amadey | 54a724762de2b08068bc2bf0fc6c7404bb89bdf62f75cac32b4fb8687c10c747

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe
Size

514KB
MD5

1e403ea018e300ab5fa01dc6722fd8a6
SHA1

b84fea8ce4026eb79d8048b8c2af1d21ecf1364c
SHA256

853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68
SHA512

51c703ee4d4c66c3c94d54f96691490b9dddd2260472b48f728f09712b081726e60bc6e1a1df1fe4306b99ab594065512bbce2f44587be7a7461a53dd7c6e244
SSDEEP

12288:fMrdy90UdEtCZ8v/PXBqYmXzGNmIubtV4xM6ijMEV:yy7ut3nx0XKNmIucBEV

Score

10^/10

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3542491.exe	healer
behavioral7/memory/2404-21-0x0000000000090000-0x000000000009A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a3542491.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3542491.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3542491.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3542491.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3542491.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3542491.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3542491.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2875192.exe	family_redline
behavioral7/memory/872-44-0x0000000000380000-0x00000000003B0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0053232.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	b0053232.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v0812977.exev7797511.exea3542491.exeb0053232.exepdates.exec9427367.exed2875192.exepdates.exepdates.exe

pid process

4724 v0812977.exe
3800 v7797511.exe
2404 a3542491.exe
1608 b0053232.exe
1132 pdates.exe
2712 c9427367.exe
872 d2875192.exe
2000 pdates.exe
1616 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a3542491.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3542491.exe

pid	process
4724	v0812977.exe
3800	v7797511.exe
2404	a3542491.exe
1608	b0053232.exe
1132	pdates.exe
2712	c9427367.exe
872	d2875192.exe
2000	pdates.exe
1616	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3542491.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exev0812977.exev7797511.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0812977.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7797511.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2856 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2856	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c9427367.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9427367.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9427367.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9427367.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1280 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3542491.exe

pid process

2404 a3542491.exe
2404 a3542491.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3542491.exe

description pid process

Token: SeDebugPrivilege 2404 a3542491.exe

pid	process
1280	schtasks.exe

pid	process
2404	a3542491.exe
2404	a3542491.exe

description	pid	process
Token: SeDebugPrivilege	2404	a3542491.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exev0812977.exev7797511.exeb0053232.exepdates.execmd.exe

description	pid	process	target process
PID 5096 wrote to memory of 4724	5096	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe	v0812977.exe
PID 5096 wrote to memory of 4724	5096	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe	v0812977.exe
PID 5096 wrote to memory of 4724	5096	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe	v0812977.exe
PID 4724 wrote to memory of 3800	4724	v0812977.exe	v7797511.exe
PID 4724 wrote to memory of 3800	4724	v0812977.exe	v7797511.exe
PID 4724 wrote to memory of 3800	4724	v0812977.exe	v7797511.exe
PID 3800 wrote to memory of 2404	3800	v7797511.exe	a3542491.exe
PID 3800 wrote to memory of 2404	3800	v7797511.exe	a3542491.exe
PID 3800 wrote to memory of 1608	3800	v7797511.exe	b0053232.exe
PID 3800 wrote to memory of 1608	3800	v7797511.exe	b0053232.exe
PID 3800 wrote to memory of 1608	3800	v7797511.exe	b0053232.exe
PID 1608 wrote to memory of 1132	1608	b0053232.exe	pdates.exe
PID 1608 wrote to memory of 1132	1608	b0053232.exe	pdates.exe
PID 1608 wrote to memory of 1132	1608	b0053232.exe	pdates.exe
PID 4724 wrote to memory of 2712	4724	v0812977.exe	c9427367.exe
PID 4724 wrote to memory of 2712	4724	v0812977.exe	c9427367.exe
PID 4724 wrote to memory of 2712	4724	v0812977.exe	c9427367.exe
PID 1132 wrote to memory of 1280	1132	pdates.exe	schtasks.exe
PID 1132 wrote to memory of 1280	1132	pdates.exe	schtasks.exe
PID 1132 wrote to memory of 1280	1132	pdates.exe	schtasks.exe
PID 1132 wrote to memory of 2620	1132	pdates.exe	cmd.exe
PID 1132 wrote to memory of 2620	1132	pdates.exe	cmd.exe
PID 1132 wrote to memory of 2620	1132	pdates.exe	cmd.exe
PID 2620 wrote to memory of 4324	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 4324	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 4324	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 3580	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3580	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3580	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4792	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4792	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4792	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3520	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 3520	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 3520	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 3500	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3500	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3500	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 804	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 804	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 804	2620	cmd.exe	cacls.exe
PID 5096 wrote to memory of 872	5096	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe	d2875192.exe
PID 5096 wrote to memory of 872	5096	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe	d2875192.exe
PID 5096 wrote to memory of 872	5096	853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe	d2875192.exe

