amadey | a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe
Size

739KB
MD5

60b587fff23f1c7c539a22e9c806b0cc
SHA1

dd10e67ee98edc3f7c6bc15afed32c8f1f1d7072
SHA256

a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3
SHA512

db910b8640e5361bd4bff03233b7cd76703272b134ab28bfbe34b7579829594aef01318d6d385b0b9da5200623c9555139c8b34272636d516f13ac00737b488e
SSDEEP

12288:xMrYy90+njJXfnkxr7Dpu/JCZ1lVZK8tDL3l96CR88RScIPICdEmy9nD8Wn0jPgn:Fyxepu/JCZ5Uu/3l9RR88RScIzs9nD8i

Score

10^/10

amadey redline fusa discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

fusa

193.233.20.12:4132

Attributes

auth_value
a08b2f01bd2af756e38c5dd60e87e697

Extracted

Family

amadey

Version

3.66

62.204.41.5/Bu58Ngs/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	miG76.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	mnolyk.exe

Executes dropped EXE 6 IoCs

pid	Process
5080	sUI87Nf.exe
3660	sGe96oB.exe
4580	kML76uS.exe
1768	miG76.exe
936	mnolyk.exe
4992	nrB11jO.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	sGe96oB.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	sUI87Nf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sUI87Nf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	sGe96oB.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	4992	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4580	kML76uS.exe
4580	kML76uS.exe
4992	nrB11jO.exe
4992	nrB11jO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	kML76uS.exe
Token: SeDebugPrivilege	4992	nrB11jO.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 5080	4500	a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe	80
PID 4500 wrote to memory of 5080	4500	a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe	80
PID 4500 wrote to memory of 5080	4500	a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe	80
PID 5080 wrote to memory of 3660	5080	sUI87Nf.exe	82
PID 5080 wrote to memory of 3660	5080	sUI87Nf.exe	82
PID 5080 wrote to memory of 3660	5080	sUI87Nf.exe	82
PID 3660 wrote to memory of 4580	3660	sGe96oB.exe	83
PID 3660 wrote to memory of 4580	3660	sGe96oB.exe	83
PID 3660 wrote to memory of 4580	3660	sGe96oB.exe	83
PID 3660 wrote to memory of 1768	3660	sGe96oB.exe	84
PID 3660 wrote to memory of 1768	3660	sGe96oB.exe	84
PID 3660 wrote to memory of 1768	3660	sGe96oB.exe	84
PID 1768 wrote to memory of 936	1768	miG76.exe	85
PID 1768 wrote to memory of 936	1768	miG76.exe	85
PID 1768 wrote to memory of 936	1768	miG76.exe	85
PID 5080 wrote to memory of 4992	5080	sUI87Nf.exe	86
PID 5080 wrote to memory of 4992	5080	sUI87Nf.exe	86
PID 5080 wrote to memory of 4992	5080	sUI87Nf.exe	86
PID 936 wrote to memory of 116	936	mnolyk.exe	87
PID 936 wrote to memory of 116	936	mnolyk.exe	87
PID 936 wrote to memory of 116	936	mnolyk.exe	87
PID 936 wrote to memory of 4548	936	mnolyk.exe	89
PID 936 wrote to memory of 4548	936	mnolyk.exe	89
PID 936 wrote to memory of 4548	936	mnolyk.exe	89
PID 4548 wrote to memory of 4704	4548	cmd.exe	91
PID 4548 wrote to memory of 4704	4548	cmd.exe	91
PID 4548 wrote to memory of 4704	4548	cmd.exe	91
PID 4548 wrote to memory of 4072	4548	cmd.exe	92
PID 4548 wrote to memory of 4072	4548	cmd.exe	92
PID 4548 wrote to memory of 4072	4548	cmd.exe	92
PID 4548 wrote to memory of 3412	4548	cmd.exe	93
PID 4548 wrote to memory of 3412	4548	cmd.exe	93
PID 4548 wrote to memory of 3412	4548	cmd.exe	93
PID 4548 wrote to memory of 3752	4548	cmd.exe	94
PID 4548 wrote to memory of 3752	4548	cmd.exe	94
PID 4548 wrote to memory of 3752	4548	cmd.exe	94
PID 4548 wrote to memory of 3656	4548	cmd.exe	95
PID 4548 wrote to memory of 3656	4548	cmd.exe	95
PID 4548 wrote to memory of 3656	4548	cmd.exe	95
PID 4548 wrote to memory of 3648	4548	cmd.exe	96
PID 4548 wrote to memory of 3648	4548	cmd.exe	96
PID 4548 wrote to memory of 3648	4548	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe
"C:\Users\Admin\AppData\Local\Temp\a816ffbcdbff0c6bb772547247fd954f0b796c9db2600e8716e801e66c9833d3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sUI87Nf.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sUI87Nf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe96oB.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe96oB.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kML76uS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kML76uS.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\miG76.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\miG76.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:116
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "mnolyk.exe" /P "Admin:N"
        7⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "mnolyk.exe" /P "Admin:R" /E
        7⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5eb6b96734" /P "Admin:N"
        7⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5eb6b96734" /P "Admin:R" /E
        7⤵
        
        PID:3648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nrB11jO.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nrB11jO.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1180
      4⤵
      Program crash
      PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4992 -ip 4992
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sUI87Nf.exe

