amadey | 2685b451d5bc5d1cd7c159a87efdfacd5a60c314491404e6e60e752ba3db90cf

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
Size

515KB
MD5

d9913d9f643c9aaedccb2c7e055ed031
SHA1

f9812f588b1a16b6d292bd553695404858dae7b6
SHA256

1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab
SHA512

51ce523840bec8f71baaab82b7841abbb825276280142cb67a84276558bb640a5fee511c865862868cd1f15ecddaeaf6e4c0feacf826751d37229577384dae00
SSDEEP

12288:KMrxy907uK8EElOOinxnMP+vIPGBEARwMrXu72wuL:TyquPo/nZ4LPGBEAdrXu7bo

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral3/files/0x0008000000023277-19.dat	healer
behavioral3/memory/4768-22-0x0000000000070000-0x000000000007A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8390704.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8390704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8390704.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x0007000000023272-46.dat	family_redline
behavioral3/memory/4684-48-0x0000000000E20000-0x0000000000E50000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	b7079007.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 9 IoCs

pid	Process
2892	v7044475.exe
3588	v4811916.exe
4768	a8390704.exe
60	b7079007.exe
656	danke.exe
684	c6028004.exe
4684	d6888003.exe
3228	danke.exe
3648	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8390704.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7044475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4811916.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c6028004.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	a8390704.exe
4768	a8390704.exe
684	c6028004.exe
684	c6028004.exe
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found
3188	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
684	c6028004.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	a8390704.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
60	b7079007.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2892	2428	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	90
PID 2428 wrote to memory of 2892	2428	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	90
PID 2428 wrote to memory of 2892	2428	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	90
PID 2892 wrote to memory of 3588	2892	v7044475.exe	91
PID 2892 wrote to memory of 3588	2892	v7044475.exe	91
PID 2892 wrote to memory of 3588	2892	v7044475.exe	91
PID 3588 wrote to memory of 4768	3588	v4811916.exe	92
PID 3588 wrote to memory of 4768	3588	v4811916.exe	92
PID 3588 wrote to memory of 60	3588	v4811916.exe	93
PID 3588 wrote to memory of 60	3588	v4811916.exe	93
PID 3588 wrote to memory of 60	3588	v4811916.exe	93
PID 60 wrote to memory of 656	60	b7079007.exe	95
PID 60 wrote to memory of 656	60	b7079007.exe	95
PID 60 wrote to memory of 656	60	b7079007.exe	95
PID 2892 wrote to memory of 684	2892	v7044475.exe	96
PID 2892 wrote to memory of 684	2892	v7044475.exe	96
PID 2892 wrote to memory of 684	2892	v7044475.exe	96
PID 656 wrote to memory of 3316	656	danke.exe	97
PID 656 wrote to memory of 3316	656	danke.exe	97
PID 656 wrote to memory of 3316	656	danke.exe	97
PID 656 wrote to memory of 2024	656	danke.exe	99
PID 656 wrote to memory of 2024	656	danke.exe	99
PID 656 wrote to memory of 2024	656	danke.exe	99
PID 2024 wrote to memory of 3176	2024	cmd.exe	101
PID 2024 wrote to memory of 3176	2024	cmd.exe	101
PID 2024 wrote to memory of 3176	2024	cmd.exe	101
PID 2024 wrote to memory of 4636	2024	cmd.exe	102
PID 2024 wrote to memory of 4636	2024	cmd.exe	102
PID 2024 wrote to memory of 4636	2024	cmd.exe	102
PID 2024 wrote to memory of 1836	2024	cmd.exe	103
PID 2024 wrote to memory of 1836	2024	cmd.exe	103
PID 2024 wrote to memory of 1836	2024	cmd.exe	103
PID 2024 wrote to memory of 4060	2024	cmd.exe	104
PID 2024 wrote to memory of 4060	2024	cmd.exe	104
PID 2024 wrote to memory of 4060	2024	cmd.exe	104
PID 2024 wrote to memory of 2924	2024	cmd.exe	105
PID 2024 wrote to memory of 2924	2024	cmd.exe	105
PID 2024 wrote to memory of 2924	2024	cmd.exe	105
PID 2024 wrote to memory of 3656	2024	cmd.exe	106
PID 2024 wrote to memory of 3656	2024	cmd.exe	106
PID 2024 wrote to memory of 3656	2024	cmd.exe	106
PID 2428 wrote to memory of 4684	2428	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	107
PID 2428 wrote to memory of 4684	2428	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	107
PID 2428 wrote to memory of 4684	2428	1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe	107

