amadey | efe008ef2d2f134b3dc13b0e7774cf5afaac37652f491658b45665e175cf12b9

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe
Size

515KB
MD5

105d5754387cc3a3140ccc8660c1e50f
SHA1

8dbb756c10678900b0e33893e81976f82ca0b8b5
SHA256

654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b
SHA512

538caa75dbcbd33065587c29e6ce0bcbf51eddc8ce50ce8b6684381e4ee0d9bb8c603669afc0272c7e8efd614c7ae87a0d78fe1b3a284006d193389c98243e62
SSDEEP

12288:bMrzy90w4dJ/YUR/O0OI/gbs/YYsDYHHlhctsY6Zqztn7Q6ip2:gyV4DHR/VO+/YDknlCtf6ZaV7Q6iM

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7572284.exe	healer
behavioral7/memory/3552-21-0x0000000000630000-0x000000000063A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a7572284.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7572284.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7572284.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7572284.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7572284.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7572284.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7572284.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9832152.exe	family_redline
behavioral7/memory/2516-45-0x0000000000260000-0x0000000000290000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b7237472.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b7237472.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

Processes:

v6755417.exev2587500.exea7572284.exeb7237472.exedanke.exec5022085.exedanke.exed9832152.exedanke.exedanke.exe

pid	process
220	v6755417.exe
1620	v2587500.exe
3552	a7572284.exe
4376	b7237472.exe
2376	danke.exe
1664	c5022085.exe
2596	danke.exe
2516	d9832152.exe
2700	danke.exe
8	danke.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a7572284.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7572284.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7572284.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exev6755417.exev2587500.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6755417.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2587500.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c5022085.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5022085.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5022085.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5022085.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1012 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a7572284.exe

pid process

3552 a7572284.exe
3552 a7572284.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7572284.exe

description pid process

Token: SeDebugPrivilege 3552 a7572284.exe

pid	process
1012	schtasks.exe

pid	process
3552	a7572284.exe
3552	a7572284.exe

description	pid	process
Token: SeDebugPrivilege	3552	a7572284.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exev6755417.exev2587500.exeb7237472.exedanke.execmd.exe

description	pid	process	target process
PID 2508 wrote to memory of 220	2508	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe	v6755417.exe
PID 2508 wrote to memory of 220	2508	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe	v6755417.exe
PID 2508 wrote to memory of 220	2508	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe	v6755417.exe
PID 220 wrote to memory of 1620	220	v6755417.exe	v2587500.exe
PID 220 wrote to memory of 1620	220	v6755417.exe	v2587500.exe
PID 220 wrote to memory of 1620	220	v6755417.exe	v2587500.exe
PID 1620 wrote to memory of 3552	1620	v2587500.exe	a7572284.exe
PID 1620 wrote to memory of 3552	1620	v2587500.exe	a7572284.exe
PID 1620 wrote to memory of 4376	1620	v2587500.exe	b7237472.exe
PID 1620 wrote to memory of 4376	1620	v2587500.exe	b7237472.exe
PID 1620 wrote to memory of 4376	1620	v2587500.exe	b7237472.exe
PID 4376 wrote to memory of 2376	4376	b7237472.exe	danke.exe
PID 4376 wrote to memory of 2376	4376	b7237472.exe	danke.exe
PID 4376 wrote to memory of 2376	4376	b7237472.exe	danke.exe
PID 220 wrote to memory of 1664	220	v6755417.exe	c5022085.exe
PID 220 wrote to memory of 1664	220	v6755417.exe	c5022085.exe
PID 220 wrote to memory of 1664	220	v6755417.exe	c5022085.exe
PID 2376 wrote to memory of 1012	2376	danke.exe	schtasks.exe
PID 2376 wrote to memory of 1012	2376	danke.exe	schtasks.exe
PID 2376 wrote to memory of 1012	2376	danke.exe	schtasks.exe
PID 2376 wrote to memory of 4600	2376	danke.exe	cmd.exe
PID 2376 wrote to memory of 4600	2376	danke.exe	cmd.exe
PID 2376 wrote to memory of 4600	2376	danke.exe	cmd.exe
PID 4600 wrote to memory of 1204	4600	cmd.exe	cmd.exe
PID 4600 wrote to memory of 1204	4600	cmd.exe	cmd.exe
PID 4600 wrote to memory of 1204	4600	cmd.exe	cmd.exe
PID 4600 wrote to memory of 2704	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 2704	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 2704	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 4136	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 4136	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 4136	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 3096	4600	cmd.exe	cmd.exe
PID 4600 wrote to memory of 3096	4600	cmd.exe	cmd.exe
PID 4600 wrote to memory of 3096	4600	cmd.exe	cmd.exe
PID 4600 wrote to memory of 3716	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 3716	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 3716	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 4524	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 4524	4600	cmd.exe	cacls.exe
PID 4600 wrote to memory of 4524	4600	cmd.exe	cacls.exe
PID 2508 wrote to memory of 2516	2508	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe	d9832152.exe
PID 2508 wrote to memory of 2516	2508	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe	d9832152.exe
PID 2508 wrote to memory of 2516	2508	654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe	d9832152.exe

