amadey | fea4a5268fd3fad5b4772bcf4ef021d104110cff4b7bd43f6ad10ebcab7b0916

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe
Size

514KB
MD5

32ab0711c74737a7d5948b73ccc1ab6f
SHA1

3bd68e686a0260a11aa4805a2655867c4e780059
SHA256

5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1
SHA512

2aebec7ee681bd7e5e085571347a9caed38c2dfd5c705ee5fdb23da1258079bfb77b278427dd46811afc7f2f98afa2c818abb44e305cc13d4e43c8d1dec0a7e3
SSDEEP

12288:8Mrzy906i3DhgK5RE1g0xJF7ceeeeDC37Ztoj8QXII:HysNDSF7we97Zc

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral10/files/0x000800000002344b-19.dat	healer
behavioral10/memory/244-22-0x0000000000C50000-0x0000000000C5A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0423755.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0423755.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0423755.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0423755.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0423755.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0423755.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral10/files/0x0007000000023446-44.dat	family_redline
behavioral10/memory/4508-46-0x00000000003E0000-0x0000000000410000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	b3882292.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 9 IoCs

pid	Process
3444	v9804047.exe
392	v1593511.exe
244	a0423755.exe
4356	b3882292.exe
212	danke.exe
2664	c0749332.exe
4572	danke.exe
4508	d6820135.exe
3040	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0423755.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9804047.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1593511.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c0749332.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c0749332.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c0749332.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
244	a0423755.exe
244	a0423755.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	a0423755.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 3444	1456	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe	85
PID 1456 wrote to memory of 3444	1456	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe	85
PID 1456 wrote to memory of 3444	1456	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe	85
PID 3444 wrote to memory of 392	3444	v9804047.exe	86
PID 3444 wrote to memory of 392	3444	v9804047.exe	86
PID 3444 wrote to memory of 392	3444	v9804047.exe	86
PID 392 wrote to memory of 244	392	v1593511.exe	88
PID 392 wrote to memory of 244	392	v1593511.exe	88
PID 392 wrote to memory of 4356	392	v1593511.exe	99
PID 392 wrote to memory of 4356	392	v1593511.exe	99
PID 392 wrote to memory of 4356	392	v1593511.exe	99
PID 4356 wrote to memory of 212	4356	b3882292.exe	100
PID 4356 wrote to memory of 212	4356	b3882292.exe	100
PID 4356 wrote to memory of 212	4356	b3882292.exe	100
PID 3444 wrote to memory of 2664	3444	v9804047.exe	101
PID 3444 wrote to memory of 2664	3444	v9804047.exe	101
PID 3444 wrote to memory of 2664	3444	v9804047.exe	101
PID 212 wrote to memory of 4344	212	danke.exe	102
PID 212 wrote to memory of 4344	212	danke.exe	102
PID 212 wrote to memory of 4344	212	danke.exe	102
PID 212 wrote to memory of 384	212	danke.exe	104
PID 212 wrote to memory of 384	212	danke.exe	104
PID 212 wrote to memory of 384	212	danke.exe	104
PID 384 wrote to memory of 1836	384	cmd.exe	106
PID 384 wrote to memory of 1836	384	cmd.exe	106
PID 384 wrote to memory of 1836	384	cmd.exe	106
PID 384 wrote to memory of 1448	384	cmd.exe	107
PID 384 wrote to memory of 1448	384	cmd.exe	107
PID 384 wrote to memory of 1448	384	cmd.exe	107
PID 384 wrote to memory of 4188	384	cmd.exe	108
PID 384 wrote to memory of 4188	384	cmd.exe	108
PID 384 wrote to memory of 4188	384	cmd.exe	108
PID 384 wrote to memory of 3172	384	cmd.exe	109
PID 384 wrote to memory of 3172	384	cmd.exe	109
PID 384 wrote to memory of 3172	384	cmd.exe	109
PID 384 wrote to memory of 468	384	cmd.exe	110
PID 384 wrote to memory of 468	384	cmd.exe	110
PID 384 wrote to memory of 468	384	cmd.exe	110
PID 384 wrote to memory of 2268	384	cmd.exe	111
PID 384 wrote to memory of 2268	384	cmd.exe	111
PID 384 wrote to memory of 2268	384	cmd.exe	111
PID 1456 wrote to memory of 4508	1456	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe	119
PID 1456 wrote to memory of 4508	1456	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe	119
PID 1456 wrote to memory of 4508	1456	5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe	119

C:\Users\Admin\AppData\Local\Temp\5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe
"C:\Users\Admin\AppData\Local\Temp\5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9804047.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9804047.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1593511.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1593511.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0423755.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0423755.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:244
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3882292.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3882292.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4344
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:468
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:2268
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0749332.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0749332.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2664
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6820135.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6820135.exe
  2⤵
  - Executes dropped EXE
  PID:4508

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6820135.exe

Filesize
172KB

MD5
35c069df2551d2e840fda156cc641cc6

SHA1
3d585c42d1263b19654dbbb2116c6e1634748f45

SHA256
6f0c4d8a21e15d15d6f6bc50e37e67a0e9217cc8601de1c084e16a35a82f3042

SHA512
55bb9bc855872a4c51033e0343f78e3dd7c998bc46a704c9cff631e9bb27a117eaff3a2005a35e836d8c66d89372441c2b233778ff3dfbaa7edbaaa1f28b0619

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9804047.exe

Filesize
359KB

MD5
f96731ad89768ce38ca85155833675d0

SHA1
c5d8a91c287100b4fe000328e838a442380efed0

SHA256
7441d0da025a83eb86b2311e1d4eba38dabcdc4d77ba48942bd0b8318e1cd4a0

SHA512
0d2e17273a0222b9779ad33af67c33dc98e6a1917e5926ab5c44daa037698f169d1645380f46300d028303a9692d894210ae9b5c04e720fd535768c314e70c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0749332.exe

Filesize
32KB

MD5
ff0df20aebaf00c240e35f3c6b3957ec

SHA1
651f9c7a07b9f8b960e7ded63930e6e28b82b3f8

SHA256
0397e50962c0459763242b1b1334a5e3fb923f693fbeb47a5a837ede9ab207bb

SHA512
70de52de0f30a327b22d0d9a1d081369f1fc50cefc9b00d1c70c6919271e878b5d7d2d2fe824e81f418e7454c531956d875149827f31d8f4aeca779f2e485afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1593511.exe

Filesize
235KB

MD5
f022d704d6a78d750895a61fa69ac1c0

SHA1
1cd6a0036b9b623372a3cc265cf498bdb6a992a8

SHA256
c9aa8e6cc76da1ba13bb15864e57ccce2ea5f191245f3289a15a6df22a4f6c77

SHA512
c228a1db499b7eaea173da79b87b95ba3d06664958d8e03ac6f95379732c22ccca25557c1247e2ae0d915fad34ee08103d8d7d0dee14edea331074348474d646

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0423755.exe

Filesize
14KB

MD5
db00354a2702c30e10247ec3409494ed

SHA1
e08194ec9f17cbc43f2fba1462feed2f89dd1550

SHA256
dfd3e39fdb8c41e7b58bc6138a3773186bfc0bb2b65c555e66292603f032acd5

SHA512
78af980cad7b2af08d261f42e2ed7191556f5c66de16246db82cee4391af644018a9ea8efe33ca390821b09c00ff9e150dc9bccfeb70991b0dba1cb72d38b511

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3882292.exe

Filesize
226KB

MD5
1559c7c688a29ee1fbc80447c10bb7d7

SHA1
770fd8c753c5f5bca3001a6a5d132504f29bbcd7

SHA256
bf50960f0a97170ac60526811496d5f47fb73e6d94962a4d624fdaa5669ed645

SHA512
cdbb1dea45137051c156e05d698c018e5253f3ca48f4c9d637948594180431c33fc08f879549fd1a8f1fa38837c2cca4b540c15f2701cafb9284bf31c88f6e94

Download Submit
memory/244-21-0x00007FFD5D423000-0x00007FFD5D425000-memory.dmp

Filesize
8KB

Download
memory/244-22-0x0000000000C50000-0x0000000000C5A000-memory.dmp

Filesize
40KB

Download
memory/2664-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2664-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4508-46-0x00000000003E0000-0x0000000000410000-memory.dmp

Filesize
192KB

Download
memory/4508-47-0x00000000025C0000-0x00000000025C6000-memory.dmp

Filesize
24KB

Download
memory/4508-48-0x000000000A7C0000-0x000000000ADD8000-memory.dmp

Filesize
6.1MB

Download
memory/4508-49-0x000000000A2B0000-0x000000000A3BA000-memory.dmp

Filesize
1.0MB

Download
memory/4508-50-0x000000000A1A0000-0x000000000A1B2000-memory.dmp

Filesize
72KB

Download
memory/4508-51-0x000000000A200000-0x000000000A23C000-memory.dmp

Filesize
240KB

Download
memory/4508-52-0x0000000002600000-0x000000000264C000-memory.dmp

Filesize
304KB

Download