amadey | 54a724762de2b08068bc2bf0fc6c7404bb89bdf62f75cac32b4fb8687c10c747

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
Size

515KB
MD5

2154ece6d371bfbe7b76969405904f7e
SHA1

39f7c2f9abe69a8dc9b42853d10e330b93c9858d
SHA256

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f
SHA512

da64833b8c9a80598631242e5649164230f586d26e6171af7fac767496319a2e7147df082f7294a7faeb6e97843c03f4031ebfac1244ffab3804102e293a857f
SSDEEP

12288:ZMr7y90W5WJa5xOzgYAkrlzdEEcjXAyEc6hoMzR3VFKTv2h:uyfxOpRzKEOAyEphtzhrKTg

Score

10^/10

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe	healer
behavioral6/memory/2512-21-0x0000000000180000-0x000000000018A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a1921299.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1921299.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1921299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1921299.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe	family_redline
behavioral6/memory/1636-45-0x00000000005E0000-0x0000000000610000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b6797687.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	b6797687.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v8037124.exev6090559.exea1921299.exeb6797687.exepdates.exec1730609.exed2034385.exepdates.exepdates.exe

pid process

3164 v8037124.exe
2408 v6090559.exe
2512 a1921299.exe
2488 b6797687.exe
2944 pdates.exe
2584 c1730609.exe
1636 d2034385.exe
4992 pdates.exe
4936 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a1921299.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1921299.exe

pid	process
3164	v8037124.exe
2408	v6090559.exe
2512	a1921299.exe
2488	b6797687.exe
2944	pdates.exe
2584	c1730609.exe
1636	d2034385.exe
4992	pdates.exe
4936	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1921299.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exev8037124.exev6090559.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8037124.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6090559.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c1730609.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1730609.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1730609.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c1730609.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4040 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1921299.exe

pid process

2512 a1921299.exe
2512 a1921299.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a1921299.exe

description pid process

Token: SeDebugPrivilege 2512 a1921299.exe

pid	process
4040	schtasks.exe

pid	process
2512	a1921299.exe
2512	a1921299.exe

description	pid	process
Token: SeDebugPrivilege	2512	a1921299.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exev8037124.exev6090559.exeb6797687.exepdates.execmd.exe

description	pid	process	target process
PID 3008 wrote to memory of 3164	3008	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	v8037124.exe
PID 3008 wrote to memory of 3164	3008	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	v8037124.exe
PID 3008 wrote to memory of 3164	3008	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	v8037124.exe
PID 3164 wrote to memory of 2408	3164	v8037124.exe	v6090559.exe
PID 3164 wrote to memory of 2408	3164	v8037124.exe	v6090559.exe
PID 3164 wrote to memory of 2408	3164	v8037124.exe	v6090559.exe
PID 2408 wrote to memory of 2512	2408	v6090559.exe	a1921299.exe
PID 2408 wrote to memory of 2512	2408	v6090559.exe	a1921299.exe
PID 2408 wrote to memory of 2488	2408	v6090559.exe	b6797687.exe
PID 2408 wrote to memory of 2488	2408	v6090559.exe	b6797687.exe
PID 2408 wrote to memory of 2488	2408	v6090559.exe	b6797687.exe
PID 2488 wrote to memory of 2944	2488	b6797687.exe	pdates.exe
PID 2488 wrote to memory of 2944	2488	b6797687.exe	pdates.exe
PID 2488 wrote to memory of 2944	2488	b6797687.exe	pdates.exe
PID 3164 wrote to memory of 2584	3164	v8037124.exe	c1730609.exe
PID 3164 wrote to memory of 2584	3164	v8037124.exe	c1730609.exe
PID 3164 wrote to memory of 2584	3164	v8037124.exe	c1730609.exe
PID 2944 wrote to memory of 4040	2944	pdates.exe	schtasks.exe
PID 2944 wrote to memory of 4040	2944	pdates.exe	schtasks.exe
PID 2944 wrote to memory of 4040	2944	pdates.exe	schtasks.exe
PID 2944 wrote to memory of 4680	2944	pdates.exe	cmd.exe
PID 2944 wrote to memory of 4680	2944	pdates.exe	cmd.exe
PID 2944 wrote to memory of 4680	2944	pdates.exe	cmd.exe
PID 4680 wrote to memory of 4944	4680	cmd.exe	cmd.exe
PID 4680 wrote to memory of 4944	4680	cmd.exe	cmd.exe
PID 4680 wrote to memory of 4944	4680	cmd.exe	cmd.exe
PID 4680 wrote to memory of 2312	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 2312	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 2312	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 5064	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 5064	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 5064	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 4436	4680	cmd.exe	cmd.exe
PID 4680 wrote to memory of 4436	4680	cmd.exe	cmd.exe
PID 4680 wrote to memory of 4436	4680	cmd.exe	cmd.exe
PID 4680 wrote to memory of 468	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 468	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 468	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 1584	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 1584	4680	cmd.exe	cacls.exe
PID 4680 wrote to memory of 1584	4680	cmd.exe	cacls.exe
PID 3008 wrote to memory of 1636	3008	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	d2034385.exe
PID 3008 wrote to memory of 1636	3008	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	d2034385.exe
PID 3008 wrote to memory of 1636	3008	764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe	d2034385.exe