C:\Users\Admin\AppData\Local\Temp\654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe
"C:\Users\Admin\AppData\Local\Temp\654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6755417.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6755417.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2587500.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2587500.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7572284.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7572284.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7237472.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7237472.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1012
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:4524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5022085.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5022085.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1664
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9832152.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9832152.exe
  2⤵
  - Executes dropped EXE
  PID:2516

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2596

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9832152.exe

Filesize
172KB

MD5
f9134fe199fe40d3840de7c2d1cf7626

SHA1
71e84180ecc47673bba3756dc82831c8ca7703d8

SHA256
c185cbb3f086aa9438a168501878f157ee09772c206e1f696c156287ace76601

SHA512
c206352ac9174758c4ff6dbbd87db05ea2221b3f7fe10812f44ab82f04ff83f71003d1bd0c984bf42851411b67112d49a8500dc56fb0d156152b1f810b9eaef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6755417.exe

Filesize
359KB

MD5
20a461e7d991d6c885b03fbdc9e5b3b7

SHA1
30e0195427693c8260ef770662f35f23c4ca443f

SHA256
653c97fa8ec15eec96e7a1f4beeeb050e9f50aa6c1e5ce5df4c2263eb6dea437

SHA512
50d503ef4ac5e60fda82a3f6cca24f794c4bce843fab516fc806ff1a8252a5314c0bfe48c0fdff95bb446e78aa50317dc5f1a655e3feb8e901ebed6082727c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5022085.exe

Filesize
32KB

MD5
cb9bbd4b11ad5758700da13e6572e36f

SHA1
3d87175a25a93e1b5e8d6b5709ceb992057bff66

SHA256
d7f0388d0e3073dee185bf13374239d3abb402249b8ebf340453bdf74912c9f6

SHA512
14d8f936add65adbf28e92d1eab8bb2fa2f2dbd2b87910fc3514a6fe3f628e8b43e1b121ccac73ab4b27a0450b25949690ae6bd42e372c2ee9feb1d54062f6bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2587500.exe

Filesize
235KB

MD5
f7eef894fec935791018acdbc76be540

SHA1
ecb9c5e7e59e23a94b334cbbad0cae9a3dd4fbc8

SHA256
b3c4fe6df97d9176da72d1c43f14a9d7e17a0ceb54c5d6484b8f0efdf4de4dac

SHA512
bedc8c5a123861f0fd010a674074fd99160b5b8c51bf5f31f2efce04a381d0c96ebb1455561ab3caed395c7ce422177cb9639acdbbbcc6798bb429ce61b389f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7572284.exe

Filesize
14KB

MD5
372c645aaebe1317c8abd1b3cb07a9c8

SHA1
7ae5f6ccbfdd090dcad3b0b42348334dad0cb088

SHA256
71ee2c84d850725d9b823d031b8738cac2dd4c3415d7563db32880bd5d7eaac8

SHA512
28213c2ad45c2db75da52201cb1def1313a07084b96d6b8b8eedaef89f5ca190738b8e3c29ec66f4dcc3ae9aabb0b552f40c7ef7ac7dab69cee9738333321500

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7237472.exe

Filesize
227KB

MD5
5da544a0a458ff5ab127e6f315afd32b

SHA1
89fc3d62af1aee2b54a5cf3a8250dc17c220aff3

SHA256
e8632950db05ace2b19055cdba0dec60a681d04bd788ff99784d9df0354ca456

SHA512
64fa91eebd8114be4ecdef0215eeae33d8b03c34e64cf2fea83d0be1b9a8bd5a029bc3f2c60ac28b2659242b6f358b00247256b527293e73bfbe929d98fcbb20

Download Submit
memory/1664-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2516-48-0x000000000A0D0000-0x000000000A1DA000-memory.dmp

Filesize
1.0MB

Download
memory/2516-45-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/2516-46-0x0000000004A40000-0x0000000004A46000-memory.dmp

Filesize
24KB

Download
memory/2516-47-0x000000000A550000-0x000000000AB68000-memory.dmp

Filesize
6.1MB

Download
memory/2516-49-0x000000000A010000-0x000000000A022000-memory.dmp

Filesize
72KB

Download
memory/2516-50-0x000000000A070000-0x000000000A0AC000-memory.dmp

Filesize
240KB

Download
memory/2516-51-0x0000000004500000-0x000000000454C000-memory.dmp

Filesize
304KB

Download
memory/3552-22-0x00007FF8EE563000-0x00007FF8EE565000-memory.dmp

Filesize
8KB

Download
memory/3552-21-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download