amadey | a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427

Analysis

max time kernel
135s
max time network
153s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
21/08/2023, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe
Size

592KB
MD5

ff33a71602fc223bc4f769d3ed9f7cac
SHA1

daa8e1a4e29575e03b1e98f3a646bbd3bf9d93c2
SHA256

a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427
SHA512

1b3fb161420b0adf6e448006a79103679add9a7471d415c134ad5c146a312541557d57b7813f10f3e9e167c06f11d685ad9148203023eea59b7a9a7be3edbfbc
SSDEEP

12288:WMr2y900+oZ5mCdS3zDJcpCI6bybGK6tz0vx7EFmjkp15XoRMCR:UyVjfOJFGz6h/XbCR

Score

10^/10

amadey redline lang infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

S-%lu-

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

lang

77.91.124.73:19071

Attributes

auth_value
92c0fc2b7a8b3fc5a01baa1abf31c42a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
3136	y4874033.exe
2688	y7677159.exe
3228	m9964596.exe
5064	n9145650.exe
4156	saves.exe
3404	o5827766.exe
4812	saves.exe

Loads dropped DLL 1 IoCs

pid	Process
4472	rundll32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4874033.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7677159.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2324	schtasks.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3136	4904	a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe	70
PID 4904 wrote to memory of 3136	4904	a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe	70
PID 4904 wrote to memory of 3136	4904	a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe	70
PID 3136 wrote to memory of 2688	3136	y4874033.exe	71
PID 3136 wrote to memory of 2688	3136	y4874033.exe	71
PID 3136 wrote to memory of 2688	3136	y4874033.exe	71
PID 2688 wrote to memory of 3228	2688	y7677159.exe	72
PID 2688 wrote to memory of 3228	2688	y7677159.exe	72
PID 2688 wrote to memory of 3228	2688	y7677159.exe	72
PID 2688 wrote to memory of 5064	2688	y7677159.exe	73
PID 2688 wrote to memory of 5064	2688	y7677159.exe	73
PID 2688 wrote to memory of 5064	2688	y7677159.exe	73
PID 5064 wrote to memory of 4156	5064	n9145650.exe	74
PID 5064 wrote to memory of 4156	5064	n9145650.exe	74
PID 5064 wrote to memory of 4156	5064	n9145650.exe	74
PID 3136 wrote to memory of 3404	3136	y4874033.exe	75
PID 3136 wrote to memory of 3404	3136	y4874033.exe	75
PID 3136 wrote to memory of 3404	3136	y4874033.exe	75
PID 4156 wrote to memory of 2324	4156	saves.exe	76
PID 4156 wrote to memory of 2324	4156	saves.exe	76
PID 4156 wrote to memory of 2324	4156	saves.exe	76
PID 4156 wrote to memory of 428	4156	saves.exe	77
PID 4156 wrote to memory of 428	4156	saves.exe	77
PID 4156 wrote to memory of 428	4156	saves.exe	77
PID 428 wrote to memory of 4556	428	cmd.exe	80
PID 428 wrote to memory of 4556	428	cmd.exe	80
PID 428 wrote to memory of 4556	428	cmd.exe	80
PID 428 wrote to memory of 4392	428	cmd.exe	81
PID 428 wrote to memory of 4392	428	cmd.exe	81
PID 428 wrote to memory of 4392	428	cmd.exe	81
PID 428 wrote to memory of 3816	428	cmd.exe	82
PID 428 wrote to memory of 3816	428	cmd.exe	82
PID 428 wrote to memory of 3816	428	cmd.exe	82
PID 428 wrote to memory of 3812	428	cmd.exe	83
PID 428 wrote to memory of 3812	428	cmd.exe	83
PID 428 wrote to memory of 3812	428	cmd.exe	83
PID 428 wrote to memory of 2916	428	cmd.exe	84
PID 428 wrote to memory of 2916	428	cmd.exe	84
PID 428 wrote to memory of 2916	428	cmd.exe	84
PID 428 wrote to memory of 4620	428	cmd.exe	85
PID 428 wrote to memory of 4620	428	cmd.exe	85
PID 428 wrote to memory of 4620	428	cmd.exe	85
PID 4156 wrote to memory of 4472	4156	saves.exe	87
PID 4156 wrote to memory of 4472	4156	saves.exe	87
PID 4156 wrote to memory of 4472	4156	saves.exe	87

