amadey | 19ffc101f7c4457a5adb66b38ce5823d52f596b323578de48d3585b1b57d24c6

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
Size

514KB
MD5

3596d2031894bae219111af96da907c0
SHA1

21c0f19aa3d9e05ee8d8c6433acce202f0e60ab6
SHA256

55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce
SHA512

057ddc2bd1f41cb1a07078de858578a79ec3a3f8601741c671c20400d14658a0ba0f34fc455b35c6b6ed8f5887cd7d524bf43d25b41d90b7ea5a44c8f00be966
SSDEEP

6144:KHy+bnr+zp0yN90QESKrrG+f2s1De9WhDPxn7r6DM59U1UHSllzk7dX632XG8FWU:5MrLy90BOJW55n7rDdHIlzF36xooH

Score

10^/10

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

news

77.91.68.68:19071

Attributes

auth_value
99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral8/files/0x00080000000233d3-20.dat	healer
behavioral8/memory/1488-21-0x0000000000F90000-0x0000000000F9A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1887952.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1887952.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1887952.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x00070000000233ce-42.dat	family_redline
behavioral8/memory/2132-44-0x0000000000A10000-0x0000000000A40000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	b1416740.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

pid	Process
3616	v2566214.exe
4316	v0147678.exe
1488	a1887952.exe
1388	b1416740.exe
3116	pdates.exe
3904	c2864142.exe
2132	d8069388.exe
4440	pdates.exe
4116	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1887952.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2566214.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0147678.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2864142.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2864142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2864142.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	a1887952.exe
1488	a1887952.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	a1887952.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3616	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	83
PID 2984 wrote to memory of 3616	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	83
PID 2984 wrote to memory of 3616	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	83
PID 3616 wrote to memory of 4316	3616	v2566214.exe	85
PID 3616 wrote to memory of 4316	3616	v2566214.exe	85
PID 3616 wrote to memory of 4316	3616	v2566214.exe	85
PID 4316 wrote to memory of 1488	4316	v0147678.exe	86
PID 4316 wrote to memory of 1488	4316	v0147678.exe	86
PID 4316 wrote to memory of 1388	4316	v0147678.exe	89
PID 4316 wrote to memory of 1388	4316	v0147678.exe	89
PID 4316 wrote to memory of 1388	4316	v0147678.exe	89
PID 1388 wrote to memory of 3116	1388	b1416740.exe	90
PID 1388 wrote to memory of 3116	1388	b1416740.exe	90
PID 1388 wrote to memory of 3116	1388	b1416740.exe	90
PID 3616 wrote to memory of 3904	3616	v2566214.exe	91
PID 3616 wrote to memory of 3904	3616	v2566214.exe	91
PID 3616 wrote to memory of 3904	3616	v2566214.exe	91
PID 3116 wrote to memory of 2260	3116	pdates.exe	92
PID 3116 wrote to memory of 2260	3116	pdates.exe	92
PID 3116 wrote to memory of 2260	3116	pdates.exe	92
PID 3116 wrote to memory of 1736	3116	pdates.exe	94
PID 3116 wrote to memory of 1736	3116	pdates.exe	94
PID 3116 wrote to memory of 1736	3116	pdates.exe	94
PID 1736 wrote to memory of 4652	1736	cmd.exe	96
PID 1736 wrote to memory of 4652	1736	cmd.exe	96
PID 1736 wrote to memory of 4652	1736	cmd.exe	96
PID 1736 wrote to memory of 2108	1736	cmd.exe	97
PID 1736 wrote to memory of 2108	1736	cmd.exe	97
PID 1736 wrote to memory of 2108	1736	cmd.exe	97
PID 1736 wrote to memory of 5048	1736	cmd.exe	98
PID 1736 wrote to memory of 5048	1736	cmd.exe	98
PID 1736 wrote to memory of 5048	1736	cmd.exe	98
PID 1736 wrote to memory of 3036	1736	cmd.exe	99
PID 1736 wrote to memory of 3036	1736	cmd.exe	99
PID 1736 wrote to memory of 3036	1736	cmd.exe	99
PID 1736 wrote to memory of 636	1736	cmd.exe	100
PID 1736 wrote to memory of 636	1736	cmd.exe	100
PID 1736 wrote to memory of 636	1736	cmd.exe	100
PID 1736 wrote to memory of 872	1736	cmd.exe	101
PID 1736 wrote to memory of 872	1736	cmd.exe	101
PID 1736 wrote to memory of 872	1736	cmd.exe	101
PID 2984 wrote to memory of 2132	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	104
PID 2984 wrote to memory of 2132	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	104
PID 2984 wrote to memory of 2132	2984	55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe	104

