amadey | 88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213

Analysis

max time kernel
136s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
22/08/2023, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe
Size

591KB
MD5

4ef065f629781183032fb4cb8e96bce6
SHA1

c663addc912c8e5f4ba7b2f410282d5b3f0664fe
SHA256

88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213
SHA512

8fc5e79856e2d627db1a6cdd4bc9159c2b0e86e59e318b05a927bc3e4f7eab329a8eae30b10953063a1ca0dc119c5b9fd06fa18da1b79b07ccbd04d794e42706
SSDEEP

12288:/Mrty90aE/wFsROFgN491AXqswqAfuAQScNtOG7DrIITQ/AQvUaI8T6k3OSK9:myFEqsxq9O6swqAdQSWR7DrDq8aI8+kG

Score

10^/10

amadey redline piter infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

S-%lu-

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

piter

77.91.124.73:19071

Attributes

auth_value
7f92ff466423bb35edbfbc22f78b0bb9

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
3136	y4341646.exe
4948	y4464319.exe
5008	m2006370.exe
4960	n0085886.exe
164	saves.exe
1808	o5594418.exe
4544	saves.exe

Loads dropped DLL 1 IoCs

pid	Process
3952	rundll32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4341646.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4464319.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4692	schtasks.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3136	3148	88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe	69
PID 3148 wrote to memory of 3136	3148	88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe	69
PID 3148 wrote to memory of 3136	3148	88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe	69
PID 3136 wrote to memory of 4948	3136	y4341646.exe	70
PID 3136 wrote to memory of 4948	3136	y4341646.exe	70
PID 3136 wrote to memory of 4948	3136	y4341646.exe	70
PID 4948 wrote to memory of 5008	4948	y4464319.exe	71
PID 4948 wrote to memory of 5008	4948	y4464319.exe	71
PID 4948 wrote to memory of 5008	4948	y4464319.exe	71
PID 4948 wrote to memory of 4960	4948	y4464319.exe	72
PID 4948 wrote to memory of 4960	4948	y4464319.exe	72
PID 4948 wrote to memory of 4960	4948	y4464319.exe	72
PID 4960 wrote to memory of 164	4960	n0085886.exe	73
PID 4960 wrote to memory of 164	4960	n0085886.exe	73
PID 4960 wrote to memory of 164	4960	n0085886.exe	73
PID 3136 wrote to memory of 1808	3136	y4341646.exe	74
PID 3136 wrote to memory of 1808	3136	y4341646.exe	74
PID 3136 wrote to memory of 1808	3136	y4341646.exe	74
PID 164 wrote to memory of 4692	164	saves.exe	75
PID 164 wrote to memory of 4692	164	saves.exe	75
PID 164 wrote to memory of 4692	164	saves.exe	75
PID 164 wrote to memory of 696	164	saves.exe	76
PID 164 wrote to memory of 696	164	saves.exe	76
PID 164 wrote to memory of 696	164	saves.exe	76
PID 696 wrote to memory of 4652	696	cmd.exe	80
PID 696 wrote to memory of 4652	696	cmd.exe	80
PID 696 wrote to memory of 4652	696	cmd.exe	80
PID 696 wrote to memory of 4668	696	cmd.exe	79
PID 696 wrote to memory of 4668	696	cmd.exe	79
PID 696 wrote to memory of 4668	696	cmd.exe	79
PID 696 wrote to memory of 2176	696	cmd.exe	81
PID 696 wrote to memory of 2176	696	cmd.exe	81
PID 696 wrote to memory of 2176	696	cmd.exe	81
PID 696 wrote to memory of 2588	696	cmd.exe	82
PID 696 wrote to memory of 2588	696	cmd.exe	82
PID 696 wrote to memory of 2588	696	cmd.exe	82
PID 696 wrote to memory of 3596	696	cmd.exe	83
PID 696 wrote to memory of 3596	696	cmd.exe	83
PID 696 wrote to memory of 3596	696	cmd.exe	83
PID 696 wrote to memory of 3432	696	cmd.exe	84
PID 696 wrote to memory of 3432	696	cmd.exe	84
PID 696 wrote to memory of 3432	696	cmd.exe	84
PID 164 wrote to memory of 3952	164	saves.exe	85
PID 164 wrote to memory of 3952	164	saves.exe	85
PID 164 wrote to memory of 3952	164	saves.exe	85