Filesize
635KB

MD5
a782eaed4849193d06b380017c7b2063

SHA1
6cae3da20d48d8d5c79e2bb601ea390b7366b732

SHA256
f838adffd3f4029acc1e96532aa639abfe83513c501576fc82828b5384d1a0f1

SHA512
f48765a43a2367db07e7bf773524b5127b62e74703ccfd1160cad85e37d31b67da76054120154badc9e41afc238dbafe5014dc046898df4403419bc446f2178c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sUI87Nf.exe

Filesize
635KB

MD5
a782eaed4849193d06b380017c7b2063

SHA1
6cae3da20d48d8d5c79e2bb601ea390b7366b732

SHA256
f838adffd3f4029acc1e96532aa639abfe83513c501576fc82828b5384d1a0f1

SHA512
f48765a43a2367db07e7bf773524b5127b62e74703ccfd1160cad85e37d31b67da76054120154badc9e41afc238dbafe5014dc046898df4403419bc446f2178c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nrB11jO.exe

Filesize
338KB

MD5
34c8db70ca3e7fa5ff713e6d0322767f

SHA1
b52b7734d5deceaf101279cd98fccfc26c9614e4

SHA256
dc89d449b00405be637c1c7932b01606709d7ecbc51b6c82f7c04cb1794f75f0

SHA512
58727d312967aa8c54b5826cf4edf22d62a3412526a09fac606e10d6136650314fff8338811f30a4980529c58071c981abb8e70c24bd7f37a992e7a26992aa5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nrB11jO.exe

Filesize
338KB

MD5
34c8db70ca3e7fa5ff713e6d0322767f

SHA1
b52b7734d5deceaf101279cd98fccfc26c9614e4

SHA256
dc89d449b00405be637c1c7932b01606709d7ecbc51b6c82f7c04cb1794f75f0

SHA512
58727d312967aa8c54b5826cf4edf22d62a3412526a09fac606e10d6136650314fff8338811f30a4980529c58071c981abb8e70c24bd7f37a992e7a26992aa5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe96oB.exe

Filesize
286KB

MD5
fcbf5f8394532ed9a3818de29849fe8d

SHA1
32d42b0b06a088367a1248f728c0b5e4d9ce15ec

SHA256
aedbee3b52fb41e09d8e46f1acb4b6230382b6ae873dc8f9354b22d89de9bb1e

SHA512
46bb57def028c416d429572c7e4eb0ff0034ec73945483c003e6ce98f80e47ac410223abd3eb11cd4a49a2f981edc9620c55db15b64ed9083871f747570a8557

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe96oB.exe

Filesize
286KB

MD5
fcbf5f8394532ed9a3818de29849fe8d

SHA1
32d42b0b06a088367a1248f728c0b5e4d9ce15ec

SHA256
aedbee3b52fb41e09d8e46f1acb4b6230382b6ae873dc8f9354b22d89de9bb1e

SHA512
46bb57def028c416d429572c7e4eb0ff0034ec73945483c003e6ce98f80e47ac410223abd3eb11cd4a49a2f981edc9620c55db15b64ed9083871f747570a8557

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kML76uS.exe

Filesize
175KB

MD5
da6f3bef8abc85bd09f50783059964e3

SHA1
a0f25f60ec1896c4c920ea397f40e6ce29724322

SHA256
e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

SHA512
4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kML76uS.exe

Filesize
175KB

MD5
da6f3bef8abc85bd09f50783059964e3

SHA1
a0f25f60ec1896c4c920ea397f40e6ce29724322

SHA256
e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

SHA512
4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\miG76.exe

Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\miG76.exe

Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
memory/4580-142-0x00000000058F0000-0x0000000005F08000-memory.dmp

Filesize
6.1MB

Download
memory/4580-145-0x0000000005410000-0x000000000544C000-memory.dmp

Filesize
240KB

Download
memory/4580-151-0x00000000067C0000-0x0000000006982000-memory.dmp

Filesize
1.8MB

Download
memory/4580-150-0x00000000064A0000-0x00000000064F0000-memory.dmp

Filesize
320KB

Download
memory/4580-149-0x00000000063F0000-0x0000000006466000-memory.dmp

Filesize
472KB

Download
memory/4580-148-0x00000000069A0000-0x0000000006F44000-memory.dmp

Filesize
5.6MB

Download
memory/4580-147-0x0000000006350000-0x00000000063E2000-memory.dmp

Filesize
584KB

Download
memory/4580-146-0x0000000005190000-0x00000000051F6000-memory.dmp

Filesize
408KB

Download
memory/4580-152-0x0000000007480000-0x00000000079AC000-memory.dmp

Filesize
5.2MB

Download
memory/4580-141-0x00000000009D0000-0x0000000000A02000-memory.dmp

Filesize
200KB

Download
memory/4580-144-0x00000000053B0000-0x00000000053C2000-memory.dmp

Filesize
72KB

Download
memory/4580-143-0x0000000005470000-0x000000000557A000-memory.dmp

Filesize
1.0MB

Download
memory/4992-170-0x00000000008E3000-0x0000000000911000-memory.dmp

Filesize
184KB

Download
memory/4992-171-0x0000000000870000-0x00000000008BB000-memory.dmp

Filesize
300KB

Download
memory/4992-172-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download
memory/4992-173-0x00000000008E3000-0x0000000000911000-memory.dmp

Filesize
184KB

Download