C:\Users\Admin\AppData\Local\Temp\a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe
"C:\Users\Admin\AppData\Local\Temp\a23fdd75a2d9e82d73f030102f214322b02dd2b577df5660522765de29c79427.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4874033.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4874033.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7677159.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7677159.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9964596.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9964596.exe
      4⤵
      Executes dropped EXE
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9145650.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9145650.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2324
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        7⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        7⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        7⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        7⤵
        
        PID:4620
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:4472
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5827766.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5827766.exe
    3⤵
    - Executes dropped EXE
    PID:3404

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4874033.exe

Filesize
476KB

MD5
81469f73e2770017f6e971fe4e427708

SHA1
bd6981ea9ab8ce0c5a9c445231250a24dc4f2135

SHA256
eed94697243943d68d8d999f702fa07af8a6ef14c27e704db0db29a4d5306415

SHA512
3ee0e2f00c7df134fa68b413bcd5af1a046396adeafcb8967400fe972387aa4cc1a0ff5d4c7541fd6ef0d0cf273b6b7755c71567fd88222d0b46a669b7b78a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4874033.exe

Filesize
476KB

MD5
81469f73e2770017f6e971fe4e427708

SHA1
bd6981ea9ab8ce0c5a9c445231250a24dc4f2135

SHA256
eed94697243943d68d8d999f702fa07af8a6ef14c27e704db0db29a4d5306415

SHA512
3ee0e2f00c7df134fa68b413bcd5af1a046396adeafcb8967400fe972387aa4cc1a0ff5d4c7541fd6ef0d0cf273b6b7755c71567fd88222d0b46a669b7b78a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5827766.exe

Filesize
174KB

MD5
7b14cc96a784c852d6ea2cf93a7de6b3

SHA1
1d417a6dbf0e18d8cbbcc34f045e45e73658c16b

SHA256
611dfad09aa493e1a05b0773c258f4a0b1f04a6cad091eab5a9aa698a04af670

SHA512
9a0f6aba365626df805f7b405ee2a7ac93c6ee32b84e4c6fe0fd957a04145676f622aec787f80666cde4638059a6903b2750fbfa704b58e45be412da3d801488

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5827766.exe

Filesize
174KB

MD5
7b14cc96a784c852d6ea2cf93a7de6b3

SHA1
1d417a6dbf0e18d8cbbcc34f045e45e73658c16b

SHA256
611dfad09aa493e1a05b0773c258f4a0b1f04a6cad091eab5a9aa698a04af670

SHA512
9a0f6aba365626df805f7b405ee2a7ac93c6ee32b84e4c6fe0fd957a04145676f622aec787f80666cde4638059a6903b2750fbfa704b58e45be412da3d801488

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7677159.exe

Filesize
320KB

MD5
113b9128323f31721e7f9b38151f08b9

SHA1
1821a310ab0626c870782e4a8018199b84bbf118

SHA256
44c6912d047316daa1bff123640fe35dab29cd557fd4141883d34d033a9ce0cd

SHA512
a239df3ff5e261e575f2b666348bb07026a53e381cd6170f5a297b12d1823e5d7082450e253a1b5fd97ea578db87f7b8146ec052e3a577d6aee27c4b08786128

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7677159.exe

Filesize
320KB

MD5
113b9128323f31721e7f9b38151f08b9

SHA1
1821a310ab0626c870782e4a8018199b84bbf118

SHA256
44c6912d047316daa1bff123640fe35dab29cd557fd4141883d34d033a9ce0cd

SHA512
a239df3ff5e261e575f2b666348bb07026a53e381cd6170f5a297b12d1823e5d7082450e253a1b5fd97ea578db87f7b8146ec052e3a577d6aee27c4b08786128

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9964596.exe

Filesize
140KB

MD5
571a3fa2954d3f33f971e623c441be10

SHA1
a902c96b17f79ebf29d8bd2b95181299ff3a779d

SHA256
d02897bad4976a29618bf4a3c8516359853d4ff8af15f19dc2f82526426b41be

SHA512
bf2445b8a1c92475e787f5556cf2b616fa9aa7785f4814918a791c9209ca3615371ea1855d0c0052c20b1efc0cca5d93e69b10ff9371f4254cfba50cf0bae03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m9964596.exe

