amadey | 19ffc101f7c4457a5adb66b38ce5823d52f596b323578de48d3585b1b57d24c6

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe
Size

514KB
MD5

34224bafba80ee4c2ef4d7cc26e983c5
SHA1

978f969321bdad8a20b343cbba8d22370589d48f
SHA256

729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea
SHA512

890361ddd6d7cb18c85190609d988b754dac9b82a2806acba148102d952d5f73fd3d05ddebe6de7918aba217b9759e634518f2552efe3d8db453930181d67592
SSDEEP

12288:1MrLy90fDRO1eZcHs6uy3WvAXdjI4hR0Hp9LV9R/XIqUkLC:Oy2+8cbuy3WvqNhCHXVDIrYC

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2037556.exe	healer
behavioral12/memory/2664-22-0x0000000000620000-0x000000000062A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a2037556.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2037556.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2037556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2037556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2037556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2037556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2037556.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9995990.exe	family_redline
behavioral12/memory/448-44-0x0000000000ED0000-0x0000000000F00000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b6911514.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	b6911514.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v9758243.exev8236123.exea2037556.exeb6911514.exepdates.exec3067524.exed9995990.exepdates.exepdates.exe

pid process

2472 v9758243.exe
4356 v8236123.exe
2664 a2037556.exe
4912 b6911514.exe
4700 pdates.exe
4668 c3067524.exe
448 d9995990.exe
736 pdates.exe
4560 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a2037556.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a2037556.exe

pid	process
2472	v9758243.exe
4356	v8236123.exe
2664	a2037556.exe
4912	b6911514.exe
4700	pdates.exe
4668	c3067524.exe
448	d9995990.exe
736	pdates.exe
4560	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2037556.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exev9758243.exev8236123.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9758243.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8236123.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c3067524.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c3067524.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c3067524.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c3067524.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4612 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a2037556.exe

pid process

2664 a2037556.exe
2664 a2037556.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a2037556.exe

description pid process

Token: SeDebugPrivilege 2664 a2037556.exe

pid	process
4612	schtasks.exe

pid	process
2664	a2037556.exe
2664	a2037556.exe

description	pid	process
Token: SeDebugPrivilege	2664	a2037556.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exev9758243.exev8236123.exeb6911514.exepdates.execmd.exe

description	pid	process	target process
PID 3872 wrote to memory of 2472	3872	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe	v9758243.exe
PID 3872 wrote to memory of 2472	3872	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe	v9758243.exe
PID 3872 wrote to memory of 2472	3872	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe	v9758243.exe
PID 2472 wrote to memory of 4356	2472	v9758243.exe	v8236123.exe
PID 2472 wrote to memory of 4356	2472	v9758243.exe	v8236123.exe
PID 2472 wrote to memory of 4356	2472	v9758243.exe	v8236123.exe
PID 4356 wrote to memory of 2664	4356	v8236123.exe	a2037556.exe
PID 4356 wrote to memory of 2664	4356	v8236123.exe	a2037556.exe
PID 4356 wrote to memory of 4912	4356	v8236123.exe	b6911514.exe
PID 4356 wrote to memory of 4912	4356	v8236123.exe	b6911514.exe
PID 4356 wrote to memory of 4912	4356	v8236123.exe	b6911514.exe
PID 4912 wrote to memory of 4700	4912	b6911514.exe	pdates.exe
PID 4912 wrote to memory of 4700	4912	b6911514.exe	pdates.exe
PID 4912 wrote to memory of 4700	4912	b6911514.exe	pdates.exe
PID 2472 wrote to memory of 4668	2472	v9758243.exe	c3067524.exe
PID 2472 wrote to memory of 4668	2472	v9758243.exe	c3067524.exe
PID 2472 wrote to memory of 4668	2472	v9758243.exe	c3067524.exe
PID 3872 wrote to memory of 448	3872	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe	d9995990.exe
PID 3872 wrote to memory of 448	3872	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe	d9995990.exe
PID 3872 wrote to memory of 448	3872	729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe	d9995990.exe
PID 4700 wrote to memory of 4612	4700	pdates.exe	schtasks.exe
PID 4700 wrote to memory of 4612	4700	pdates.exe	schtasks.exe
PID 4700 wrote to memory of 4612	4700	pdates.exe	schtasks.exe
PID 4700 wrote to memory of 1396	4700	pdates.exe	cmd.exe
PID 4700 wrote to memory of 1396	4700	pdates.exe	cmd.exe
PID 4700 wrote to memory of 1396	4700	pdates.exe	cmd.exe
PID 1396 wrote to memory of 3400	1396	cmd.exe	cmd.exe
PID 1396 wrote to memory of 3400	1396	cmd.exe	cmd.exe
PID 1396 wrote to memory of 3400	1396	cmd.exe	cmd.exe
PID 1396 wrote to memory of 3616	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 3616	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 3616	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 2264	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 2264	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 2264	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 3084	1396	cmd.exe	cmd.exe
PID 1396 wrote to memory of 3084	1396	cmd.exe	cmd.exe
PID 1396 wrote to memory of 3084	1396	cmd.exe	cmd.exe
PID 1396 wrote to memory of 4844	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 4844	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 4844	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 5080	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 5080	1396	cmd.exe	cacls.exe
PID 1396 wrote to memory of 5080	1396	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe
"C:\Users\Admin\AppData\Local\Temp\729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3872

