amadey | 54a724762de2b08068bc2bf0fc6c7404bb89bdf62f75cac32b4fb8687c10c747

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
Size

390KB
MD5

2115f838100aacbc3124baa1083c9d98
SHA1

7eb9e1272fdcbc6deec8fbdc06d609c69a0a88fc
SHA256

ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c
SHA512

7a8645ad4437cfa1833f826b9ed83dc329ecf14ceed774d5aea2982f305ee3c89cb69f4a72e31e4d78bc8ecb70937198a732c36e5b0914cce9f42fcf18bfd8d2
SSDEEP

6144:Kwy+bnr+Qp0yN90QEHQvEyqANvRS5KRQrw6kd7lmm39LBGGHlXve5oGvAe:wMr8y90QEyqANc6Qr5KAm9HFXaone

Score

10^/10

amadey healer redline roma dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

http://77.91.68.3

Attributes

install_dir
3ec1f323b5
install_file
danke.exe
strings_key
827021be90f1e85ab27949ea7e9347e8
url_paths
/home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

roma

77.91.68.56:19071

Attributes

auth_value
f099c2cf92834dbc554a94e1456cf576

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral17/files/0x000700000002343e-26.dat	healer
behavioral17/memory/1436-27-0x0000000000990000-0x000000000099A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h4931381.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h4931381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h4931381.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral17/files/0x000700000002343b-30.dat	family_redline
behavioral17/memory/3452-32-0x0000000000690000-0x00000000006C0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	g9963861.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	danke.exe

Executes dropped EXE 7 IoCs

pid	Process
1620	x3731075.exe
4804	g9963861.exe
2928	danke.exe
1436	h4931381.exe
3452	j2624853.exe
468	danke.exe
1448	danke.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	h4931381.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x3731075.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	h4931381.exe
1436	h4931381.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	h4931381.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1620	1320	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	82
PID 1320 wrote to memory of 1620	1320	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	82
PID 1320 wrote to memory of 1620	1320	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	82
PID 1620 wrote to memory of 4804	1620	x3731075.exe	83
PID 1620 wrote to memory of 4804	1620	x3731075.exe	83
PID 1620 wrote to memory of 4804	1620	x3731075.exe	83
PID 4804 wrote to memory of 2928	4804	g9963861.exe	85
PID 4804 wrote to memory of 2928	4804	g9963861.exe	85
PID 4804 wrote to memory of 2928	4804	g9963861.exe	85
PID 1620 wrote to memory of 1436	1620	x3731075.exe	86
PID 1620 wrote to memory of 1436	1620	x3731075.exe	86
PID 2928 wrote to memory of 2208	2928	danke.exe	87
PID 2928 wrote to memory of 2208	2928	danke.exe	87
PID 2928 wrote to memory of 2208	2928	danke.exe	87
PID 2928 wrote to memory of 1184	2928	danke.exe	89
PID 2928 wrote to memory of 1184	2928	danke.exe	89
PID 2928 wrote to memory of 1184	2928	danke.exe	89
PID 1184 wrote to memory of 4792	1184	cmd.exe	92
PID 1184 wrote to memory of 4792	1184	cmd.exe	92
PID 1184 wrote to memory of 4792	1184	cmd.exe	92
PID 1184 wrote to memory of 5088	1184	cmd.exe	93
PID 1184 wrote to memory of 5088	1184	cmd.exe	93
PID 1184 wrote to memory of 5088	1184	cmd.exe	93
PID 1184 wrote to memory of 2588	1184	cmd.exe	94
PID 1184 wrote to memory of 2588	1184	cmd.exe	94
PID 1184 wrote to memory of 2588	1184	cmd.exe	94
PID 1184 wrote to memory of 2044	1184	cmd.exe	95
PID 1184 wrote to memory of 2044	1184	cmd.exe	95
PID 1184 wrote to memory of 2044	1184	cmd.exe	95
PID 1184 wrote to memory of 1016	1184	cmd.exe	96
PID 1184 wrote to memory of 1016	1184	cmd.exe	96
PID 1184 wrote to memory of 1016	1184	cmd.exe	96
PID 1184 wrote to memory of 2624	1184	cmd.exe	97
PID 1184 wrote to memory of 2624	1184	cmd.exe	97
PID 1184 wrote to memory of 2624	1184	cmd.exe	97
PID 1320 wrote to memory of 3452	1320	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	101
PID 1320 wrote to memory of 3452	1320	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	101
PID 1320 wrote to memory of 3452	1320	ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe	101

C:\Users\Admin\AppData\Local\Temp\ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
"C:\Users\Admin\AppData\Local\Temp\ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3731075.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3731075.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9963861.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9963861.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
      "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2208
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4792
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        6⤵
        
        PID:5088
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        6⤵
        
        PID:2588
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2044
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        6⤵
        
        PID:1016
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        6⤵
        
        PID:2624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4931381.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4931381.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2624853.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2624853.exe
  2⤵
  - Executes dropped EXE
  PID:3452

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:468

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2624853.exe

Filesize
175KB

MD5
79d695993551d95d1dc462067311249d

SHA1
a09b6be89d4cb4d0e77d654b80bf73871fc5ae90

SHA256
9da891fbecacaf934f0e24ed59d13540062b32165dd914857a8af4109cc6340b

SHA512
9e53d532febd0221c9ec9720b2ffa3ef3ec59db0c1d7894d3d071fc3a1725255031225420d718427ac17e56e4fcfa46f66468d4976a160a371f41e20ab61b891

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3731075.exe

Filesize
234KB

MD5
0a0078e9aa75b182d33076182db21f09

SHA1
dc45a8085f53e9ceac803650b69f3858467db64e

SHA256
1ccaf92b146c89c824046a4bf8a94ba1646e425ecf6432de085cc96358a7db9c

SHA512
49efd218d098b555d962d2ec90907540c9c36d012e2dab87b72760660ec6dff9f95aea84c82d8bb1f4c6535bae2d2566d51638e15f864c6621d63ad42c935d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9963861.exe

Filesize
224KB

MD5
8c6b79ec436d7cf6950a804c1ec7d3e9

SHA1
4a589d5605d8ef785fdc78b0bf64e769e3a21ad6

SHA256
4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d

SHA512
06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4931381.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1436-27-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/3452-32-0x0000000000690000-0x00000000006C0000-memory.dmp

Filesize
192KB

Download
memory/3452-33-0x0000000000D80000-0x0000000000D86000-memory.dmp

Filesize
24KB

Download
memory/3452-34-0x000000000AB20000-0x000000000B138000-memory.dmp

Filesize
6.1MB

Download
memory/3452-35-0x000000000A610000-0x000000000A71A000-memory.dmp

Filesize
1.0MB

Download
memory/3452-36-0x00000000050C0000-0x00000000050D2000-memory.dmp

Filesize
72KB

Download
memory/3452-37-0x0000000005120000-0x000000000515C000-memory.dmp

Filesize
240KB

Download
memory/3452-38-0x00000000029F0000-0x0000000002A3C000-memory.dmp

Filesize
304KB

Download