Behavioral Report

General

Target

99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe
Size

312KB
MD5

d5a042d15c800a5f811e993b95d64596
SHA1

3ca2653f3ec0da78c094beaf3529fffc5784ef37
SHA256

99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492
SHA512

8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Score

10^/10

amadey redline install collection discovery infostealer spyware stealer suricata trojan

Malware Config

Extracted

Family	amadey
Version	3.08
C2	185.215.113.35/d2VxjasuwS/index.php 185.215.113.35/d2VxjasuwS/index.php

Extracted

Family	redline
Botnet	install
C2	193.233.48.13:80 193.233.48.13:80
Attributes	auth_value 607ed2c8bc0b557489789c04d9e91426

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload ⋅ 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3436-173-0x0000000000400000-0x0000000000449000-memory.dmp	family_redline
behavioral2/memory/3624-175-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/3436-180-0x0000000000400000-0x0000000000449000-memory.dmp	family_redline

suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
Blocklisted process makes network request ⋅ 1 IoCs

Processes:

rundll32.exe

flow pid process

71 2172 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE ⋅ 5 IoCs

Processes:

ftewk.exeftewk.exeftewk.exeftewk.exeftewk.exe

pid process

4600 ftewk.exe
3436 ftewk.exe
2500 ftewk.exe
4832 ftewk.exe
4744 ftewk.exe

flow	pid	process
71	2172	rundll32.exe

pid	process
4600	ftewk.exe
3436	ftewk.exe
2500	ftewk.exe
4832	ftewk.exe
4744	ftewk.exe

Checks computer location settings ⋅ 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

TTPs:

Query Registry System Information Discovery

Processes:

99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exeftewk.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	ftewk.exe

Loads dropped DLL ⋅ 1 IoCs

Processes:

rundll32.exe

pid process

2172 rundll32.exe
Reads local data of messenger clients ⋅ 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

TTPs:

Data from Local System Credentials in Files
Reads user/profile data of web browsers ⋅ 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

TTPs:

Data from Local System Credentials in Files

pid	process
2172	rundll32.exe

Accesses Microsoft Outlook profiles ⋅ 1 TTPs 1 IoCs

collection

TTPs:

Email Collection

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
spyware

TTPs:

Data from Local System Credentials in Files
Checks installed software on the system ⋅ 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

TTPs:

Query Registry

Suspicious use of SetThreadContext ⋅ 3 IoCs

Processes:

ftewk.exeftewk.exe

description	pid	process	target process
PID 4600 set thread context of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 set thread context of 2500	4600	ftewk.exe	ftewk.exe
PID 3436 set thread context of 3624	3436	ftewk.exe	AppLaunch.exe

Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery

Program crash ⋅ 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1864	2288	WerFault.exe	99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe
2024	4832	WerFault.exe	ftewk.exe
740	2500	WerFault.exe	ftewk.exe
4832	4744	WerFault.exe	ftewk.exe

Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

TTPs:

Scheduled Task

Processes:

schtasks.exe

pid process

4320 schtasks.exe
Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs

Processes:

ftewk.exeAppLaunch.exerundll32.exe

pid process

2500 ftewk.exe
3624 AppLaunch.exe
2172 rundll32.exe
2172 rundll32.exe
2172 rundll32.exe
2172 rundll32.exe
Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs

Processes:

ftewk.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 2500 ftewk.exe
Token: SeDebugPrivilege 3624 AppLaunch.exe

pid	process
4320	schtasks.exe

pid	process
2500	ftewk.exe
3624	AppLaunch.exe
2172	rundll32.exe
2172	rundll32.exe
2172	rundll32.exe
2172	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2500	ftewk.exe
Token: SeDebugPrivilege	3624	AppLaunch.exe

Suspicious use of WriteProcessMemory ⋅ 41 IoCs

Processes:

99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exeftewk.execmd.exeftewk.exe

description	pid	process	target process
PID 2288 wrote to memory of 4600	2288	99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe	ftewk.exe
PID 2288 wrote to memory of 4600	2288	99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe	ftewk.exe
PID 2288 wrote to memory of 4600	2288	99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe	ftewk.exe
PID 4600 wrote to memory of 4308	4600	ftewk.exe	cmd.exe
PID 4600 wrote to memory of 4308	4600	ftewk.exe	cmd.exe
PID 4600 wrote to memory of 4308	4600	ftewk.exe	cmd.exe
PID 4600 wrote to memory of 4320	4600	ftewk.exe	schtasks.exe
PID 4600 wrote to memory of 4320	4600	ftewk.exe	schtasks.exe
PID 4600 wrote to memory of 4320	4600	ftewk.exe	schtasks.exe
PID 4308 wrote to memory of 2464	4308	cmd.exe	reg.exe
PID 4308 wrote to memory of 2464	4308	cmd.exe	reg.exe
PID 4308 wrote to memory of 2464	4308	cmd.exe	reg.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 3436	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 4600 wrote to memory of 2500	4600	ftewk.exe	ftewk.exe
PID 3436 wrote to memory of 3624	3436	ftewk.exe	AppLaunch.exe
PID 3436 wrote to memory of 3624	3436	ftewk.exe	AppLaunch.exe
PID 3436 wrote to memory of 3624	3436	ftewk.exe	AppLaunch.exe
PID 3436 wrote to memory of 3624	3436	ftewk.exe	AppLaunch.exe
PID 3436 wrote to memory of 3624	3436	ftewk.exe	AppLaunch.exe
PID 4600 wrote to memory of 2172	4600	ftewk.exe	rundll32.exe
PID 4600 wrote to memory of 2172	4600	ftewk.exe	rundll32.exe
PID 4600 wrote to memory of 2172	4600	ftewk.exe	rundll32.exe

outlook_win_path ⋅ 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe

"C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe"

Checks computer location settings
Suspicious use of WriteProcessMemory

PID:2288

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

"C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"

Executes dropped EXE
Checks computer location settings
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory

PID:4600

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\

Suspicious use of WriteProcessMemory

PID:4308

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\

PID:2464

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe" /F

Creates scheduled task(s)

PID:4320

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

"C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"

Executes dropped EXE
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory

PID:3436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:3624

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

"C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"

Executes dropped EXE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:2500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 1508

Program crash

PID:740

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll, Main

Blocklisted process makes network request
Loads dropped DLL
Accesses Microsoft Outlook profiles
Suspicious behavior: EnumeratesProcesses
outlook_win_path

PID:2172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 1108

Program crash

PID:1864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2288 -ip 2288

PID:4592

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

Executes dropped EXE

PID:4832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 252

Program crash

PID:2024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4832 -ip 4832

PID:3456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2500 -ip 2500

PID:3596

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe

Executes dropped EXE

PID:4744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 252

Program crash

PID:4832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4744 -ip 4744

PID:1508

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Credentials in Files

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
MD5
d5a042d15c800a5f811e993b95d64596

SHA1
3ca2653f3ec0da78c094beaf3529fffc5784ef37

SHA256
99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

SHA512
8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
MD5
d5a042d15c800a5f811e993b95d64596

SHA1
3ca2653f3ec0da78c094beaf3529fffc5784ef37

SHA256
99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

SHA512
8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
MD5
d5a042d15c800a5f811e993b95d64596

SHA1
3ca2653f3ec0da78c094beaf3529fffc5784ef37

SHA256
99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

SHA512
8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
MD5
d5a042d15c800a5f811e993b95d64596

SHA1
3ca2653f3ec0da78c094beaf3529fffc5784ef37

SHA256
99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

SHA512
8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
MD5
d5a042d15c800a5f811e993b95d64596

SHA1
3ca2653f3ec0da78c094beaf3529fffc5784ef37

SHA256
99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

SHA512
8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
MD5
d5a042d15c800a5f811e993b95d64596

SHA1
3ca2653f3ec0da78c094beaf3529fffc5784ef37

SHA256
99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

SHA512
8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Download Submit
C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
MD5
d4ca12f7203548519be8455bd836274f

SHA1
7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

SHA256
7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

SHA512
e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

Download Submit
C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
MD5
d4ca12f7203548519be8455bd836274f

SHA1
7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

SHA256
7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

SHA512
e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

Download Submit
memory/2172-181-0x0000000000000000-mapping.dmp

Download
memory/2288-130-0x000000000066D000-0x000000000068B000-memory.dmp

Download
memory/2288-132-0x0000000000400000-0x0000000000491000-memory.dmp

Download
memory/2288-131-0x00000000020F0000-0x0000000002128000-memory.dmp

Download
memory/2464-142-0x0000000000000000-mapping.dmp

Download
memory/2500-170-0x0000000008950000-0x0000000008B12000-memory.dmp

Download
memory/2500-163-0x0000000005E80000-0x0000000005E92000-memory.dmp

Download
memory/2500-172-0x0000000009D40000-0x0000000009D90000-memory.dmp

Download
memory/2500-171-0x0000000008B60000-0x000000000908C000-memory.dmp

Download
memory/2500-169-0x00000000086B0000-0x00000000086CE000-memory.dmp

Download
memory/2500-149-0x0000000000000000-mapping.dmp

Download
memory/2500-150-0x0000000000400000-0x00000000004F8000-memory.dmp

Download
memory/2500-168-0x00000000084D0000-0x0000000008562000-memory.dmp

Download
memory/2500-152-0x0000000000400000-0x00000000004F8000-memory.dmp

Download
memory/2500-153-0x0000000000400000-0x00000000004F8000-memory.dmp

Download
memory/2500-154-0x0000000000400000-0x00000000004F8000-memory.dmp

Download
memory/2500-155-0x0000000000761000-0x000000000078D000-memory.dmp

Download
memory/2500-156-0x0000000000890000-0x00000000008CA000-memory.dmp

Download
memory/2500-157-0x0000000000400000-0x00000000004F8000-memory.dmp

Download
memory/2500-167-0x0000000008450000-0x00000000084C6000-memory.dmp

Download
memory/2500-166-0x0000000005F30000-0x0000000005F96000-memory.dmp

Download
memory/2500-165-0x00000000078B0000-0x00000000078EC000-memory.dmp

Download
memory/2500-161-0x0000000004B40000-0x00000000050E4000-memory.dmp

Download
memory/2500-162-0x00000000057F0000-0x0000000005E08000-memory.dmp

Download
memory/2500-164-0x00000000075B0000-0x00000000076BA000-memory.dmp

Download
memory/3436-146-0x0000000000400000-0x0000000000449000-memory.dmp

Download
memory/3436-144-0x0000000000400000-0x0000000000449000-memory.dmp

Download
memory/3436-173-0x0000000000400000-0x0000000000449000-memory.dmp

Download
memory/3436-143-0x0000000000000000-mapping.dmp

Download
memory/3436-148-0x0000000000400000-0x0000000000449000-memory.dmp

Download
memory/3436-147-0x0000000000400000-0x0000000000449000-memory.dmp

Download
memory/3436-180-0x0000000000400000-0x0000000000449000-memory.dmp

Download
memory/3624-174-0x0000000000000000-mapping.dmp

Download
memory/3624-175-0x0000000000400000-0x0000000000420000-memory.dmp

Download
memory/4308-137-0x0000000000000000-mapping.dmp

Download
memory/4320-140-0x0000000000000000-mapping.dmp

Download
memory/4600-138-0x00000000004A0000-0x00000000005A0000-memory.dmp

Download
memory/4600-139-0x0000000002090000-0x00000000020C8000-memory.dmp

Download
memory/4600-133-0x0000000000000000-mapping.dmp

Download
memory/4600-141-0x0000000000400000-0x0000000000491000-memory.dmp

Download
memory/4744-186-0x0000000000400000-0x0000000000491000-memory.dmp

Download
memory/4744-185-0x0000000000681000-0x000000000069F000-memory.dmp

Download
memory/4832-160-0x0000000000400000-0x0000000000491000-memory.dmp

Download
memory/4832-159-0x00000000005B1000-0x00000000005CF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Downloads