C:\Users\Admin\AppData\Local\Temp\55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
"C:\Users\Admin\AppData\Local\Temp\55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2566214.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2566214.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0147678.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0147678.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1416740.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1416740.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2260
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:636
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:872
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2864142.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2864142.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3904
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe
  2⤵
  - Executes dropped EXE
  PID:2132

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8069388.exe

Filesize
175KB

MD5
5b710050da5fa29668f5e65bcd26b77a

SHA1
7fbc2d52076fadf2d463529dcff70eaad98cedd6

SHA256
8999e65eae8cff841020771fa8b81959f1178d42fcff2ca9652618c5cd8877fa

SHA512
27945f266fd2fea5de25b669abd3b0ff5022e191b950e25045fbf7f7b2addc36b4dd2c732db1dad8886aedd45681d0ce7176c723648a278052801c0775485186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2566214.exe

Filesize
358KB

MD5
025518f9f75d68afc626b8fdae033de5

SHA1
1526adcd1196de1e8f01e95592b08ba73721dc2f

SHA256
4ed863f7b3b7493c6f5809e8e83d6ce9a9132b49b64602ebc89e14b2eed79834

SHA512
1b1bd5e92952125876afbbaa5e162d44a9d85f280f9a2e80560362f6b2cb8879bda990abe1d2ed9569644e5b024b5b283a10a6b8dd90163817997c3cdbb8703a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2864142.exe

Filesize
35KB

MD5
32c7040e547bf9cd25df85aa47c3cbf6

SHA1
60bc64c033d79b5af2350fcb20981e34076fea81

SHA256
9b80db8a9e5c33a69eb46cc19255649a1822eee80090756d068b196daf1cb71e

SHA512
7ad6b3e8f96199bbf07107b08c4f27a12d40338103f1bf2f0d1dc97069c36e4de99e563c93b49b65a76cb5f4fb0be6ceece10b89d9fe9c976b79ea4e1c2fff17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0147678.exe

Filesize
234KB

MD5
57648417a68b6f1f8a03a685caf88d79

SHA1
d691aaeab8eb7dc8d7300b84b13b85217ff1e9af

SHA256
aaac203900178a544f55644dc0fcbc403cd2b4c4ba39f1fc38513ee55f059667

SHA512
50b51eafe17895013bf055cda13954265426da2205cfab51d3a813ba253c0342f9c0bd40a262eb3be83c998229b54cd6a35cd038eb1d27e8d5bf97e04233649f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1887952.exe

Filesize
11KB

MD5
35148121e93b2903c6ea720f4af0e8fd

SHA1
ff33ed98166a08008b3d3212435c0e3707204229

SHA256
a65380126b5f7615f67af3f925864e43edbee91028aa58cf9783f28a5e7f2071

SHA512
5517fd5c0a0e7685ff93cf12b6fecadf9d3f57bb37a8f7d76e7db0c2914b672c1d9006efd86d081fe1f5b1afdc020a5d476534e15914f58a9b6ebc94fd41be2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1416740.exe

Filesize
223KB

MD5
e6df1c01ec99b43dcb015c4e7cb0f527

SHA1
7f1415a6aca7900575a356625f0ea7ece4a6b6f3

SHA256
a31e09926730956b52a5a85d0b31475527087b9b4d2eed66536c2d73db1b23d8

SHA512
4889381ecf967f05fdd3e69149e06fd2c62449f7144aa13a9019b3bef329ec7a46373313b5cb9fbdf9d6f00d89075dc24f983518a585dc01a0cb1761380293df

Download Submit
memory/1488-22-0x00007FF8CE503000-0x00007FF8CE505000-memory.dmp

Filesize
8KB

Download
memory/1488-21-0x0000000000F90000-0x0000000000F9A000-memory.dmp

Filesize
40KB

Download
memory/2132-44-0x0000000000A10000-0x0000000000A40000-memory.dmp

Filesize
192KB

Download
memory/2132-45-0x0000000005370000-0x0000000005376000-memory.dmp

Filesize
24KB

Download
memory/2132-46-0x000000000AF00000-0x000000000B518000-memory.dmp

Filesize
6.1MB

Download
memory/2132-47-0x000000000A9F0000-0x000000000AAFA000-memory.dmp

Filesize
1.0MB

Download
memory/2132-48-0x000000000A900000-0x000000000A912000-memory.dmp

Filesize
72KB

Download
memory/2132-49-0x000000000A960000-0x000000000A99C000-memory.dmp

Filesize
240KB

Download
memory/2132-50-0x0000000004E20000-0x0000000004E6C000-memory.dmp

Filesize
304KB

Download
memory/3904-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download