C:\Users\Admin\AppData\Local\Temp\853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe
"C:\Users\Admin\AppData\Local\Temp\853890cb435781965f3dc9618397058d03c8d3e59706ede7d308b4afe12cbe68.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0812977.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0812977.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7797511.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7797511.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3542491.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3542491.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0053232.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0053232.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1280
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:804
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9427367.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9427367.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2875192.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2875192.exe
  2⤵
  - Executes dropped EXE
  PID:872

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2875192.exe

Filesize
174KB

MD5
38a04acb886db0132375ad04c9a2bb08

SHA1
55ec8886c54c6b02e1b4c1e7d3852251e9d09e2b

SHA256
e06c224f38d4a32ebd14834b31f6aa0fde1aaade7c0fda95e00ea77335ea07dc

SHA512
44c44ff8633f4b248a9f1dd3bb5e7d50eab8aff1f5d6258964092b784f3a1268d3300056099f6dbd4300b9560f5e6b84da176d6ff80c004f7d02855912ff8263

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0812977.exe

Filesize
359KB

MD5
4b48efe54f18bd0d702132b9dd87d5a4

SHA1
1c73fce06bc3992ad6891ffce68ac110259ac338

SHA256
6353e20081b17fcb87b6e48091215d3ced15b545c58252541e6ad469f86ee28d

SHA512
9f33a26d9ed8a374ab6ff484af4d474a8f3cc737a62520e7dfb49ef11c7104b23be1ba1dfc8f57fbcbf202f29a93eb8fc5a4e7489e0651079f2c13f02192a0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9427367.exe

Filesize
35KB

MD5
e04982564d83c1da9dc6811abdaf672c

SHA1
39e45bf02a3da1a70bdf65b78ad76bc84b1974be

SHA256
8490f14e10df94782494e03066e7d37b24bbfe263ff115d4c0af74d4d7639469

SHA512
a9725f8a15eb5062aad342555e5e5b2762d4cc13c95f6e20272c51d28586e5f720a19ce4bd3900941ae933f4455c6926aff2d96218cb6a30cee4f060aeb21a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7797511.exe

Filesize
234KB

MD5
72ab08d944fa19aca3d2fae7ae0c7ee2

SHA1
e31da6072297dcdd757c91e8b4b30ebd42b4fd68

SHA256
c4dcbfff5e865bc9a6fbf9962b21102a73e74636fca25c63ad35ab1077fd71f3

SHA512
fdf4e47df1e09df6cb39493165576affab59f855b6d41659fb3ec6c5c077a425782ff3e21250c52d34874b9a3dee6d6fd46beeb89a3803d5f7afdb065756a36a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3542491.exe

Filesize
11KB

MD5
63ad89a9a8af000b4e51d0f893aad085

SHA1
21f1e059d707e49f48331b13ab8332395d2821a5

SHA256
b00ec97cdf7d31f31c4b35bd2ef8cf500373d642e7e3d13a326f26443e0c4808

SHA512
0794e9fdc53c0f56af4e2fb4597facf387d302b25fd04d5b11aa687846327cb723007c020bb744102f7211142e8d9a3bd2fe28604d248bd7d15eeb93cde9418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0053232.exe

Filesize
224KB

MD5
3c62041559af1b19996dbf854519eec8

SHA1
86ebe337544b33294f14cfcf5d9d993055823333

SHA256
b280fa99dc4be9d943bdbae696626b5c39d3f15810eb91cda6b53e6075c7fd0f

SHA512
ef3112655756a7ae16acb10b4a97461e37e6c8795e435599a57303f015460c89187e75b6fa7e6ed82687c758e6e67d45fede7599b1e50590d3d78f08dafad624

Download Submit
memory/872-47-0x000000000A330000-0x000000000A43A000-memory.dmp

Filesize
1.0MB

Download
memory/872-44-0x0000000000380000-0x00000000003B0000-memory.dmp

Filesize
192KB

Download
memory/872-45-0x0000000002530000-0x0000000002536000-memory.dmp

Filesize
24KB

Download
memory/872-46-0x000000000A7D0000-0x000000000ADE8000-memory.dmp

Filesize
6.1MB

Download
memory/872-48-0x000000000A270000-0x000000000A282000-memory.dmp

Filesize
72KB

Download
memory/872-49-0x000000000A2D0000-0x000000000A30C000-memory.dmp

Filesize
240KB

Download
memory/872-50-0x0000000004670000-0x00000000046BC000-memory.dmp

Filesize
304KB

Download
memory/2404-21-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/2404-22-0x00007FFEC0D43000-0x00007FFEC0D45000-memory.dmp

Filesize
8KB

Download
memory/2712-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download