amadey | ebd9a15280a9fbd641ead11a6ab911fd72dcd48a6226e2e161005aebc9f70813

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe
Size

514KB
MD5

59fb589e90a00ec0ccf1612f0dc2781c
SHA1

017a2f2c15e968b8c5ea36c9a853d5d77919fb82
SHA256

ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39
SHA512

3ab6ec4e8e968c478404f8a926e20d0ba1f1d223374358e048a8ac9b68148937d775679c3c2bd736409e604556a63620e30b4cf386b0f4eb6fe421602dd38f65
SSDEEP

12288:XMrHy90WBtd2hKp4mL7wQpgp0PkOV3q3RcSWjjXeJoGTvq:QypBtwhK1w308o3KSfPqoGbq

Score

10^/10

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe	healer
behavioral22/memory/3540-22-0x0000000000B20000-0x0000000000B2A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a3381042.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3381042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3381042.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe	family_redline
behavioral22/memory/2500-44-0x0000000000480000-0x00000000004B0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b7149162.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	b7149162.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 9 IoCs

Processes:

v1108511.exev5947689.exea3381042.exeb7149162.exepdates.exec9897645.exed6847860.exepdates.exepdates.exe

pid process

2452 v1108511.exe
1012 v5947689.exe
3540 a3381042.exe
4960 b7149162.exe
948 pdates.exe
4464 c9897645.exe
2500 d6847860.exe
4892 pdates.exe
4036 pdates.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a3381042.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3381042.exe

pid	process
2452	v1108511.exe
1012	v5947689.exe
3540	a3381042.exe
4960	b7149162.exe
948	pdates.exe
4464	c9897645.exe
2500	d6847860.exe
4892	pdates.exe
4036	pdates.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3381042.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exev1108511.exev5947689.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1108511.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5947689.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c9897645.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9897645.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9897645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c9897645.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2964 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3381042.exe

pid process

3540 a3381042.exe
3540 a3381042.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3381042.exe

description pid process

Token: SeDebugPrivilege 3540 a3381042.exe

pid	process
2964	schtasks.exe

pid	process
3540	a3381042.exe
3540	a3381042.exe

description	pid	process
Token: SeDebugPrivilege	3540	a3381042.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exev1108511.exev5947689.exeb7149162.exepdates.execmd.exe

description	pid	process	target process
PID 380 wrote to memory of 2452	380	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	v1108511.exe
PID 380 wrote to memory of 2452	380	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	v1108511.exe
PID 380 wrote to memory of 2452	380	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	v1108511.exe
PID 2452 wrote to memory of 1012	2452	v1108511.exe	v5947689.exe
PID 2452 wrote to memory of 1012	2452	v1108511.exe	v5947689.exe
PID 2452 wrote to memory of 1012	2452	v1108511.exe	v5947689.exe
PID 1012 wrote to memory of 3540	1012	v5947689.exe	a3381042.exe
PID 1012 wrote to memory of 3540	1012	v5947689.exe	a3381042.exe
PID 1012 wrote to memory of 4960	1012	v5947689.exe	b7149162.exe
PID 1012 wrote to memory of 4960	1012	v5947689.exe	b7149162.exe
PID 1012 wrote to memory of 4960	1012	v5947689.exe	b7149162.exe
PID 4960 wrote to memory of 948	4960	b7149162.exe	pdates.exe
PID 4960 wrote to memory of 948	4960	b7149162.exe	pdates.exe
PID 4960 wrote to memory of 948	4960	b7149162.exe	pdates.exe
PID 2452 wrote to memory of 4464	2452	v1108511.exe	c9897645.exe
PID 2452 wrote to memory of 4464	2452	v1108511.exe	c9897645.exe
PID 2452 wrote to memory of 4464	2452	v1108511.exe	c9897645.exe
PID 948 wrote to memory of 2964	948	pdates.exe	schtasks.exe
PID 948 wrote to memory of 2964	948	pdates.exe	schtasks.exe
PID 948 wrote to memory of 2964	948	pdates.exe	schtasks.exe
PID 948 wrote to memory of 1388	948	pdates.exe	cmd.exe
PID 948 wrote to memory of 1388	948	pdates.exe	cmd.exe
PID 948 wrote to memory of 1388	948	pdates.exe	cmd.exe
PID 1388 wrote to memory of 4388	1388	cmd.exe	cmd.exe
PID 1388 wrote to memory of 4388	1388	cmd.exe	cmd.exe
PID 1388 wrote to memory of 4388	1388	cmd.exe	cmd.exe
PID 1388 wrote to memory of 4360	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 4360	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 4360	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 3280	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 3280	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 3280	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 1132	1388	cmd.exe	cmd.exe
PID 1388 wrote to memory of 1132	1388	cmd.exe	cmd.exe
PID 1388 wrote to memory of 1132	1388	cmd.exe	cmd.exe
PID 1388 wrote to memory of 1248	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 1248	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 1248	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 2664	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 2664	1388	cmd.exe	cacls.exe
PID 1388 wrote to memory of 2664	1388	cmd.exe	cacls.exe
PID 380 wrote to memory of 2500	380	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	d6847860.exe
PID 380 wrote to memory of 2500	380	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	d6847860.exe
PID 380 wrote to memory of 2500	380	ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe	d6847860.exe

