amadey | e6564b70fa3d9a9e989ad7c1bb2b027f2e5447273c0bb64f84c7940828ecb0ed

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
Size

515KB
MD5

3133d51b9cb5dff2ffb1eb479a3a8197
SHA1

c7751780b417509447b6374f2044c4a70bd3aea2
SHA256

6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3
SHA512

4d0249966b11f4933be1aa3126d2ebd6d93700ff22f858457c0cde49a6e691f89d6480068f00d26b5aaa07b48f71ec0ec67f6ad6951d92815777801153789ae2
SSDEEP

12288:2Mr3y90Mp419rk/h+B4egjTgl+ZP3SFgHEgD/r17DZ:ByDp4vg+uegjTgl6PQeESr91

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe	healer
behavioral12/memory/2480-22-0x0000000000DF0000-0x0000000000DFA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a6050394.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6050394.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6050394.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6050394.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9946860.exe	family_redline
behavioral12/memory/4080-44-0x0000000000E10000-0x0000000000E40000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b5038122.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b5038122.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

Processes:

v2439283.exev6626793.exea6050394.exeb5038122.exedanke.exec9387752.exed9946860.exedanke.exedanke.exedanke.exe

pid	process
752	v2439283.exe
1132	v6626793.exe
2480	a6050394.exe
3692	b5038122.exe
4652	danke.exe
4356	c9387752.exe
4080	d9946860.exe
3200	danke.exe
3964	danke.exe
4580	danke.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a6050394.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6050394.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6050394.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exev2439283.exev6626793.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2439283.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6626793.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c9387752.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9387752.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9387752.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9387752.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4456 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a6050394.exe

pid process

2480 a6050394.exe
2480 a6050394.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6050394.exe

description pid process

Token: SeDebugPrivilege 2480 a6050394.exe

pid	process
4456	schtasks.exe

pid	process
2480	a6050394.exe
2480	a6050394.exe

description	pid	process
Token: SeDebugPrivilege	2480	a6050394.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exev2439283.exev6626793.exeb5038122.exedanke.execmd.exe

description	pid	process	target process
PID 5064 wrote to memory of 752	5064	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	v2439283.exe
PID 5064 wrote to memory of 752	5064	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	v2439283.exe
PID 5064 wrote to memory of 752	5064	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	v2439283.exe
PID 752 wrote to memory of 1132	752	v2439283.exe	v6626793.exe
PID 752 wrote to memory of 1132	752	v2439283.exe	v6626793.exe
PID 752 wrote to memory of 1132	752	v2439283.exe	v6626793.exe
PID 1132 wrote to memory of 2480	1132	v6626793.exe	a6050394.exe
PID 1132 wrote to memory of 2480	1132	v6626793.exe	a6050394.exe
PID 1132 wrote to memory of 3692	1132	v6626793.exe	b5038122.exe
PID 1132 wrote to memory of 3692	1132	v6626793.exe	b5038122.exe
PID 1132 wrote to memory of 3692	1132	v6626793.exe	b5038122.exe
PID 3692 wrote to memory of 4652	3692	b5038122.exe	danke.exe
PID 3692 wrote to memory of 4652	3692	b5038122.exe	danke.exe
PID 3692 wrote to memory of 4652	3692	b5038122.exe	danke.exe
PID 752 wrote to memory of 4356	752	v2439283.exe	c9387752.exe
PID 752 wrote to memory of 4356	752	v2439283.exe	c9387752.exe
PID 752 wrote to memory of 4356	752	v2439283.exe	c9387752.exe
PID 5064 wrote to memory of 4080	5064	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	d9946860.exe
PID 5064 wrote to memory of 4080	5064	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	d9946860.exe
PID 5064 wrote to memory of 4080	5064	6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe	d9946860.exe
PID 4652 wrote to memory of 4456	4652	danke.exe	schtasks.exe
PID 4652 wrote to memory of 4456	4652	danke.exe	schtasks.exe
PID 4652 wrote to memory of 4456	4652	danke.exe	schtasks.exe
PID 4652 wrote to memory of 4672	4652	danke.exe	cmd.exe
PID 4652 wrote to memory of 4672	4652	danke.exe	cmd.exe
PID 4652 wrote to memory of 4672	4652	danke.exe	cmd.exe
PID 4672 wrote to memory of 4776	4672	cmd.exe	cmd.exe
PID 4672 wrote to memory of 4776	4672	cmd.exe	cmd.exe
PID 4672 wrote to memory of 4776	4672	cmd.exe	cmd.exe
PID 4672 wrote to memory of 3204	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3204	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3204	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3096	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3096	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3096	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 4108	4672	cmd.exe	cmd.exe
PID 4672 wrote to memory of 4108	4672	cmd.exe	cmd.exe
PID 4672 wrote to memory of 4108	4672	cmd.exe	cmd.exe
PID 4672 wrote to memory of 3704	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3704	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 3704	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 4632	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 4632	4672	cmd.exe	cacls.exe
PID 4672 wrote to memory of 4632	4672	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
"C:\Users\Admin\AppData\Local\Temp\6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5064

