amadey | a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe
Size

514KB
MD5

ad9443ce5e431e8295fd202f57cf1d6d
SHA1

330ab81f8d5d8360f11e9e15f6829608c3ed666e
SHA256

2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc
SHA512

d6bfaf96f61d6055c4e368f22542ba85d8d9c77d652480195953db43eced505a7102d5b10d79842e76483f90b1bbfa22a0d2fd6d0a423166efc8c585c3f665fb
SSDEEP

12288:NMrby90ooS9jGwyQikPj16mcXt3Q+snYfeplV3:GyOSTJj143Q7nmebh

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0410470.exe	healer
behavioral1/memory/544-21-0x00000000005C0000-0x00000000005CA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a0410470.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0410470.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0410470.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0410470.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0410470.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0410470.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0410470.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7760520.exe	family_redline
behavioral1/memory/3324-45-0x00000000006F0000-0x0000000000720000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0689294.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	b0689294.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v1715175.exev5470627.exea0410470.exeb0689294.exepdates.exec1053362.exepdates.exed7760520.exepdates.exe

pid process

2996 v1715175.exe
844 v5470627.exe
544 a0410470.exe
5020 b0689294.exe
2840 pdates.exe
1956 c1053362.exe
768 pdates.exe
3324 d7760520.exe
3996 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a0410470.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0410470.exe

pid	process
2996	v1715175.exe
844	v5470627.exe
544	a0410470.exe
5020	b0689294.exe
2840	pdates.exe
1956	c1053362.exe
768	pdates.exe
3324	d7760520.exe
3996	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0410470.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exev1715175.exev5470627.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1715175.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5470627.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c1053362.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1053362.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1053362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1053362.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4176 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a0410470.exe

pid process

544 a0410470.exe
544 a0410470.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a0410470.exe

description pid process

Token: SeDebugPrivilege 544 a0410470.exe

pid	process
4176	schtasks.exe

pid	process
544	a0410470.exe
544	a0410470.exe

description	pid	process
Token: SeDebugPrivilege	544	a0410470.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exev1715175.exev5470627.exeb0689294.exepdates.execmd.exe

description	pid	process	target process
PID 3032 wrote to memory of 2996	3032	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe	v1715175.exe
PID 3032 wrote to memory of 2996	3032	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe	v1715175.exe
PID 3032 wrote to memory of 2996	3032	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe	v1715175.exe
PID 2996 wrote to memory of 844	2996	v1715175.exe	v5470627.exe
PID 2996 wrote to memory of 844	2996	v1715175.exe	v5470627.exe
PID 2996 wrote to memory of 844	2996	v1715175.exe	v5470627.exe
PID 844 wrote to memory of 544	844	v5470627.exe	a0410470.exe
PID 844 wrote to memory of 544	844	v5470627.exe	a0410470.exe
PID 844 wrote to memory of 5020	844	v5470627.exe	b0689294.exe
PID 844 wrote to memory of 5020	844	v5470627.exe	b0689294.exe
PID 844 wrote to memory of 5020	844	v5470627.exe	b0689294.exe
PID 5020 wrote to memory of 2840	5020	b0689294.exe	pdates.exe
PID 5020 wrote to memory of 2840	5020	b0689294.exe	pdates.exe
PID 5020 wrote to memory of 2840	5020	b0689294.exe	pdates.exe
PID 2996 wrote to memory of 1956	2996	v1715175.exe	c1053362.exe
PID 2996 wrote to memory of 1956	2996	v1715175.exe	c1053362.exe
PID 2996 wrote to memory of 1956	2996	v1715175.exe	c1053362.exe
PID 2840 wrote to memory of 4176	2840	pdates.exe	schtasks.exe
PID 2840 wrote to memory of 4176	2840	pdates.exe	schtasks.exe
PID 2840 wrote to memory of 4176	2840	pdates.exe	schtasks.exe
PID 2840 wrote to memory of 4832	2840	pdates.exe	cmd.exe
PID 2840 wrote to memory of 4832	2840	pdates.exe	cmd.exe
PID 2840 wrote to memory of 4832	2840	pdates.exe	cmd.exe
PID 4832 wrote to memory of 5104	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 5104	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 5104	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 4512	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 4512	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 4512	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 2396	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 2396	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 2396	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 2420	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 2420	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 2420	4832	cmd.exe	cmd.exe
PID 4832 wrote to memory of 3304	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 3304	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 3304	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 4948	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 4948	4832	cmd.exe	cacls.exe
PID 4832 wrote to memory of 4948	4832	cmd.exe	cacls.exe
PID 3032 wrote to memory of 3324	3032	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe	d7760520.exe
PID 3032 wrote to memory of 3324	3032	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe	d7760520.exe
PID 3032 wrote to memory of 3324	3032	2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe	d7760520.exe