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9758243.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9758243.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8236123.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8236123.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4356

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2037556.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2037556.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6911514.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6911514.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
6⤵
- Creates scheduled task(s)
PID:4612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3400

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:N"
7⤵
PID:3616

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:R" /E
7⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3084

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:N"
7⤵
PID:4844

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:R" /E
7⤵
PID:5080

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3067524.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3067524.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4668

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9995990.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9995990.exe
2⤵
- Executes dropped EXE
PID:448

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:736

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9995990.exe
Filesize
173KB

MD5
82272970e8557d9bdcd29d3dcc2af441

SHA1
0f12180cbe8f9cca11ea0a07df5c3683f4007b09

SHA256
d7777c84268ca0d047ddce997f76fd17654e661ba7ccbbe2e1d184669114ede7

SHA512
08721c6d4666312dc322f2ea848e7e1cda4ed1dc4a3e83cad8a62ab6c4fbf7968acb68d6054ab4c0e9757dbfe1abe481a738637dd052daca7c0f268c7620336e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9758243.exe
Filesize
359KB

MD5
abf9d89a34b06d6f61fc036a6b92a314

SHA1
d415dd212d5cae8bdfa864b5a6a8aa616056ed9c

SHA256
23a7242b34faf2fe65e8c459e2f1e409eabf56b87169f0d76795644cb778eb39

SHA512
54949548c32035f8ff8da57a68dbdebf870598b5735bf0b0162a49234a107258af9219112304c66bc947f4ff6711cb26cd94743cbffe36fbd0363d65b5009446

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3067524.exe
Filesize
36KB

MD5
69d19cb0ae5efc1681018dc89feaf5d4

SHA1
1cd77651dcbef0a1da387dad78a5667fb4d7805d

SHA256
12b9fb30a3b5c93abc180037dfcc5ba55547807b8e1b397d807d0d3a3dd79cae

SHA512
da9c5647b129e5990f9c0806c947aaace1fcb09010b66b68bf5d7afc781017755522e72b0f704cfb4635dac21fd7b783a203267993e4cac595630fcf251bdba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8236123.exe
Filesize
234KB

MD5
a7f0088e3a5ea0f52c5faf6ee4deebfd

SHA1
985aab914633e0d92d8cc6d0daf9c3f98e85a53d

SHA256
0eb954c26f144a5b2eaa8bec5728b1b9cc08bf98df5df5b7422ead3ba8429d5f

SHA512
cdf3f795532511e07b0bef19558c36530621ed49b143dda187882af63c6ffd2ec27748ad1d1d9ac9f24fc0f4dcff9a5f3763df547f997f21ae5d1a11250bd348

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2037556.exe
Filesize
13KB

MD5
06f9ea1b9d99aeffa658940300e5b3e9

SHA1
203ed88851ce92ca9fc935b5e9cd9ea635134521

SHA256
4afd5d4a8b6fe6f193572915a00f0d64abf365a92588643d58c34b30cceca324

SHA512
e6ace7bc58005f92c3207d3fe4da785e6795ea9f86d95a5648c802d6d5a10adf89786c201911745ad20796fc3923e86d0def2913d7015b140809e06b59b59865

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6911514.exe
Filesize
225KB

MD5
08fb0a39e54c5f25a5ef13805b240ef6

SHA1
7c4815bdebfb69cb6ed09f9af8c1febd70b09f0b

SHA256
857a3a468952305783338ea17fbac38c0c3b4509a045142886195b0de4e4fe22

SHA512
8bffd267209d12ddd0401a3c72cd033280530f10a064bb8db1e5dd4f938e7f46b60b0e00443d306121318bf253201b43e5d324b6793d69815eab22893982ce39

Download Submit
memory/448-47-0x0000000005AD0000-0x0000000005BDA000-memory.dmp

Filesize
1.0MB

Download
memory/448-44-0x0000000000ED0000-0x0000000000F00000-memory.dmp

Filesize
192KB

Download
memory/448-45-0x00000000057F0000-0x00000000057F6000-memory.dmp

Filesize
24KB

Download
memory/448-46-0x0000000005FE0000-0x00000000065F8000-memory.dmp

Filesize
6.1MB

Download
memory/448-48-0x0000000005890000-0x00000000058A2000-memory.dmp

Filesize
72KB

Download
memory/448-49-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/448-50-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download
memory/2664-22-0x0000000000620000-0x000000000062A000-memory.dmp

Filesize
40KB

Download
memory/2664-21-0x00007FFDAA663000-0x00007FFDAA665000-memory.dmp

Filesize
8KB

Download
memory/4668-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download