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2439283.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2439283.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6626793.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6626793.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1132

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5038122.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5038122.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
6⤵
- Creates scheduled task(s)
PID:4456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4776

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:N"
7⤵
PID:3204

C:\Windows\SysWOW64\cacls.exe
CACLS "danke.exe" /P "Admin:R" /E
7⤵
PID:3096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4108

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:N"
7⤵
PID:3704

C:\Windows\SysWOW64\cacls.exe
CACLS "..\3ec1f323b5" /P "Admin:R" /E
7⤵
PID:4632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9387752.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9387752.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4356

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9946860.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9946860.exe
2⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9946860.exe
Filesize
173KB

MD5
b787561ef39443cd949621f9c189edce

SHA1
6fa6607cb82c22e522547240c8fc40a69cc7c3f7

SHA256
75fe759176072d5688b12d57a87b086cd843600351d953b9ae7672dfe407fc56

SHA512
3fc333966851e5179410aee1b2cfc788d20ce8057af2f1205c2a15add8c77f87e474f404c5cf91d6b5f37e35270ff3596c8c22cfbde61e6b93766f37f575a59e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2439283.exe
Filesize
359KB

MD5
1867f755c2e50bec05eb667e0d0a1184

SHA1
8fb81278c740f702f51a45a067b28c2b2564e2ed

SHA256
f34e8c5cb56f19f07740954bfbda5b828aec62e6cb8d7cadbf1354b3f811c2d2

SHA512
30148c0a3b0fc230fa4f455493319343186b7f9d71b33388133ab772ea0a10460d40514bda15486591f0da714904f7a1239c40274fd18fd19b8eb872c4be0cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9387752.exe
Filesize
32KB

MD5
df6d3dd8d25c7c1afe3a7756ed9e9ecc

SHA1
a66f386ff69133f8ba6478ae69d56b7880ac0177

SHA256
9916aae975cc1b7af1360bc7de341ddc914a619eeb9cb468cc713147ca4e95f8

SHA512
4c6ec99bd9b06fc4723aefd5a7a637f641aba4fca5d40ae89555a52ec286557675335f2d22ab83710c07a0cd93bbbbcb55614288b4a3cb436c484b7ba173d59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6626793.exe
Filesize
235KB

MD5
f4707a9db7540780ee9da722fde3e0d8

SHA1
38c1069235780f3b2132f28cf526557d418b62b5

SHA256
cb1f767773f8b86ba74d1fac8848b3130be3bc93cc3930e1d123abe7d9329de9

SHA512
1e61b996234ad10e82753fdd995d3a87781b57585e4e24ea8bd11b506541bf57e2f4915f6ea6d8ed0665d23920a0e556723143cb0a4986a46c637f1d02431290

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6050394.exe
Filesize
14KB

MD5
a74dd029101a25504d8fc7ca33c1adc2

SHA1
22cc29079d98d3ff79f13b8ebf9a27c67757594e

SHA256
1361d5cc17da4688d29e0a60cdb9fe1669d80f3c999292e2467969cf898f3f84

SHA512
2a6bb5b8fe48c838d9af2c95a32b69729e32ee0d2ce1fe35d281b286e910657a8792037d3a52b825d24d7e69730eff09f99ec549ecd3da6e4cb69a277a81f5d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5038122.exe
Filesize
227KB

MD5
787410f258f680e28c135ac0ecc645ca

SHA1
06505649a3c2729796b57e7de0869c8b5a2fd84c

SHA256
064ca5e3fc52bd168e29697fc755b7310781344cafad50e1cd14555e7255641e

SHA512
3c5c3d74569766c30fabe448ec04e1560de75ba10244c4179b0b19deda31ecf5207b7545b6e1c8411e2587409f7d5ca54f35cb04f2bcba109239f83d48294580

Download Submit
memory/2480-22-0x0000000000DF0000-0x0000000000DFA000-memory.dmp

Filesize
40KB

Download
memory/2480-21-0x00007FFCCB063000-0x00007FFCCB065000-memory.dmp

Filesize
8KB

Download
memory/4080-44-0x0000000000E10000-0x0000000000E40000-memory.dmp

Filesize
192KB

Download
memory/4080-45-0x0000000003290000-0x0000000003296000-memory.dmp

Filesize
24KB

Download
memory/4080-46-0x000000000B350000-0x000000000B968000-memory.dmp

Filesize
6.1MB

Download
memory/4080-47-0x000000000AE40000-0x000000000AF4A000-memory.dmp

Filesize
1.0MB

Download
memory/4080-48-0x0000000005970000-0x0000000005982000-memory.dmp

Filesize
72KB

Download
memory/4080-49-0x000000000AD70000-0x000000000ADAC000-memory.dmp

Filesize
240KB

Download
memory/4080-50-0x0000000003200000-0x000000000324C000-memory.dmp

Filesize
304KB

Download
memory/4356-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download