3173aaeb138cb46f951d1e6b103a424c91ee05b416cdc9080e3ac5ba6db33dd0431d1ba0b8228b379f6ea6631b5c6622a4875459ce1105a0b959722e7717f96
SSDEEP 384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1399127.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
Size 234KB
SHA256 26a1717813eedfd0569c474064d1e14eeba61b97bb26866c53a19428a448a3f5
MD5 8f620f99bbeba489fc4bddc2af02f9b8
SHA1 2e97752a24581dd229306cfad5763cf82f9c4f96
SHA512 b5065ed02a3bdcb68461265bb56f9173a7f9a1c75d12cf1ae53c43224cf2aada5586a4ee122779d7c83b8e8130cc6a980080cd03c2cc751ce19ac5ea3b2caa03
SSDEEP 6144:Khy+bnr+Ap0yN90QEiHdzT08HNEr/zmwW:7Mrcy9009/Erzi
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6513102.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
Size 13KB
SHA256 d320fcef46ae85d5f06133a3b8d4f5a7d2dff0886a86d981f3186f464fbb7abb
MD5 12803f40ef0b813626de6e5eb0ec05b2
SHA1 27e32adac36ba9f4d54ecbf53e112158d4e988b5
SHA512 84d7c28b03fdceb94e00fbcc838f203f6cd9e091b67b7ea8dad577a529a0d96eecf3b246a8548c9b7bef1e063aa96525f6b2148b5d0bb79b32a3415e9f151e0a
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1736941.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
Size 225KB
SHA256 9d69e620d8bb7cb24c7d4831312351d09872badc8331594ce05afe46ff56ab3d
MD5 2b7ed1055ddd27afe675dd11da92357a
SHA1 3809cb22cbdda5ba5707892163217563020df5ca
SHA512 549602e7e10ae1b006fafe9d6c1c09d35280a3af8815157dfa9b7664f16bf1682cc782585a24202dd150955073b5e648f0ad8a39add3f95ceeb51a5eb26fc641
SSDEEP 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-21-0x0000000000440000-0x000000000044A000-memory.dmp

Download

memory/228-22-0x00007FFF90803000-0x00007FFF90805000-memory.dmp

Download

memory/2080-47-0x0000000005940000-0x0000000005F58000-memory.dmp

Download

memory/2080-45-0x0000000000840000-0x0000000000870000-memory.dmp

Download

memory/2080-46-0x0000000005160000-0x0000000005166000-memory.dmp

Download

memory/2080-48-0x0000000005430000-0x000000000553A000-memory.dmp

Download

memory/2080-49-0x0000000005320000-0x0000000005332000-memory.dmp

Download

memory/2080-50-0x0000000005380000-0x00000000053BC000-memory.dmp

Download

memory/2080-51-0x00000000053C0000-0x000000000540C000-memory.dmp

Download

memory/3556-41-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3556-40-0x0000000000400000-0x0000000000409000-memory.dmp

Download