amadey | 19ef966a051fb80a7e9a4c226171784888184c9e12f75a8cc5d88da9ecab375f

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe
Size

515KB
MD5

c138f8ea750795895b64bd99b1fcd8da
SHA1

b815664dadb4d1ff91862b2af099b84b230e1aeb
SHA256

6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625
SHA512

d6056b12443f399230bc7a469f11ae18fbe83915ac64966d4650ebeade16f6ae5033a7dc66415bbdc4e5f740a7568b1ee18dafb4ded14bee85b3c40e3350a6ee
SSDEEP

12288:kMr2y90vRliN0WXndhbap8sQM9oVgswQWT3l:Kygi0andh08sQM9oVbol

Score

10^/10

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

news

77.91.68.68:19071

Attributes

auth_value
99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe	healer
behavioral16/memory/3844-22-0x0000000000050000-0x000000000005A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a0144100.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0144100.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0144100.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0144100.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe	family_redline
behavioral16/memory/3208-45-0x00000000003F0000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b6446034.exedanke.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	b6446034.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 10 IoCs

Processes:

v0977630.exev7545579.exea0144100.exeb6446034.exedanke.exec4034930.exedanke.exed5914663.exedanke.exedanke.exe

pid	process
3908	v0977630.exe
3896	v7545579.exe
3844	a0144100.exe
4904	b6446034.exe
1504	danke.exe
1564	c4034930.exe
3500	danke.exe
3208	d5914663.exe
3844	danke.exe
3968	danke.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a0144100.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0144100.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0144100.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v7545579.exe6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exev0977630.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7545579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0977630.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1104 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1104	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c4034930.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4034930.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4034930.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c4034930.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1880 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a0144100.exe

pid process

3844 a0144100.exe
3844 a0144100.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a0144100.exe

description pid process

Token: SeDebugPrivilege 3844 a0144100.exe

pid	process
1880	schtasks.exe

pid	process
3844	a0144100.exe
3844	a0144100.exe

description	pid	process
Token: SeDebugPrivilege	3844	a0144100.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exev0977630.exev7545579.exeb6446034.exedanke.execmd.exe

description	pid	process	target process
PID 1568 wrote to memory of 3908	1568	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	v0977630.exe
PID 1568 wrote to memory of 3908	1568	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	v0977630.exe
PID 1568 wrote to memory of 3908	1568	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	v0977630.exe
PID 3908 wrote to memory of 3896	3908	v0977630.exe	v7545579.exe
PID 3908 wrote to memory of 3896	3908	v0977630.exe	v7545579.exe
PID 3908 wrote to memory of 3896	3908	v0977630.exe	v7545579.exe
PID 3896 wrote to memory of 3844	3896	v7545579.exe	a0144100.exe
PID 3896 wrote to memory of 3844	3896	v7545579.exe	a0144100.exe
PID 3896 wrote to memory of 4904	3896	v7545579.exe	b6446034.exe
PID 3896 wrote to memory of 4904	3896	v7545579.exe	b6446034.exe
PID 3896 wrote to memory of 4904	3896	v7545579.exe	b6446034.exe
PID 4904 wrote to memory of 1504	4904	b6446034.exe	danke.exe
PID 4904 wrote to memory of 1504	4904	b6446034.exe	danke.exe
PID 4904 wrote to memory of 1504	4904	b6446034.exe	danke.exe
PID 3908 wrote to memory of 1564	3908	v0977630.exe	c4034930.exe
PID 3908 wrote to memory of 1564	3908	v0977630.exe	c4034930.exe
PID 3908 wrote to memory of 1564	3908	v0977630.exe	c4034930.exe
PID 1504 wrote to memory of 1880	1504	danke.exe	schtasks.exe
PID 1504 wrote to memory of 1880	1504	danke.exe	schtasks.exe
PID 1504 wrote to memory of 1880	1504	danke.exe	schtasks.exe
PID 1504 wrote to memory of 1984	1504	danke.exe	cmd.exe
PID 1504 wrote to memory of 1984	1504	danke.exe	cmd.exe
PID 1504 wrote to memory of 1984	1504	danke.exe	cmd.exe
PID 1984 wrote to memory of 4520	1984	cmd.exe	cmd.exe
PID 1984 wrote to memory of 4520	1984	cmd.exe	cmd.exe
PID 1984 wrote to memory of 4520	1984	cmd.exe	cmd.exe
PID 1984 wrote to memory of 4608	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 4608	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 4608	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 1988	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 1988	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 1988	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 2568	1984	cmd.exe	cmd.exe
PID 1984 wrote to memory of 2568	1984	cmd.exe	cmd.exe
PID 1984 wrote to memory of 2568	1984	cmd.exe	cmd.exe
PID 1984 wrote to memory of 2976	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 2976	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 2976	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 4976	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 4976	1984	cmd.exe	cacls.exe
PID 1984 wrote to memory of 4976	1984	cmd.exe	cacls.exe
PID 1568 wrote to memory of 3208	1568	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	d5914663.exe
PID 1568 wrote to memory of 3208	1568	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	d5914663.exe
PID 1568 wrote to memory of 3208	1568	6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe	d5914663.exe

C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe
"C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1504
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1880
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:4976
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1564
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe
  2⤵
  - Executes dropped EXE
  PID:3208

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3500

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1104

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe

Filesize
173KB

MD5
89351eab443679ae0585e5d0c1515274

SHA1
7828c9bcd09ef64234b58c41e2ff15ffd08db306

SHA256
123f04ade0250cb30a448146ce4b74429ef38cd2811dce57126ef47db84f5bf6

SHA512
5983d02df411cf86d49e5a90b1f0d56200b3e31c187d3c36002f84657646950d1377f1fad039cc57df4757c524798d6d12c9df4633537438a55a75563f8ead8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe

Filesize
359KB

MD5
9b497b6b1e005de6a787c0bd9d1272fa

SHA1
10e84675f9eff72d4a99c1bf6110797dc5c69f0d

SHA256
13bbb6f14ebbd1a2b4a29fd6996f6ac546b555d0f8b264c0ad971466e4633ebe

SHA512
d8569d11f1c047baf36182282e32c0184bca286b7c40d2a1633fd876b635810d492ca4818c343d3b79e25dbda7dbbc38dc76b3bb40900e9be5b1b784dd188911

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe

Filesize
34KB

MD5
203da1f790ddfa54124b731334a820df

SHA1
4b8478a077b4053ff9f69705f888aaeecefc14dc

SHA256
47a99c2f3c457d009db77e5985d95a96dd4be2ab35d64c53516a196e5ed35d7f

SHA512
a631197e543edbeae0d256676513a2371f1ff539f26c102894d270bad9541624c0a15cac69e209d132b78af9e08e334a1dedcc660d7afcdd614793bd5babc989

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe

Filesize
234KB

MD5
86958943dd057021da6c771b6453b53a

SHA1
2738978ca7570c32c278b1d4010f39ac69e9fa8b

SHA256
3f700054b2901755279893023f905c92bbd13e4797f45cbcc0c3711aad4ffd78

SHA512
c4ef49c0462b4b9bce612d8f0c4f6be172159ebd58eb82c53963773a712fc297cd7cf67537a01040dc7c643eeae3c16fa0a3a5b36e0adecdfd790bc54054b94a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe

Filesize
12KB

MD5
3dee36b75657e42f643591ceac6af15a

SHA1
4c2de5072a1ca02bbc13d99e5be250807b3563fd

SHA256
d7a2203f9712448ce305e60cfdfdc8faa013fb121417a2ee41c676e49c3c87d9

SHA512
bcf1886345d8eccd330fa569f15b52be13b8f4a813a9d722c74b52cdf4c2c2d9611985fab51224f298f9554feeb24d3bfc92def9256258e1675567cdf96e928e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe

Filesize
229KB

MD5
1dc772e6085ff2515e39f3c9f98471ef

SHA1
6fb28af6f8bc753525323797c71a3598872a345e

SHA256
f5f062d5f2c9563dbaef81eda64958605b77ba1becbe272f1e8a1bff78e76cfe

SHA512
76ec2f514ba9290fc88ba22aec3bdfb0c93eda47bb038db0a37a05ff72fe62e33e08e8de0f1470399299397e894f6f3209e212690eaa076cf675d41aaa69f873

Download Submit
memory/1564-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3208-48-0x000000000A3A0000-0x000000000A4AA000-memory.dmp

Filesize
1.0MB

Download
memory/3208-45-0x00000000003F0000-0x0000000000420000-memory.dmp

Filesize
192KB

Download
memory/3208-46-0x00000000026E0000-0x00000000026E6000-memory.dmp

Filesize
24KB

Download
memory/3208-47-0x000000000A860000-0x000000000AE78000-memory.dmp

Filesize
6.1MB

Download
memory/3208-49-0x000000000A2E0000-0x000000000A2F2000-memory.dmp

Filesize
72KB

Download
memory/3208-50-0x000000000A340000-0x000000000A37C000-memory.dmp

Filesize
240KB

Download
memory/3208-51-0x0000000004740000-0x000000000478C000-memory.dmp

Filesize
304KB

Download
memory/3844-22-0x0000000000050000-0x000000000005A000-memory.dmp

Filesize
40KB

Download
memory/3844-21-0x00007FFD9E1F3000-0x00007FFD9E1F5000-memory.dmp

Filesize
8KB

Download