C:\Users\Admin\AppData\Local\Temp\1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
"C:\Users\Admin\AppData\Local\Temp\1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:656
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3316
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:3656
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:684
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe
  2⤵
  - Executes dropped EXE
  PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4480

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3228

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6888003.exe

Filesize
173KB

MD5
dc51fd06c4c11e328b3bbebe4a5e3b1a

SHA1
8801e69f81e62172416c44fbb0e7ad3f7c7da060

SHA256
2fca2e995466e6580daffec9deb1e14968ee0d18dd6bd67a43726ff1ffcab97e

SHA512
0235cce4966e4220b0f7e5835629f186247048bc124a64224b5836ed3b69dbd2b26ef00e924d9c788d5b131a93d5b1b46c64af494cc7a9dc678922634910816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7044475.exe

Filesize
359KB

MD5
2aec1b9778e7ab934eb8f482cd5348c8

SHA1
4cbe9b809e9078ccb733078b6cf0c26c8332db01

SHA256
35b0a82941fcf9428dec41ecae6a486fbeaae5972700d2b8012911bc3db032d9

SHA512
d4608974600ed0854341eb733a406f319c2471e2d3b85c7a19b56806244663f90f6bea390896b6c34fae95aa0d90b2e47454427a43e5d00feaa18857f3d95140

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6028004.exe

Filesize
32KB

MD5
b4e06a9b1b9ee7ab12f4e6d095116573

SHA1
65345bf69da2a27bd02e357766eabf0662b9d20d

SHA256
5f959a2842a4a6fe579e5d8ce1295c060597b82bc58a3e70e5bd329c9c3edbf8

SHA512
cc660fd5ad640cf41f548355022b4f0f087c8866c7cdc637948bf20cccf9846d961082f6a3cef10b8bb439f80b2658ffd7a7a1f310575e688455786c0e315949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4811916.exe

Filesize
234KB

MD5
7f521795c493f40b5675b6a506a5b3de

SHA1
6f2bcf31a86152fb0ae5e4c8ff216d4020014fb8

SHA256
75c3f68ed606787effbe57ad37d444610af3400509491497dbcc28b58a8b16f3

SHA512
7e54657247c50044816573dc242503d4b2275924813b4bccb866710089b0b96b7292fa744f42e4aa329498c264f57bbc3d0675122ebccc6298d811b87875b469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8390704.exe

Filesize
14KB

MD5
cf00d02aceeb4224969efc47fe25c140

SHA1
dfabd48292f691f2784e682cea4178d408c525e6

SHA256
592a3bcb0985f4b4d4a3e77a2f2aa52818c1f88c529c74aac70b0d8af1daf011

SHA512
676cc3aeb9c9683c4f243b04ee86894e9f74b526212331f30f7c15595b16a238ca27144e84161d904964ded6f7fbd88a109b7ad35727b0b2f670f8f30847ff80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7079007.exe

Filesize
227KB

MD5
ac6a3d2e01d97ef4adffa6b0c5e5efeb

SHA1
d5bb7aaad36ed2176246608875c6c46617a0e731

SHA256
12ff593e0cf7a829535ae891138dc92d3c3487fa831b1c8c122c3c726e7e91a9

SHA512
7f7165c35f53ec935db001541ad19769b45ab71011d2271af026dddff7886f1ba704e866efa295b57c9079bfad75be031ea4676c24fc783a1ef0d1e63ab1caec

Download Submit
memory/684-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/684-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3188-41-0x0000000002DB0000-0x0000000002DC6000-memory.dmp

Filesize
88KB

Download
memory/4684-49-0x0000000002F40000-0x0000000002F46000-memory.dmp

Filesize
24KB

Download
memory/4684-48-0x0000000000E20000-0x0000000000E50000-memory.dmp

Filesize
192KB

Download
memory/4684-51-0x0000000005D80000-0x0000000006398000-memory.dmp

Filesize
6.1MB

Download
memory/4684-52-0x0000000005870000-0x000000000597A000-memory.dmp

Filesize
1.0MB

Download
memory/4684-53-0x00000000057B0000-0x00000000057C2000-memory.dmp

Filesize
72KB

Download
memory/4684-54-0x0000000005810000-0x000000000584C000-memory.dmp

Filesize
240KB

Download
memory/4684-55-0x0000000005980000-0x00000000059CC000-memory.dmp

Filesize
304KB

Download
memory/4768-22-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/4768-21-0x00007FFE6D0C3000-0x00007FFE6D0C5000-memory.dmp

Filesize
8KB

Download