amadey | 19ffc101f7c4457a5adb66b38ce5823d52f596b323578de48d3585b1b57d24c6

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
Size

514KB
MD5

3596d2031894bae219111af96da907c0
SHA1

21c0f19aa3d9e05ee8d8c6433acce202f0e60ab6
SHA256

55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce
SHA512

057ddc2bd1f41cb1a07078de858578a79ec3a3f8601741c671c20400d14658a0ba0f34fc455b35c6b6ed8f5887cd7d524bf43d25b41d90b7ea5a44c8f00be966
SSDEEP

6144:KHy+bnr+zp0yN90QESKrrG+f2s1De9WhDPxn7r6DM59U1UHSllzk7dX632XG8FWU:5MrLy90BOJW55n7rDdHIlzF36xooH

Score

10^/10

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

news

77.91.68.68:19071

Attributes

auth_value
99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe	healer
behavioral8/memory/1488-21-0x0000000000F90000-0x0000000000F9A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a1887952.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1887952.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1887952.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe	family_redline
behavioral8/memory/2132-44-0x0000000000A10000-0x0000000000A40000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b1416740.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	b1416740.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v2566214.exev0147678.exea1887952.exeb1416740.exepdates.exec2864142.exed8069388.exepdates.exepdates.exe

pid process

3616 v2566214.exe
4316 v0147678.exe
1488 a1887952.exe
1388 b1416740.exe
3116 pdates.exe
3904 c2864142.exe
2132 d8069388.exe
4440 pdates.exe
4116 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a1887952.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1887952.exe

pid	process
3616	v2566214.exe
4316	v0147678.exe
1488	a1887952.exe
1388	b1416740.exe
3116	pdates.exe
3904	c2864142.exe
2132	d8069388.exe
4440	pdates.exe
4116	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1887952.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exev2566214.exev0147678.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2566214.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0147678.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c2864142.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2864142.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2864142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2864142.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2260 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1887952.exe

pid process

1488 a1887952.exe
1488 a1887952.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a1887952.exe

description pid process

Token: SeDebugPrivilege 1488 a1887952.exe

pid	process
2260	schtasks.exe

pid	process
1488	a1887952.exe
1488	a1887952.exe

description	pid	process
Token: SeDebugPrivilege	1488	a1887952.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exev2566214.exev0147678.exeb1416740.exepdates.execmd.exe

description	pid	process	target process
PID 2984 wrote to memory of 3616	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	v2566214.exe
PID 2984 wrote to memory of 3616	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	v2566214.exe
PID 2984 wrote to memory of 3616	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	v2566214.exe
PID 3616 wrote to memory of 4316	3616	v2566214.exe	v0147678.exe
PID 3616 wrote to memory of 4316	3616	v2566214.exe	v0147678.exe
PID 3616 wrote to memory of 4316	3616	v2566214.exe	v0147678.exe
PID 4316 wrote to memory of 1488	4316	v0147678.exe	a1887952.exe
PID 4316 wrote to memory of 1488	4316	v0147678.exe	a1887952.exe
PID 4316 wrote to memory of 1388	4316	v0147678.exe	b1416740.exe
PID 4316 wrote to memory of 1388	4316	v0147678.exe	b1416740.exe
PID 4316 wrote to memory of 1388	4316	v0147678.exe	b1416740.exe
PID 1388 wrote to memory of 3116	1388	b1416740.exe	pdates.exe
PID 1388 wrote to memory of 3116	1388	b1416740.exe	pdates.exe
PID 1388 wrote to memory of 3116	1388	b1416740.exe	pdates.exe
PID 3616 wrote to memory of 3904	3616	v2566214.exe	c2864142.exe
PID 3616 wrote to memory of 3904	3616	v2566214.exe	c2864142.exe
PID 3616 wrote to memory of 3904	3616	v2566214.exe	c2864142.exe
PID 3116 wrote to memory of 2260	3116	pdates.exe	schtasks.exe
PID 3116 wrote to memory of 2260	3116	pdates.exe	schtasks.exe
PID 3116 wrote to memory of 2260	3116	pdates.exe	schtasks.exe
PID 3116 wrote to memory of 1736	3116	pdates.exe	cmd.exe
PID 3116 wrote to memory of 1736	3116	pdates.exe	cmd.exe
PID 3116 wrote to memory of 1736	3116	pdates.exe	cmd.exe
PID 1736 wrote to memory of 4652	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 4652	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 4652	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 2108	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 2108	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 2108	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 5048	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 5048	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 5048	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 3036	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 3036	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 3036	1736	cmd.exe	cmd.exe
PID 1736 wrote to memory of 636	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 636	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 636	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 872	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 872	1736	cmd.exe	cacls.exe
PID 1736 wrote to memory of 872	1736	cmd.exe	cacls.exe
PID 2984 wrote to memory of 2132	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	d8069388.exe
PID 2984 wrote to memory of 2132	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	d8069388.exe
PID 2984 wrote to memory of 2132	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	d8069388.exe

