amadey | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Size 514KB
Sample240510-prnxbsef21
SHA256 1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e
MD5 1942d1d3d93833f0a1d4f5381ce33a23
SHA1 4056636db4625bb6b3fee03b4c1be992681affa9
SHA512 a9569c93345b4565b8e9bd30a1b09400eaba1ddeb3fbcf00d53563d1ba34d4d6f4f5bba9ffe6852ff699de66e8177eab35ffc771741fd9d528e6802726aa3a6c
SSDEEP 12288:SMrqy908fsn+JqW9WsGJPMj1kn4tBA6jmcRyqBq08:4yIEqwWsKmy4YikWJ8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey healer redline smokeloader roma backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

roma

77.91.68.56:19071

Attributes

auth_value
f099c2cf92834dbc554a94e1456cf576

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral5/files/0x0008000000023417-19.dat	healer
behavioral5/memory/3680-22-0x0000000000C30000-0x0000000000C3A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7008015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7008015.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7008015.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x0007000000023412-43.dat	family_redline
behavioral5/memory/1372-45-0x0000000000030000-0x0000000000060000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	danke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	b7865879.exe

Executes dropped EXE 9 IoCs

pid	Process
2604	v5770759.exe
2516	v1936485.exe
3680	a7008015.exe
4168	b7865879.exe
4152	danke.exe
4824	c5034781.exe
1372	d3489522.exe
2676	danke.exe
2504	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7008015.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5770759.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1936485.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5034781.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5034781.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5034781.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	a7008015.exe
3680	a7008015.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	a7008015.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2604	4512	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	84
PID 4512 wrote to memory of 2604	4512	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	84
PID 4512 wrote to memory of 2604	4512	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	84
PID 2604 wrote to memory of 2516	2604	v5770759.exe	85
PID 2604 wrote to memory of 2516	2604	v5770759.exe	85
PID 2604 wrote to memory of 2516	2604	v5770759.exe	85
PID 2516 wrote to memory of 3680	2516	v1936485.exe	86
PID 2516 wrote to memory of 3680	2516	v1936485.exe	86
PID 2516 wrote to memory of 4168	2516	v1936485.exe	97
PID 2516 wrote to memory of 4168	2516	v1936485.exe	97
PID 2516 wrote to memory of 4168	2516	v1936485.exe	97
PID 4168 wrote to memory of 4152	4168	b7865879.exe	98
PID 4168 wrote to memory of 4152	4168	b7865879.exe	98
PID 4168 wrote to memory of 4152	4168	b7865879.exe	98
PID 2604 wrote to memory of 4824	2604	v5770759.exe	100
PID 2604 wrote to memory of 4824	2604	v5770759.exe	100
PID 2604 wrote to memory of 4824	2604	v5770759.exe	100
PID 4152 wrote to memory of 3660	4152	danke.exe	101
PID 4152 wrote to memory of 3660	4152	danke.exe	101
PID 4152 wrote to memory of 3660	4152	danke.exe	101
PID 4152 wrote to memory of 1604	4152	danke.exe	103
PID 4152 wrote to memory of 1604	4152	danke.exe	103
PID 4152 wrote to memory of 1604	4152	danke.exe	103
PID 1604 wrote to memory of 1632	1604	cmd.exe	105
PID 1604 wrote to memory of 1632	1604	cmd.exe	105
PID 1604 wrote to memory of 1632	1604	cmd.exe	105
PID 1604 wrote to memory of 1416	1604	cmd.exe	106
PID 1604 wrote to memory of 1416	1604	cmd.exe	106
PID 1604 wrote to memory of 1416	1604	cmd.exe	106
PID 1604 wrote to memory of 1448	1604	cmd.exe	107
PID 1604 wrote to memory of 1448	1604	cmd.exe	107
PID 1604 wrote to memory of 1448	1604	cmd.exe	107
PID 1604 wrote to memory of 4860	1604	cmd.exe	108
PID 1604 wrote to memory of 4860	1604	cmd.exe	108
PID 1604 wrote to memory of 4860	1604	cmd.exe	108
PID 1604 wrote to memory of 2528	1604	cmd.exe	109
PID 1604 wrote to memory of 2528	1604	cmd.exe	109
PID 1604 wrote to memory of 2528	1604	cmd.exe	109
PID 1604 wrote to memory of 2228	1604	cmd.exe	110
PID 1604 wrote to memory of 2228	1604	cmd.exe	110
PID 1604 wrote to memory of 2228	1604	cmd.exe	110
PID 4512 wrote to memory of 1372	4512	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	114
PID 4512 wrote to memory of 1372	4512	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	114
PID 4512 wrote to memory of 1372	4512	1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe	114

C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
"C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3660
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:2228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
  2⤵
  - Executes dropped EXE
  PID:1372

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2676

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d3489522.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
Size 174KB
SHA256 64faeec435f51816cff0efdacc9e777d677400fd7a59bc1e037a24ec7ae7cb4b
MD5 fd61776b34b5a58e732533da17d122d0
SHA1 336015c059047a658ea57b6ebe49418d23a65593
SHA512 afbd9465a721b8e447359c88451f9525ecc5f3aedf79be424b49d4a93d5921797854471257fb1f1ea7d967e56d54aec7b712773875f92fd4335e5a12afd4fc68
SSDEEP 3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

v5770759.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
Size 359KB
SHA256 e7da30afc9870af8478dffe8cb7c3517dbcd725d83d3c9e7435cc5bcfaa1a76d
MD5 e5fee7b57e9630eb6cbe1861cb6d1a82
SHA1 de69d6c77a4db78be5c7239199528da46bd4a9b9
SHA512 c7af1fd9383094548929920e18b2adeb6d07fded702fc748f557d913ad8521c666e419aee611d994ec94154830967e39d797a98ba0cd18ab10548ce85f6a02ba
SSDEEP 6144:Kay+bnr+mp0yN90QEmm3tVvKZCI6PqiXYSPMjKTk0VOntBmI6y9iZ9:GMryy90t/hqTSPMjok04tBX6+q9
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5034781.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
Size 31KB
SHA256 129a6c5e5a8d98619b5be3818dfde6bab9c5345171d9d8401b886fed0660817a
MD5 c4c414d786976435cb8561c43d8dc57d
SHA1 fd73133d3509d1a6982b000a75b9dbdc7769ec22
SHA512 744106f95b8f57ea59e2906a7cbaf2e1a172cee013be12f0752b3308c428f92f9824a2497f3fced82d9124d3ab52448d3b240889fdad26925e710aa47f67b028
SSDEEP 384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1936485.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
Size 235KB
SHA256 0bd882b9fd1549e5b281cbaa19a8a2a2952a03219737db0af5cadf4e817c0561
MD5 b3f0cfa1b2d4fab75074fe1a7b426ebb
SHA1 61d950a5d649826b8b646453df4398cdd56189b9
SHA512 0141c9f835859df5fa0d8a04d010482961a693bada72d57e60677ee84b79bc86e59b523b3a4f9168fb240a815d9f80fbba05cc0d5f5a7f7d0415d0eabef699d0
SSDEEP 6144:Kby+bnr+Mp0yN90QEII+sXSUzisqdQCA+S:1Mr8y90+m33x+S
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7008015.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
Size 13KB
SHA256 d039e2510d33b0cca9b9d06c2be8152c5e126660c7860649dd966e1a7b375e9c
MD5 c9767fb557c8496da35f32149019f254
SHA1 dc206616148aad4e06dd3fb380d34b4ba15a9c6d
SHA512 f9c225248b0a8f9766b936694f71b347a0f006110928d26717d886d6b78f1b9ea3b3518a3123004cb20c4d4ffa5eb394bd169641163b297046a967f1ac9c4445
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7865879.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
Size 225KB
SHA256 2c0f306d091f752e409e8bcbe20934ffa23430a90dea79c62aff27ee1b3035cf
MD5 9728e9852854da025b4314bd0fd3687c
SHA1 6a87c09c8e29b6ca1c336416088f12cce0c206f8
SHA512 23df44bd9f5ae665f2d4c320603162b1d98b30b5610e99b5a9082843d76f0a6444e83e1c1792c2febf20d771b297777af8faa0403ba80f2f3f8b1c487abf7144
SSDEEP 3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1372-51-0x0000000002440000-0x000000000248C000-memory.dmp

Download

memory/1372-48-0x000000000A030000-0x000000000A13A000-memory.dmp

Download

memory/1372-50-0x0000000009F80000-0x0000000009FBC000-memory.dmp

Download

memory/1372-49-0x0000000009F20000-0x0000000009F32000-memory.dmp

Download

memory/1372-45-0x0000000000030000-0x0000000000060000-memory.dmp

Download

memory/1372-46-0x00000000024C0000-0x00000000024C6000-memory.dmp

Download

memory/1372-47-0x000000000A540000-0x000000000AB58000-memory.dmp

Download

memory/3680-22-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Download

memory/3680-21-0x00007FFFEC053000-0x00007FFFEC055000-memory.dmp

Download

memory/4824-41-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4824-39-0x0000000000400000-0x0000000000409000-memory.dmp

Download