C:\Users\Admin\AppData\Local\Temp\2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe
"C:\Users\Admin\AppData\Local\Temp\2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1715175.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1715175.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2996

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5470627.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5470627.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0410470.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0410470.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0689294.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0689294.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
6⤵
- Creates scheduled task(s)
PID:4176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:5104

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:N"
7⤵
PID:4512

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:R" /E
7⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2420

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:N"
7⤵
PID:3304

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:R" /E
7⤵
PID:4948

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1053362.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1053362.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1956

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7760520.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7760520.exe
2⤵
- Executes dropped EXE
PID:3324

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:768

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7760520.exe
Filesize
175KB

MD5
647971d0cadf19b3146ed9825e2e2791

SHA1
25435c9b63194809b1ddff2ea49f68336fa16673

SHA256
48b9794032771dfe78fc2c2b15e43e4b0a43143a6d6d5f3cea6e64dbcb976a76

SHA512
24aa9c1d3252a641cf4b4e74ba77d4fcf7a2d8023a71981ab514f0f9cc73bb387e54743dc2c4a17799b71608785292a0399e4c9a891479dcea18ad829b426b20

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1715175.exe
Filesize
359KB

MD5
061c406e23341bbcb1ff5e1801849cb3

SHA1
7ec3197388a3543dc54a754b526a21a74de567c3

SHA256
ae86041c8e819499d71e4c6acc7674c2aa2d49c8bcf4772c06fdcabc12acf52a

SHA512
176444ce621ff202d78fd397690322fa00d124b7ee51a6ef2cce205e5adc08205db4f4b30f866e8cb8132ef72e83462128cf4d124eeaf8c1d5992e5c18e98adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1053362.exe
Filesize
36KB

MD5
ce02f9d79dea88099619df5cb1312f35

SHA1
3c1679bf6d2ad4436f65458e679c66f79d6ae50f

SHA256
855b0ca776047364d7a3d31a44d746dd673f3d6435723e4a5093a1b757584f54

SHA512
6ace95a26369b298fe1b9cefdccea26cb2253a11c829836a51b47b9218fa291586aa6ebb652830d44c0a97b7d1e2caac43a93cad02c5182be21d537322db555d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5470627.exe
Filesize
234KB

MD5
76dddeb11de090d98b3d9edc3df979fe

SHA1
1400ec7994433f280da5b1d84c12d62d8c19702c

SHA256
e13221cfa4276e8a340f3f13212b1fef45770843a843192a8387bbd99143938f

SHA512
35384efa7caf27758daeb5d6f9a3f84c422116b77abed1e0bb0e978366cadaf2fc0d7fe15b1bb98bfe398c1eab3fb32eb9e3e1a582f5097a6779b4e2ab80f9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0410470.exe
Filesize
13KB

MD5
3a21e5d379f54add2172d6948ca4e597

SHA1
f2480642965b7c7a804ad8c62d7a623a815b1b02

SHA256
2db95b60ef54ddb759464792be2f8a007214003a75cbca2de2a12f6d512900d8

SHA512
010b8ac0ec852bbdc5e14f7409fecc81451c197281c1aff63df0acc98f46628151ce2dfabde6bde01e3c1e6b3c031637efee72edd44365afa78bafeaf63dda19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0689294.exe
Filesize
225KB

MD5
4dcc519d9075200e24e18d1eb479b00e

SHA1
93a9cd97d0d7c6c98903391297530577e1228451

SHA256
503f3735fdd75fa98e846ffc940735d1bc0f8c89c60de01dbcb852432d37e834

SHA512
b1494415d70a3bfbabbd26361b68858c3c785121ec49b6c054e0487c5bb1dac33e8e8c0cc404b39b598b4b8458c48795ff9efab1d0bf60dabe50ba41bd6f8423

Download Submit
memory/544-21-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/544-22-0x00007FF9FF2E3000-0x00007FF9FF2E5000-memory.dmp

Filesize
8KB

Download
memory/1956-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3324-45-0x00000000006F0000-0x0000000000720000-memory.dmp

Filesize
192KB

Download
memory/3324-46-0x0000000000DA0000-0x0000000000DA6000-memory.dmp

Filesize
24KB

Download
memory/3324-47-0x000000000AB50000-0x000000000B168000-memory.dmp

Filesize
6.1MB

Download
memory/3324-48-0x000000000A640000-0x000000000A74A000-memory.dmp

Filesize
1.0MB

Download
memory/3324-49-0x0000000005110000-0x0000000005122000-memory.dmp

Filesize
72KB

Download
memory/3324-50-0x000000000A530000-0x000000000A56C000-memory.dmp

Filesize
240KB

Download
memory/3324-51-0x0000000004B00000-0x0000000004B4C000-memory.dmp

Filesize
304KB

Download