C:\Users\Admin\AppData\Local\Temp\88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe
"C:\Users\Admin\AppData\Local\Temp\88aa7a094b0e069999e3d3c3010868391782e972b9ad95d95bfedbccde62f213.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4341646.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4341646.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4464319.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4464319.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m2006370.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m2006370.exe
      4⤵
      Executes dropped EXE
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0085886.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0085886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:164
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4692
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        7⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        7⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        7⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        7⤵
        
        PID:3432
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:3952
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5594418.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5594418.exe
    3⤵
    - Executes dropped EXE
    PID:1808

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4341646.exe

Filesize
476KB

MD5
634af8df662431044236c27882991a68

SHA1
771c5bbe1d6bb45575708bd16da60d323322c143

SHA256
6fe173c2b9769bc2244be070ede8e58a2902ea8e9ebb71df520669951d326d50

SHA512
21467c13485365127c06ea6bf3b1bc097bd6e7228ed0e6c8e19d7e6956034b445f5ee2b34ba24408a84d633816b5aa0386d991aa27445f978e43a5ec5e73ba95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4341646.exe

Filesize
476KB

MD5
634af8df662431044236c27882991a68

SHA1
771c5bbe1d6bb45575708bd16da60d323322c143

SHA256
6fe173c2b9769bc2244be070ede8e58a2902ea8e9ebb71df520669951d326d50

SHA512
21467c13485365127c06ea6bf3b1bc097bd6e7228ed0e6c8e19d7e6956034b445f5ee2b34ba24408a84d633816b5aa0386d991aa27445f978e43a5ec5e73ba95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5594418.exe

Filesize
174KB

MD5
c8346a98f246c733dd9b1c5eb820bb2b

SHA1
c571cf8ab9e7c50205cb74a708b2ff7be67034d9

SHA256
d7376ad6c6b4f8d7d3286418823d3bac1a1df5bbce0a67a8a89b5f5e6edb9a27

SHA512
69ec3923e4cebd32623ef5ce4c790b590bda3afe0127ff367c5844425483b2e564ab1ab3e912916789fa1486caea8fcdb64671773a3024c1fc4a433c32651334

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5594418.exe

Filesize
174KB

MD5
c8346a98f246c733dd9b1c5eb820bb2b

SHA1
c571cf8ab9e7c50205cb74a708b2ff7be67034d9

SHA256
d7376ad6c6b4f8d7d3286418823d3bac1a1df5bbce0a67a8a89b5f5e6edb9a27

SHA512
69ec3923e4cebd32623ef5ce4c790b590bda3afe0127ff367c5844425483b2e564ab1ab3e912916789fa1486caea8fcdb64671773a3024c1fc4a433c32651334

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4464319.exe

Filesize
320KB

MD5
e2cd70eae34c09dcf4c6db5183e5009b

SHA1
8e09b5ed4b1024d848e33d92af130287beef799c

SHA256
a5432fd5402646c47183c9b7621bebd97edb245a5309b1309260f4a03716bf4b

SHA512
481dabb6fc3ec8d98afed14d87d471a79ff163ffd64101f0867a0564e05168074d520424cabb1f3881082ad184aa64a9672f38cb6ca6e97f224e155b36cec67c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4464319.exe

Filesize
320KB

MD5
e2cd70eae34c09dcf4c6db5183e5009b

SHA1
8e09b5ed4b1024d848e33d92af130287beef799c

SHA256
a5432fd5402646c47183c9b7621bebd97edb245a5309b1309260f4a03716bf4b

SHA512
481dabb6fc3ec8d98afed14d87d471a79ff163ffd64101f0867a0564e05168074d520424cabb1f3881082ad184aa64a9672f38cb6ca6e97f224e155b36cec67c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m2006370.exe

Filesize
140KB

MD5
9c33adedc9b143b549a568bf82463b8c

SHA1
0c9fc79a13ef1de00740fe1a9ac06fec21c69475

SHA256
5654a249bf401326da167586498d0f6f9c48a2ee2c777905ee9f1fa705cb02d0

SHA512
40070a9c0a76190d2585239b5a2326c754d30b6297d5a44ed329a5c70d93a5fa2305ee50ba320d097b5dc071e5b1daefe5e0341b9d289bb7d499ac4c094b663e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m2006370.exe

Filesize
140KB

MD5
9c33adedc9b143b549a568bf82463b8c

SHA1
0c9fc79a13ef1de00740fe1a9ac06fec21c69475

SHA256
5654a249bf401326da167586498d0f6f9c48a2ee2c777905ee9f1fa705cb02d0

SHA512
40070a9c0a76190d2585239b5a2326c754d30b6297d5a44ed329a5c70d93a5fa2305ee50ba320d097b5dc071e5b1daefe5e0341b9d289bb7d499ac4c094b663e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0085886.exe

Filesize
315KB

MD5
3d5e68fc2cabdb7d7e2a3b7c37fe1528

SHA1
1a76be127c892972f00c5341e01064c3dd049467

SHA256
5aec847fea5f458a1df73d779d407e7add3f244bec5ab21f49264f9b440072c5

SHA512
ca9d794c8f7588d371c75772bc1d8a5269a43d35b8f8ff05ca57ad17284235e7381c026b6cf8821be9f5bd05121209e145280ef6da966c1fae432d2647285adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0085886.exe

Filesize
315KB

MD5
3d5e68fc2cabdb7d7e2a3b7c37fe1528

SHA1
1a76be127c892972f00c5341e01064c3dd049467

SHA256
5aec847fea5f458a1df73d779d407e7add3f244bec5ab21f49264f9b440072c5

SHA512
ca9d794c8f7588d371c75772bc1d8a5269a43d35b8f8ff05ca57ad17284235e7381c026b6cf8821be9f5bd05121209e145280ef6da966c1fae432d2647285adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
315KB

MD5
3d5e68fc2cabdb7d7e2a3b7c37fe1528

SHA1
1a76be127c892972f00c5341e01064c3dd049467

SHA256
5aec847fea5f458a1df73d779d407e7add3f244bec5ab21f49264f9b440072c5

SHA512
ca9d794c8f7588d371c75772bc1d8a5269a43d35b8f8ff05ca57ad17284235e7381c026b6cf8821be9f5bd05121209e145280ef6da966c1fae432d2647285adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
315KB

MD5
3d5e68fc2cabdb7d7e2a3b7c37fe1528

SHA1
1a76be127c892972f00c5341e01064c3dd049467

SHA256
5aec847fea5f458a1df73d779d407e7add3f244bec5ab21f49264f9b440072c5

SHA512
ca9d794c8f7588d371c75772bc1d8a5269a43d35b8f8ff05ca57ad17284235e7381c026b6cf8821be9f5bd05121209e145280ef6da966c1fae432d2647285adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
315KB

MD5
3d5e68fc2cabdb7d7e2a3b7c37fe1528

SHA1
1a76be127c892972f00c5341e01064c3dd049467

SHA256
5aec847fea5f458a1df73d779d407e7add3f244bec5ab21f49264f9b440072c5

SHA512
ca9d794c8f7588d371c75772bc1d8a5269a43d35b8f8ff05ca57ad17284235e7381c026b6cf8821be9f5bd05121209e145280ef6da966c1fae432d2647285adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

Filesize
315KB

MD5
3d5e68fc2cabdb7d7e2a3b7c37fe1528

SHA1
1a76be127c892972f00c5341e01064c3dd049467

SHA256
5aec847fea5f458a1df73d779d407e7add3f244bec5ab21f49264f9b440072c5

SHA512
ca9d794c8f7588d371c75772bc1d8a5269a43d35b8f8ff05ca57ad17284235e7381c026b6cf8821be9f5bd05121209e145280ef6da966c1fae432d2647285adc

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
374bfdcfcf19f4edfe949022092848d2

SHA1
df5ee40497e98efcfba30012452d433373d287d4

SHA256
224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

SHA512
bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
5bc0153d2973241b72a38c51a2f72116

SHA1
cd9c689663557452631d9f8ff609208b01884a32

SHA256
68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

SHA512
2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

Download Submit
memory/1808-154-0x0000000005660000-0x000000000576A000-memory.dmp

Filesize
1.0MB

Download
memory/1808-156-0x00000000055B0000-0x00000000055EE000-memory.dmp

Filesize
248KB

Download
memory/1808-157-0x00000000055F0000-0x000000000563B000-memory.dmp

Filesize
300KB

Download
memory/1808-158-0x0000000072C50000-0x000000007333E000-memory.dmp

Filesize
6.9MB

Download
memory/1808-155-0x0000000005550000-0x0000000005562000-memory.dmp

Filesize
72KB

Download
memory/1808-153-0x0000000005B60000-0x0000000006166000-memory.dmp

Filesize
6.0MB

Download
memory/1808-152-0x0000000002EB0000-0x0000000002EB6000-memory.dmp

Filesize
24KB

Download
memory/1808-151-0x0000000072C50000-0x000000007333E000-memory.dmp

Filesize
6.9MB

Download
memory/1808-150-0x0000000000C20000-0x0000000000C50000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads