amadey | 45e94c10bbc148cc1f0e810ef4a64b3b2814960515bbe6c69d8570dde960e0b2

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe
Size

390KB
MD5

8e667084524c9501437cd806a391ff09
SHA1

2c88b8d58c6cd3e3a299a36687ffefbc89385e86
SHA256

3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654
SHA512

78a748e7c0840f18e7ee55e6c7cd325d23672639161faf5c4c21d339aa72ca414fc903a6c9fc0fef751e9b6bfca801121af279bfb808ccbe6536ac7887b4de24
SSDEEP

6144:Kfy+bnr+jp0yN90QESxK8s3JXYQoKZ8pxgiFDgXq9asAxgiNcjr8FyUuscU5GNt5:1MrXy90c88SoQUxDgXEa78N5HUoNt5

Score

10^/10

amadey healer redline lande dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral9/files/0x0008000000023424-12.dat	healer
behavioral9/memory/4848-14-0x00000000001D0000-0x00000000001DA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p2400404.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p2400404.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p2400404.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p2400404.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p2400404.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p2400404.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral9/files/0x0007000000023422-31.dat	family_redline
behavioral9/memory/1788-33-0x0000000000D90000-0x0000000000DC0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	legola.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	r7031576.exe

Executes dropped EXE 7 IoCs

pid	Process
1796	z1652674.exe
4848	p2400404.exe
2996	r7031576.exe
5028	legola.exe
1788	t5095424.exe
4944	legola.exe
4960	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p2400404.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1652674.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	p2400404.exe
4848	p2400404.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	p2400404.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	r7031576.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1796	4736	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe	83
PID 4736 wrote to memory of 1796	4736	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe	83
PID 4736 wrote to memory of 1796	4736	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe	83
PID 1796 wrote to memory of 4848	1796	z1652674.exe	84
PID 1796 wrote to memory of 4848	1796	z1652674.exe	84
PID 1796 wrote to memory of 2996	1796	z1652674.exe	89
PID 1796 wrote to memory of 2996	1796	z1652674.exe	89
PID 1796 wrote to memory of 2996	1796	z1652674.exe	89
PID 2996 wrote to memory of 5028	2996	r7031576.exe	90
PID 2996 wrote to memory of 5028	2996	r7031576.exe	90
PID 2996 wrote to memory of 5028	2996	r7031576.exe	90
PID 4736 wrote to memory of 1788	4736	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe	91
PID 4736 wrote to memory of 1788	4736	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe	91
PID 4736 wrote to memory of 1788	4736	3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe	91
PID 5028 wrote to memory of 4280	5028	legola.exe	92
PID 5028 wrote to memory of 4280	5028	legola.exe	92
PID 5028 wrote to memory of 4280	5028	legola.exe	92
PID 5028 wrote to memory of 3608	5028	legola.exe	94
PID 5028 wrote to memory of 3608	5028	legola.exe	94
PID 5028 wrote to memory of 3608	5028	legola.exe	94
PID 3608 wrote to memory of 4580	3608	cmd.exe	96
PID 3608 wrote to memory of 4580	3608	cmd.exe	96
PID 3608 wrote to memory of 4580	3608	cmd.exe	96
PID 3608 wrote to memory of 3632	3608	cmd.exe	97
PID 3608 wrote to memory of 3632	3608	cmd.exe	97
PID 3608 wrote to memory of 3632	3608	cmd.exe	97
PID 3608 wrote to memory of 1140	3608	cmd.exe	98
PID 3608 wrote to memory of 1140	3608	cmd.exe	98
PID 3608 wrote to memory of 1140	3608	cmd.exe	98
PID 3608 wrote to memory of 1104	3608	cmd.exe	99
PID 3608 wrote to memory of 1104	3608	cmd.exe	99
PID 3608 wrote to memory of 1104	3608	cmd.exe	99
PID 3608 wrote to memory of 4404	3608	cmd.exe	100
PID 3608 wrote to memory of 4404	3608	cmd.exe	100
PID 3608 wrote to memory of 4404	3608	cmd.exe	100
PID 3608 wrote to memory of 4596	3608	cmd.exe	101
PID 3608 wrote to memory of 4596	3608	cmd.exe	101
PID 3608 wrote to memory of 4596	3608	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe
"C:\Users\Admin\AppData\Local\Temp\3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3608
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4580
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:3632
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:1140
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1104
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:4404
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:4596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe
  2⤵
  - Executes dropped EXE
  PID:1788

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5095424.exe

Filesize
172KB

MD5
6629bdfba4d480157fa8c7b4f30fb371

SHA1
35eb967b684a5e0f388445f9d84ca97c52c44aa2

SHA256
f96fe7f37dd628d744e39a0d2dbe2e0205c35039ec06c3117be112c05440d465

SHA512
cbe48a1d17d19c34e17aac1d78092c13b088eaf9032e3c7a6661f758604a5be1ec01555334ddfe0dfc655dd6c4ea42614f9d3a4a57d7570c60610fc43ddf348e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1652674.exe

Filesize
234KB

MD5
b33a76ffa9ae1087429f9def685bde06

SHA1
d8fbd884d71c20241790b2fe65a01407da960016

SHA256
08fd4b67e2c4c681d66a9e031505d3815724fbbc7bb9906191ede12fa50b0d36

SHA512
750d40a257cf79610d62cf41728f5cd0496868bf717990f9cafb89caebea83a0d1087c8df925fc9034deba67c89151a700633bec733b382dd2a6fc0ca515bef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2400404.exe

Filesize
12KB

MD5
df34836915cd0c4fac04cdda8f0f01e4

SHA1
d5f824885ea82cf1661102275ff53f5f5bde23e6

SHA256
0f108b013812de470eaceb9f7525b1bb6bde6988725f343aa26197babde7317e

SHA512
9a95b029acb09fd55a793f841031089fbda1fbd2a1be3cb7574b9e8636ed3cc3f3c3fb3900c421579312abdefa14f018d52c75aae37d31e1b4f84b54feee8e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7031576.exe

Filesize
224KB

MD5
75eb00dbd2e7aefceac0c339ecbdb0dd

SHA1
05c60327471f7d568f6d620127c6be4d46963e7e

SHA256
bc29c56cfe78572a037dd108e09bdb1ea50f2541edd52b1f7072538234ff9a9e

SHA512
bcc38dea1e25ab65dcd9aa6ee760dd20eb6312fc07b81229f851b2cca001c197a51c582277fa247a120d1267871f00ee5e34d6fc40a724c0a37cae5b425ada56

Download Submit
memory/1788-36-0x0000000005840000-0x000000000594A000-memory.dmp

Filesize
1.0MB

Download
memory/1788-33-0x0000000000D90000-0x0000000000DC0000-memory.dmp

Filesize
192KB

Download
memory/1788-34-0x0000000005570000-0x0000000005576000-memory.dmp

Filesize
24KB

Download
memory/1788-35-0x0000000005D50000-0x0000000006368000-memory.dmp

Filesize
6.1MB

Download
memory/1788-37-0x0000000005730000-0x0000000005742000-memory.dmp

Filesize
72KB

Download
memory/1788-38-0x0000000005790000-0x00000000057CC000-memory.dmp

Filesize
240KB

Download
memory/1788-39-0x00000000057D0000-0x000000000581C000-memory.dmp

Filesize
304KB

Download
memory/4848-14-0x00000000001D0000-0x00000000001DA000-memory.dmp

Filesize
40KB

Download
memory/4848-15-0x00007FF9F5CF3000-0x00007FF9F5CF5000-memory.dmp

Filesize
8KB

Download