amadey | 172cb28c1c7948ece5287c566e9a684c56e64d85574d1636d5204e168771ce01

Resubmissions

20-09-2023 14:30

230920-rt5nzagg9v 10

Analysis

max time kernel
146s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2023 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55aa5e.exe
Size

6.9MB
MD5

56c197e493f74f9233a16cdefab3109f
SHA1

af35bd2fd5d884bdf6bea8aac695e98f5a00715a
SHA256

172cb28c1c7948ece5287c566e9a684c56e64d85574d1636d5204e168771ce01
SHA512

d2830cfebfaa859f5fca15e3c81799e99c3cb31f72b1075d8828f03a490bfe6196b34d35bbcaede32a6d63d5c2d9bc17bea009e1bd8787cb4397f6627328b086
SSDEEP

98304:ULop5mhzd71cBjG9Azp56BV8cM0AnwGSOnTXsYGeCW1zbiG54WeOVEMMRHGV7E:0op5mqU9KE8nNZnTXaexbZWsMGV7E

Score

10^/10

amadey redline infostealer spyware trojan vmprotect

Malware Config

Extracted

Family

amadey

Version

3.89

http://5.42.64.33/vu3skClDn/index.php

Attributes

install_dir
a304d35d74
install_file
yiueea.exe
strings_key
3ae6c4e6339065c6f5a368011bb5cb8c

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/4860-69-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

55aa5e.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation 55aa5e.exe
Executes dropped EXE 2 IoCs

Processes:

BestSoftware.exeBestSoftware.exe

pid process

4168 BestSoftware.exe
4500 BestSoftware.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	55aa5e.exe

pid	process
4168	BestSoftware.exe
4500	BestSoftware.exe

VMProtect packed file 9 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral3/memory/4680-1-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/4680-2-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/4680-14-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/3552-36-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/3552-37-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/3552-40-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/4576-142-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/4576-141-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect
behavioral3/memory/4576-145-0x0000000000050000-0x0000000000AC0000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

Processes:

BestSoftware.exeBestSoftware.exe

description	pid	process	target process
PID 4168 set thread context of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4500 set thread context of 3764	4500	BestSoftware.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1996 schtasks.exe

pid	process
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

55aa5e.exe55aa5e.exeBestSoftware.exeRegSvcs.exeRegSvcs.exe55aa5e.exe

pid	process
4680	55aa5e.exe
4680	55aa5e.exe
3552	55aa5e.exe
3552	55aa5e.exe
4168	BestSoftware.exe
4168	BestSoftware.exe
4860	RegSvcs.exe
4860	RegSvcs.exe
4860	RegSvcs.exe
4860	RegSvcs.exe
3764	RegSvcs.exe
3764	RegSvcs.exe
3764	RegSvcs.exe
3764	RegSvcs.exe
4576	55aa5e.exe
4576	55aa5e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

BestSoftware.exeRegSvcs.exeBestSoftware.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4168	BestSoftware.exe
Token: SeDebugPrivilege	4860	RegSvcs.exe
Token: SeDebugPrivilege	4500	BestSoftware.exe
Token: SeDebugPrivilege	3764	RegSvcs.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

55aa5e.exeBestSoftware.exeBestSoftware.exe

description	pid	process	target process
PID 4680 wrote to memory of 1996	4680	55aa5e.exe	schtasks.exe
PID 4680 wrote to memory of 1996	4680	55aa5e.exe	schtasks.exe
PID 4680 wrote to memory of 1996	4680	55aa5e.exe	schtasks.exe
PID 4680 wrote to memory of 4168	4680	55aa5e.exe	BestSoftware.exe
PID 4680 wrote to memory of 4168	4680	55aa5e.exe	BestSoftware.exe
PID 4680 wrote to memory of 4168	4680	55aa5e.exe	BestSoftware.exe
PID 4168 wrote to memory of 5044	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 5044	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 5044	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4168 wrote to memory of 4860	4168	BestSoftware.exe	RegSvcs.exe
PID 4680 wrote to memory of 4500	4680	55aa5e.exe	BestSoftware.exe
PID 4680 wrote to memory of 4500	4680	55aa5e.exe	BestSoftware.exe
PID 4680 wrote to memory of 4500	4680	55aa5e.exe	BestSoftware.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe
PID 4500 wrote to memory of 3764	4500	BestSoftware.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\55aa5e.exe
"C:\Users\Admin\AppData\Local\Temp\55aa5e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 55aa5e.exe /TR "C:\Users\Admin\AppData\Local\Temp\55aa5e.exe" /F
  2⤵
  - Creates scheduled task(s)
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\1000066001\BestSoftware.exe
  "C:\Users\Admin\AppData\Local\Temp\1000066001\BestSoftware.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:5044
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Users\Admin\AppData\Local\Temp\1000068001\BestSoftware.exe
  "C:\Users\Admin\AppData\Local\Temp\1000068001\BestSoftware.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3764

C:\Users\Admin\AppData\Local\Temp\55aa5e.exe
C:\Users\Admin\AppData\Local\Temp\55aa5e.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552

C:\Users\Admin\AppData\Local\Temp\55aa5e.exe
C:\Users\Admin\AppData\Local\Temp\55aa5e.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BestSoftware.exe.log

Filesize
522B

MD5
8334a471a4b492ece225b471b8ad2fc8

SHA1
1cb24640f32d23e8f7800bd0511b7b9c3011d992

SHA256
5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

SHA512
56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Filesize
2KB

MD5
c671d50d589ce7be9ad3ff4035e6ad63

SHA1
88cdc154077c8264149cb8b19e16ba07901e1dd6

SHA256
fb07948cb75ee2b9967b1a6386eb53a46573ae99c9ecb46f2b377af8df1b7568

SHA512
a40a7500a7896f2200754499c00e74a7b8a53578808d5408e1e31733d03cdeb2b3e520c1d9b71537f2877093b686811b8e20cbb5c8061e4d3e1d75a161cebae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002051\BRR.exe

Filesize
708B

MD5
2382378378c002d88b9a507c712c3349

SHA1
2e894db3808b554abadc8b144338ad9e2ea937ba

SHA256
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

SHA512
2120f9ae9e5d63ee9aa5aa25e24081662059bdeb01afd8b21ddb8bdfff22832ea0c1dec51dbcbf714e1e82537d624f0ddf0b862ff218b9d2a38941fbe63c3258

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\BestSoftware.exe

Filesize
1.4MB

MD5
1c9cb19f72b337353fab5826b145b2f3

SHA1
2fe6ddb2fb7fc0082388904ffddb5902c520179b

SHA256
f217f02bbbf1b37386d8611b2ef07dd562d33dc1b31d84a260e11decf082b66a

SHA512
90a14e5be34e1f6b23c1ccbfb80b5f29d1ce6e1d58573de82abeb14b5a00f2bfbda4fc0d45058d6a5362274c08b0d280a4d280097f72ba3eb9b59db46acaf1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\BestSoftware.exe

Filesize
1.4MB

MD5
1c9cb19f72b337353fab5826b145b2f3

SHA1
2fe6ddb2fb7fc0082388904ffddb5902c520179b

SHA256
f217f02bbbf1b37386d8611b2ef07dd562d33dc1b31d84a260e11decf082b66a

SHA512
90a14e5be34e1f6b23c1ccbfb80b5f29d1ce6e1d58573de82abeb14b5a00f2bfbda4fc0d45058d6a5362274c08b0d280a4d280097f72ba3eb9b59db46acaf1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\BestSoftware.exe

Filesize
1.4MB

MD5
1c9cb19f72b337353fab5826b145b2f3

SHA1
2fe6ddb2fb7fc0082388904ffddb5902c520179b

SHA256
f217f02bbbf1b37386d8611b2ef07dd562d33dc1b31d84a260e11decf082b66a

SHA512
90a14e5be34e1f6b23c1ccbfb80b5f29d1ce6e1d58573de82abeb14b5a00f2bfbda4fc0d45058d6a5362274c08b0d280a4d280097f72ba3eb9b59db46acaf1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000068001\BestSoftware.exe

Filesize
1.4MB

MD5
1c9cb19f72b337353fab5826b145b2f3

SHA1
2fe6ddb2fb7fc0082388904ffddb5902c520179b

SHA256
f217f02bbbf1b37386d8611b2ef07dd562d33dc1b31d84a260e11decf082b66a

SHA512
90a14e5be34e1f6b23c1ccbfb80b5f29d1ce6e1d58573de82abeb14b5a00f2bfbda4fc0d45058d6a5362274c08b0d280a4d280097f72ba3eb9b59db46acaf1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000068001\BestSoftware.exe

Filesize
1.4MB

MD5
1c9cb19f72b337353fab5826b145b2f3

SHA1
2fe6ddb2fb7fc0082388904ffddb5902c520179b

SHA256
f217f02bbbf1b37386d8611b2ef07dd562d33dc1b31d84a260e11decf082b66a

SHA512
90a14e5be34e1f6b23c1ccbfb80b5f29d1ce6e1d58573de82abeb14b5a00f2bfbda4fc0d45058d6a5362274c08b0d280a4d280097f72ba3eb9b59db46acaf1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000069051\11bestcrypt.exe

Filesize
1KB

MD5
bf00c8de950425eb991277d0f6521954

SHA1
b905849dac07a1893e14ce75b23d6e9170b4f972

SHA256
a93b38ed77ad75dc0119f8787cbcc699cd17192b1bb06209460be92d156ffff4

SHA512
dceb513f914cbd501c7ed94f623d3f6d9eb84f72bc1b8cd69ae141ead383dd04f0671a97a54002b7b4f2d55acb1f1c2b01f4b54511650f6ff8cca8322f31ce29

Download Submit
memory/3552-36-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/3552-37-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/3552-40-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/3552-35-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/3764-138-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/3764-137-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/3764-139-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4168-42-0x0000000004BC0000-0x0000000004CA6000-memory.dmp

Filesize
920KB

Download
memory/4168-33-0x0000000004AD0000-0x0000000004B6C000-memory.dmp

Filesize
624KB

Download
memory/4168-43-0x0000000004B80000-0x0000000004B9C000-memory.dmp

Filesize
112KB

Download
memory/4168-44-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-45-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-47-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-49-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-51-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-53-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-55-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-57-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-59-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-61-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-63-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-65-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-67-0x0000000004B80000-0x0000000004B95000-memory.dmp

Filesize
84KB

Download
memory/4168-68-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/4168-31-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4168-32-0x0000000000120000-0x000000000027A000-memory.dmp

Filesize
1.4MB

Download
memory/4168-71-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4168-34-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4168-41-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/4500-136-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4500-106-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4500-107-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4500-108-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4500-133-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/4576-141-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/4576-140-0x00000000014B0000-0x00000000014B1000-memory.dmp

Filesize
4KB

Download
memory/4576-142-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/4576-145-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/4680-2-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/4680-14-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/4680-1-0x0000000000050000-0x0000000000AC0000-memory.dmp

Filesize
10.4MB

Download
memory/4680-0-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/4860-73-0x00000000077A0000-0x0000000007D44000-memory.dmp

Filesize
5.6MB

Download
memory/4860-83-0x0000000008E10000-0x0000000008E86000-memory.dmp

Filesize
472KB

Download
memory/4860-74-0x00000000072E0000-0x0000000007372000-memory.dmp

Filesize
584KB

Download
memory/4860-88-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4860-86-0x0000000008F30000-0x0000000008F4E000-memory.dmp

Filesize
120KB

Download
memory/4860-85-0x0000000009760000-0x0000000009C8C000-memory.dmp

Filesize
5.2MB

Download
memory/4860-84-0x0000000009060000-0x0000000009222000-memory.dmp

Filesize
1.8MB

Download
memory/4860-72-0x0000000072A20000-0x00000000731D0000-memory.dmp

Filesize
7.7MB

Download
memory/4860-69-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4860-75-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/4860-82-0x0000000007ED0000-0x0000000007F36000-memory.dmp

Filesize
408KB

Download
memory/4860-81-0x0000000007610000-0x000000000765C000-memory.dmp

Filesize
304KB

Download
memory/4860-80-0x00000000075D0000-0x000000000760C000-memory.dmp

Filesize
240KB

Download
memory/4860-79-0x0000000007D50000-0x0000000007E5A000-memory.dmp

Filesize
1.0MB

Download
memory/4860-78-0x0000000007570000-0x0000000007582000-memory.dmp

Filesize
72KB

Download
memory/4860-77-0x0000000008370000-0x0000000008988000-memory.dmp

Filesize
6.1MB

Download
memory/4860-76-0x00000000073A0000-0x00000000073AA000-memory.dmp

Filesize
40KB

Download