C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe
"C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:948
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2964
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:2664
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4464
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe
  2⤵
  - Executes dropped EXE
  PID:2500

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe

Filesize
175KB

MD5
76fd4c1f0800f25cb42a8a93ecec5ea5

SHA1
fa04fc79678d76ba6c3ffcc7a2e6c85f001200c3

SHA256
c21aa80c72993dd20b1c80dc2d7b5562203df278b73f9954850d6138287b7dae

SHA512
c6aeeacf4ba2ae35db56636fb9ddfece96a3335ced296ffdb371655363a2479bad34591db4a5c6040d342922330c8b42fef2fdfe5877eccf889f48f5bc377437

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe

Filesize
358KB

MD5
805ee5f2e86db8dcb71c61419b97a7bc

SHA1
bcbb33987fbe58db70d9d4dd221964fceac8f7cb

SHA256
2050fbba411021855c095f57c2f1cbec51cb387c1a9bf17bc259a01d36e114e1

SHA512
255edb5fc9d1e60d49754873e9ca9178e83afcfe6195131006dee12ede6bc964496542af50cc0b0530d503b620494be3511aa350c7dd3ef6b94367c91ea55af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe

Filesize
36KB

MD5
ce200a9ed0fe11e70629c5b6e4928b1b

SHA1
a80222a3e8cbbe8e5ac7a112771e7931b58c5449

SHA256
a6b423fde242a000df9b139abf636287f453baefccc548d8974ffde03e41a0af

SHA512
9b0f9c19dadff0f1a147cd2ce2ced002111ee7c054a2165a1c89f13464f3ab4469ae086e74c4757df5eae4226201d9209408b743f5605f0c4a82134624089130

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe

Filesize
234KB

MD5
38d6de5de6f3d5129329821b43896fbd

SHA1
35865d4f70aae5517fc369240e7269dc2656d2c7

SHA256
a037df5465ec36876bf4352c82df9c9a0d707a76ab8e4cf78ca5d69d51fbc14d

SHA512
fb868def19fa175a1c9ba1df36b43d0a91927d9d76c9a0ddce7157a450d3eb622b5893be5f2ef62bd9a193adc3a60b28a2ee59b51f8e13d51e49d03543c0e629

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe

Filesize
13KB

MD5
e4986bd5697790b80b4718cdfd11beb9

SHA1
2b2a49129467f41c7f8cfd4a43919da6c464f5a3

SHA256
7bad585253f7cf153fccffe324cbe0bb30c1b9394b9d4092067f7c28de4cd1c4

SHA512
6ddbc098e8196df85e8f06d6e46a1b69db18d61a273a9564377b538b025066d29ddad3973e1f0bd4993d6d234e18357814dab9024ce51ec5c80024491a5d9edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe

Filesize
225KB

MD5
ff6a7e0ddd84a5af2afa7670fdc3ba5f

SHA1
8d320bcb6a8b10b9d1621f41c662c449a94377fe

SHA256
65f0d7f92c5a7ed0b29cc13718e3c57529b5d7819576f135229ab355eaf01a27

SHA512
43dd7ce467625b9329c46b4667b699ab2492d29971f2337e2a858ff01daefeb31ac012f31f00d982b9adb49123facce22209cfc5d0161b5c1bddef996b3726ac

Download Submit
memory/2500-47-0x000000000A430000-0x000000000A53A000-memory.dmp

Filesize
1.0MB

Download
memory/2500-44-0x0000000000480000-0x00000000004B0000-memory.dmp

Filesize
192KB

Download
memory/2500-45-0x0000000004D60000-0x0000000004D66000-memory.dmp

Filesize
24KB

Download
memory/2500-46-0x000000000A8B0000-0x000000000AEC8000-memory.dmp

Filesize
6.1MB

Download
memory/2500-48-0x000000000A370000-0x000000000A382000-memory.dmp

Filesize
72KB

Download
memory/2500-49-0x000000000A3D0000-0x000000000A40C000-memory.dmp

Filesize
240KB

Download
memory/2500-50-0x0000000004750000-0x000000000479C000-memory.dmp

Filesize
304KB

Download
memory/3540-22-0x0000000000B20000-0x0000000000B2A000-memory.dmp

Filesize
40KB

Download
memory/3540-21-0x00007FFF033C3000-0x00007FFF033C5000-memory.dmp

Filesize
8KB

Download
memory/4464-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download