C:\Users\Admin\AppData\Local\Temp\55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
"C:\Users\Admin\AppData\Local\Temp\55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2566214.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2566214.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3616

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0147678.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0147678.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1416740.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1416740.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
6⤵
- Creates scheduled task(s)
PID:2260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4652

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:N"
7⤵
PID:2108

C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:R" /E
7⤵
PID:5048

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3036

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:N"
7⤵
PID:636

C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:R" /E
7⤵
PID:872

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2864142.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2864142.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3904

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe
2⤵
- Executes dropped EXE
PID:2132

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe
Filesize
175KB

MD5
5b710050da5fa29668f5e65bcd26b77a

SHA1
7fbc2d52076fadf2d463529dcff70eaad98cedd6

SHA256
8999e65eae8cff841020771fa8b81959f1178d42fcff2ca9652618c5cd8877fa

SHA512
27945f266fd2fea5de25b669abd3b0ff5022e191b950e25045fbf7f7b2addc36b4dd2c732db1dad8886aedd45681d0ce7176c723648a278052801c0775485186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2566214.exe
Filesize
358KB

MD5
025518f9f75d68afc626b8fdae033de5

SHA1
1526adcd1196de1e8f01e95592b08ba73721dc2f

SHA256
4ed863f7b3b7493c6f5809e8e83d6ce9a9132b49b64602ebc89e14b2eed79834

SHA512
1b1bd5e92952125876afbbaa5e162d44a9d85f280f9a2e80560362f6b2cb8879bda990abe1d2ed9569644e5b024b5b283a10a6b8dd90163817997c3cdbb8703a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2864142.exe
Filesize
35KB

MD5
32c7040e547bf9cd25df85aa47c3cbf6

SHA1
60bc64c033d79b5af2350fcb20981e34076fea81

SHA256
9b80db8a9e5c33a69eb46cc19255649a1822eee80090756d068b196daf1cb71e

SHA512
7ad6b3e8f96199bbf07107b08c4f27a12d40338103f1bf2f0d1dc97069c36e4de99e563c93b49b65a76cb5f4fb0be6ceece10b89d9fe9c976b79ea4e1c2fff17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0147678.exe
Filesize
234KB

MD5
57648417a68b6f1f8a03a685caf88d79

SHA1
d691aaeab8eb7dc8d7300b84b13b85217ff1e9af

SHA256
aaac203900178a544f55644dc0fcbc403cd2b4c4ba39f1fc38513ee55f059667

SHA512
50b51eafe17895013bf055cda13954265426da2205cfab51d3a813ba253c0342f9c0bd40a262eb3be83c998229b54cd6a35cd038eb1d27e8d5bf97e04233649f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe
Filesize
11KB

MD5
35148121e93b2903c6ea720f4af0e8fd

SHA1
ff33ed98166a08008b3d3212435c0e3707204229

SHA256
a65380126b5f7615f67af3f925864e43edbee91028aa58cf9783f28a5e7f2071

SHA512
5517fd5c0a0e7685ff93cf12b6fecadf9d3f57bb37a8f7d76e7db0c2914b672c1d9006efd86d081fe1f5b1afdc020a5d476534e15914f58a9b6ebc94fd41be2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1416740.exe
Filesize
223KB

MD5
e6df1c01ec99b43dcb015c4e7cb0f527

SHA1
7f1415a6aca7900575a356625f0ea7ece4a6b6f3

SHA256
a31e09926730956b52a5a85d0b31475527087b9b4d2eed66536c2d73db1b23d8

SHA512
4889381ecf967f05fdd3e69149e06fd2c62449f7144aa13a9019b3bef329ec7a46373313b5cb9fbdf9d6f00d89075dc24f983518a585dc01a0cb1761380293df

Download Submit
memory/1488-22-0x00007FF8CE503000-0x00007FF8CE505000-memory.dmp

Filesize
8KB

Download
memory/1488-21-0x0000000000F90000-0x0000000000F9A000-memory.dmp

Filesize
40KB

Download
memory/2132-44-0x0000000000A10000-0x0000000000A40000-memory.dmp

Filesize
192KB

Download
memory/2132-45-0x0000000005370000-0x0000000005376000-memory.dmp

Filesize
24KB

Download
memory/2132-46-0x000000000AF00000-0x000000000B518000-memory.dmp

Filesize
6.1MB

Download
memory/2132-47-0x000000000A9F0000-0x000000000AAFA000-memory.dmp

Filesize
1.0MB

Download
memory/2132-48-0x000000000A900000-0x000000000A912000-memory.dmp

Filesize
72KB

Download
memory/2132-49-0x000000000A960000-0x000000000A99C000-memory.dmp

Filesize
240KB

Download
memory/2132-50-0x0000000004E20000-0x0000000004E6C000-memory.dmp

Filesize
304KB

Download
memory/3904-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download