C:\Users\Admin\AppData\Local\Temp\764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
"C:\Users\Admin\AppData\Local\Temp\764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8037124.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8037124.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6090559.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6090559.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6797687.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6797687.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4040
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:468
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:1584
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1730609.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1730609.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2584
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe
  2⤵
  - Executes dropped EXE
  PID:1636

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2034385.exe

Filesize
173KB

MD5
478907e21056ec954863f744923d66ef

SHA1
0bd7b9905cfd5135324811c1cf6f587a8d65f638

SHA256
56b21151da3b7f5420f855668581bad6e5e1659306970372320fa453c517fd66

SHA512
7e558a09ad8905a60a30b4c3898b6a96a2dade191697b4c95ef10a57a6ecacd5d55bea551b088b81a9888de5ae2593b7099efb38dd9f5898e9056c61ffc6439c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8037124.exe

Filesize
359KB

MD5
6ffe220ea983dfad338a1f8c7a434df5

SHA1
defc72a496e79f1bdda7a9f356c65b8e2b0e0a26

SHA256
9467f8fedaa618469c91fed1e5980a9e1a7a2b22bc456b95d3a338242b3b6477

SHA512
4f8cf2f175e6706a4828a9c7537735406bd5b7d66a4a85428f69bd1f2362a0ed58707e8d0d193bd8079dbdca3f4a71f14fa34b8624f64f3d725acbe7df86fce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1730609.exe

Filesize
35KB

MD5
8fe35219f258d8bacb6bf8edc682fb2c

SHA1
979535596ea208d403d8e0e300f832a1c0a9e06c

SHA256
ef9b2cc544302f2f7afdf5f6c1d66971d65f87d3345fd763896c23b17d028981

SHA512
3e4aa30325b00ec24b2a208a39e69055b795c9f7a244d0fc49eb87c5a71b7455a0c9eedb26bbb32feaf7a7e56e79d8c6de5c775f5af84b70408fb7368d1a5f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6090559.exe

Filesize
234KB

MD5
d4e21fb6881ef1240b6fcb1807e33437

SHA1
15f7ddcc15e2d6f2a95d2f07dbd8cfa0d0f56d24

SHA256
a22a82487193ae5ea533fff71a88bdbcd42304c451d2d2383a162ea797633798

SHA512
507295973be41a82625f53301208403c817c1de7fb8a7f787d1647cbf8310e32ff88b84b330205429c0557a568bee0187fdea3c2c66bbcdbc55e44783e841844

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1921299.exe

Filesize
11KB

MD5
0af4983d266a8beca186f2982f93571e

SHA1
d23d7260618685b821d0c5d9b112b4caed4be12a

SHA256
acc3723f02d21434a6ccb2bb8ca36f7aca96cab06c9ea4c9e6a0fc0e87343066

SHA512
730ff4561382d9cde738d63d144cec4b7c205af289334b777982d3c24d698697252631eacdcfbca6bc627c2551eef8ae49878a135449299dce308b078eadd054

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6797687.exe

Filesize
223KB

MD5
92ecd63689689187a0300452da216546

SHA1
baca2601fe1323617cae2a8bc3c539be38fa0eea

SHA256
1559281dca2533a4ba1904bf90518c75008214a273e24384bbe277af03553e80

SHA512
f6759c316d6cfb393fd347ddf107052c6a02cd8f500d3b321a80d09d3446005093d01f1498c3c2535022dd3077312cebbf1f29d210ddd8e61ab2b91439360f2b

Download Submit
memory/1636-51-0x0000000004930000-0x000000000497C000-memory.dmp

Filesize
304KB

Download
memory/1636-49-0x000000000A4D0000-0x000000000A4E2000-memory.dmp

Filesize
72KB

Download
memory/1636-50-0x000000000A530000-0x000000000A56C000-memory.dmp

Filesize
240KB

Download
memory/1636-48-0x000000000A590000-0x000000000A69A000-memory.dmp

Filesize
1.0MB

Download
memory/1636-45-0x00000000005E0000-0x0000000000610000-memory.dmp

Filesize
192KB

Download
memory/1636-46-0x00000000028E0000-0x00000000028E6000-memory.dmp

Filesize
24KB

Download
memory/1636-47-0x000000000AA10000-0x000000000B028000-memory.dmp

Filesize
6.1MB

Download
memory/2512-21-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download
memory/2512-22-0x00007FF82E543000-0x00007FF82E545000-memory.dmp

Filesize
8KB

Download
memory/2584-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2584-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download