amadey | 45e94c10bbc148cc1f0e810ef4a64b3b2814960515bbe6c69d8570dde960e0b2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe
Size

390KB
MD5

96a485e578b54f2cde0c37c6f512e0c0
SHA1

0a5740973b41ae78b864ded4bc40ea2d697c118f
SHA256

02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b
SHA512

003eadf321e2614e3cf10cbbb177df679223e60866f3defa0a5851046b55a1aded5cd8cfef293c702b6d40b624b28f7c57563d106c292e33d80efed9e37c83e0
SSDEEP

6144:Kay+bnr+Xp0yN90QEw2RqEJ7YkWnjBNsnDwA16Ngl+U+YQqNwk2eAsOXmE5JCzHZ:WMrXy90OEl162l+UAkAZ26CApO

Score

10^/10

amadey healer redline krast dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral3/files/0x000800000002341f-12.dat	healer
behavioral3/memory/3876-14-0x0000000000E30000-0x0000000000E3A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p7788980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p7788980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p7788980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p7788980.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p7788980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p7788980.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x000700000002341d-31.dat	family_redline
behavioral3/memory/1472-33-0x0000000000550000-0x0000000000580000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	r4340725.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 7 IoCs

pid	Process
3560	z5801744.exe
3876	p7788980.exe
2884	r4340725.exe
2064	legola.exe
1472	t2543361.exe
4616	legola.exe
1580	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p7788980.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5801744.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	p7788980.exe
3876	p7788980.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	p7788980.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3560	4520	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe	84
PID 4520 wrote to memory of 3560	4520	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe	84
PID 4520 wrote to memory of 3560	4520	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe	84
PID 3560 wrote to memory of 3876	3560	z5801744.exe	85
PID 3560 wrote to memory of 3876	3560	z5801744.exe	85
PID 3560 wrote to memory of 2884	3560	z5801744.exe	95
PID 3560 wrote to memory of 2884	3560	z5801744.exe	95
PID 3560 wrote to memory of 2884	3560	z5801744.exe	95
PID 2884 wrote to memory of 2064	2884	r4340725.exe	97
PID 2884 wrote to memory of 2064	2884	r4340725.exe	97
PID 2884 wrote to memory of 2064	2884	r4340725.exe	97
PID 4520 wrote to memory of 1472	4520	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe	98
PID 4520 wrote to memory of 1472	4520	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe	98
PID 4520 wrote to memory of 1472	4520	02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe	98
PID 2064 wrote to memory of 2788	2064	legola.exe	99
PID 2064 wrote to memory of 2788	2064	legola.exe	99
PID 2064 wrote to memory of 2788	2064	legola.exe	99
PID 2064 wrote to memory of 3656	2064	legola.exe	101
PID 2064 wrote to memory of 3656	2064	legola.exe	101
PID 2064 wrote to memory of 3656	2064	legola.exe	101
PID 3656 wrote to memory of 1040	3656	cmd.exe	103
PID 3656 wrote to memory of 1040	3656	cmd.exe	103
PID 3656 wrote to memory of 1040	3656	cmd.exe	103
PID 3656 wrote to memory of 4732	3656	cmd.exe	104
PID 3656 wrote to memory of 4732	3656	cmd.exe	104
PID 3656 wrote to memory of 4732	3656	cmd.exe	104
PID 3656 wrote to memory of 540	3656	cmd.exe	105
PID 3656 wrote to memory of 540	3656	cmd.exe	105
PID 3656 wrote to memory of 540	3656	cmd.exe	105
PID 3656 wrote to memory of 1708	3656	cmd.exe	106
PID 3656 wrote to memory of 1708	3656	cmd.exe	106
PID 3656 wrote to memory of 1708	3656	cmd.exe	106
PID 3656 wrote to memory of 2128	3656	cmd.exe	107
PID 3656 wrote to memory of 2128	3656	cmd.exe	107
PID 3656 wrote to memory of 2128	3656	cmd.exe	107
PID 3656 wrote to memory of 2844	3656	cmd.exe	108
PID 3656 wrote to memory of 2844	3656	cmd.exe	108
PID 3656 wrote to memory of 2844	3656	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe
"C:\Users\Admin\AppData\Local\Temp\02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2788
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3656
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1040
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:4732
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1708
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:2128
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:2844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe
  2⤵
  - Executes dropped EXE
  PID:1472

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2543361.exe

Filesize
173KB

MD5
3f4816bf5f356599abe2c8d4de820c48

SHA1
ca653d885670c9e9c769feb6fa686521e0481cbb

SHA256
8841cea2635137048ccfb5be215d9ac8d538b2cd30710b1baccb67a83494c4b2

SHA512
b7c7b8d93cc0d74f6953ad5beccb2664c9c3dbdb7fca7f3aa8f4b05689bb4b95268685a102e38c6313a0d9400d9144aa90f0d8f3b4169f274a7be3ac216ce35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5801744.exe

Filesize
234KB

MD5
5dd82db66268a4b0f22e71adeaac0f32

SHA1
0f7082e1d2f8a34e8113b9299a609b40d0adcd5c

SHA256
d4a2e3dd8a69ca77f27ddce69f4c791e7611eaa72ca3547c8498068877b70b20

SHA512
879997f6fcec3110186f069e29e3304ef0791358e28ced0ea01e55520eb6247ea2e4fd4daa8d29a8ee0ac678a7fcb3a59dc534e10a9df36eb8737fbf49c494cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7788980.exe

Filesize
11KB

MD5
dce80cd173227baec918467eb5fc866a

SHA1
a152c2a8b6937591b17992d076b9bd87d80bd476

SHA256
811e7f0dc3fafe8c8a1995e710e74afa46725bcdfd4ed2d54c8398149f4ff4ba

SHA512
8e1508e54cc5e876fabeeffe7a0ed06f4d681567bd66f68c0604db2ba5b49d01a7147dcd7c9b374e386f7878dea35efac613f3f2a5a77db9f4960b4a66dead43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4340725.exe

Filesize
223KB

MD5
75472cef98fac29032610df4207d9b57

SHA1
174e6cc639afd8d27d151ae40fdd4566526c2d39

SHA256
9b9a39321869cdfca455862b642ea93dc3e9e2b884989b375496470a46c26f8f

SHA512
e836f212da764abae287bc158644f947c2d777bef654e1338651e08bc074d99d26857b4db78abb49b87263847fcc02e9e7d780504b86b558ca26c7d7e387a295

Download Submit
memory/1472-36-0x0000000005050000-0x000000000515A000-memory.dmp

Filesize
1.0MB

Download
memory/1472-33-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/1472-34-0x0000000000E50000-0x0000000000E56000-memory.dmp

Filesize
24KB

Download
memory/1472-35-0x0000000005560000-0x0000000005B78000-memory.dmp

Filesize
6.1MB

Download
memory/1472-37-0x0000000004ED0000-0x0000000004EE2000-memory.dmp

Filesize
72KB

Download
memory/1472-38-0x0000000004F40000-0x0000000004F7C000-memory.dmp

Filesize
240KB

Download
memory/1472-39-0x0000000004F80000-0x0000000004FCC000-memory.dmp

Filesize
304KB

Download
memory/3876-14-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Filesize
40KB

Download
memory/3876-15-0x00007FFE39533000-0x00007FFE39535000-memory.dmp

Filesize
8KB

Download