Filesize
140KB

MD5
571a3fa2954d3f33f971e623c441be10

SHA1
a902c96b17f79ebf29d8bd2b95181299ff3a779d

SHA256
d02897bad4976a29618bf4a3c8516359853d4ff8af15f19dc2f82526426b41be

SHA512
bf2445b8a1c92475e787f5556cf2b616fa9aa7785f4814918a791c9209ca3615371ea1855d0c0052c20b1efc0cca5d93e69b10ff9371f4254cfba50cf0bae03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9145650.exe

Filesize
314KB

MD5
76a0fd2a7597e200803e52e3d05b17be

SHA1
e51eda3bb76f59b4b400a77d975509c71891330b

SHA256
1a40bec4add361bbb045da937abd16f037d429059a368738320123362f1f59b7

SHA512
a85c4268c65197eb1c4da78469d7d6350527039944b3a83f9eb15eca9bb2bdcfba9780d0bd15b5a9f65c96e10a41b2f3dd277a11309b335509ecc09c5a0432ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9145650.exe

Filesize
314KB

MD5
76a0fd2a7597e200803e52e3d05b17be

SHA1
e51eda3bb76f59b4b400a77d975509c71891330b

SHA256
1a40bec4add361bbb045da937abd16f037d429059a368738320123362f1f59b7

SHA512
a85c4268c65197eb1c4da78469d7d6350527039944b3a83f9eb15eca9bb2bdcfba9780d0bd15b5a9f65c96e10a41b2f3dd277a11309b335509ecc09c5a0432ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
314KB

MD5
76a0fd2a7597e200803e52e3d05b17be

SHA1
e51eda3bb76f59b4b400a77d975509c71891330b

SHA256
1a40bec4add361bbb045da937abd16f037d429059a368738320123362f1f59b7

SHA512
a85c4268c65197eb1c4da78469d7d6350527039944b3a83f9eb15eca9bb2bdcfba9780d0bd15b5a9f65c96e10a41b2f3dd277a11309b335509ecc09c5a0432ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
314KB

MD5
76a0fd2a7597e200803e52e3d05b17be

SHA1
e51eda3bb76f59b4b400a77d975509c71891330b

SHA256
1a40bec4add361bbb045da937abd16f037d429059a368738320123362f1f59b7

SHA512
a85c4268c65197eb1c4da78469d7d6350527039944b3a83f9eb15eca9bb2bdcfba9780d0bd15b5a9f65c96e10a41b2f3dd277a11309b335509ecc09c5a0432ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
314KB

MD5
76a0fd2a7597e200803e52e3d05b17be

SHA1
e51eda3bb76f59b4b400a77d975509c71891330b

SHA256
1a40bec4add361bbb045da937abd16f037d429059a368738320123362f1f59b7

SHA512
a85c4268c65197eb1c4da78469d7d6350527039944b3a83f9eb15eca9bb2bdcfba9780d0bd15b5a9f65c96e10a41b2f3dd277a11309b335509ecc09c5a0432ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
314KB

MD5
76a0fd2a7597e200803e52e3d05b17be

SHA1
e51eda3bb76f59b4b400a77d975509c71891330b

SHA256
1a40bec4add361bbb045da937abd16f037d429059a368738320123362f1f59b7

SHA512
a85c4268c65197eb1c4da78469d7d6350527039944b3a83f9eb15eca9bb2bdcfba9780d0bd15b5a9f65c96e10a41b2f3dd277a11309b335509ecc09c5a0432ba

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
374bfdcfcf19f4edfe949022092848d2

SHA1
df5ee40497e98efcfba30012452d433373d287d4

SHA256
224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

SHA512
bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
memory/3404-157-0x000000000AB80000-0x000000000AC8A000-memory.dmp

Filesize
1.0MB

Download
memory/3404-159-0x000000000AB10000-0x000000000AB4E000-memory.dmp

Filesize
248KB

Download
memory/3404-160-0x000000000AC90000-0x000000000ACDB000-memory.dmp

Filesize
300KB

Download
memory/3404-161-0x00000000726A0000-0x0000000072D8E000-memory.dmp

Filesize
6.9MB

Download
memory/3404-158-0x000000000AAB0000-0x000000000AAC2000-memory.dmp

Filesize
72KB

Download
memory/3404-156-0x000000000B040000-0x000000000B646000-memory.dmp

Filesize
6.0MB

Download
memory/3404-155-0x0000000002F60000-0x0000000002F66000-memory.dmp

Filesize
24KB

Download
memory/3404-154-0x00000000726A0000-0x0000000072D8E000-memory.dmp

Filesize
6.9MB

Download
memory/3404-153-0x0000000000D70000-0x0000000000DA0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads