amadey | b2e3ef893eb456057652ab4434c1204484055bd056354e8672fc45f069c32800

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe
Size

390KB
MD5

74fbbed192dfe6039db97efc9100b00e
SHA1

31fa1d6672aa5b8faafc983fd19aa0f1fdea5eb5
SHA256

291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9
SHA512

2c0fc43eb279264970e2933ffc3beaff746ed79a2d044979b37ca26721a3e434ca62c667349167ba0e794d28449525a825194cd0d7b9b51fc31c701904356193
SSDEEP

6144:Kvy+bnr+Tp0yN90QEa5lMqNa1nox/kioWJvGeNb+I63Cfa8HJpOkl:5Mrvy9045/gxoxMFWpxh6R8TX

Score

10^/10

amadey healer redline lande dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral3/files/0x00080000000233fa-12.dat	healer
behavioral3/memory/5072-15-0x0000000000CD0000-0x0000000000CDA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p0325083.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p0325083.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p0325083.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p0325083.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p0325083.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p0325083.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x00070000000233f8-31.dat	family_redline
behavioral3/memory/2572-33-0x0000000000960000-0x0000000000990000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	r8518801.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 7 IoCs

pid	Process
4852	z5122173.exe
5072	p0325083.exe
636	r8518801.exe
4156	legola.exe
2572	t6871409.exe
3800	legola.exe
3632	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p0325083.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5122173.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5072	p0325083.exe
5072	p0325083.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	p0325083.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4852	3824	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe	81
PID 3824 wrote to memory of 4852	3824	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe	81
PID 3824 wrote to memory of 4852	3824	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe	81
PID 4852 wrote to memory of 5072	4852	z5122173.exe	82
PID 4852 wrote to memory of 5072	4852	z5122173.exe	82
PID 4852 wrote to memory of 636	4852	z5122173.exe	83
PID 4852 wrote to memory of 636	4852	z5122173.exe	83
PID 4852 wrote to memory of 636	4852	z5122173.exe	83
PID 636 wrote to memory of 4156	636	r8518801.exe	84
PID 636 wrote to memory of 4156	636	r8518801.exe	84
PID 636 wrote to memory of 4156	636	r8518801.exe	84
PID 3824 wrote to memory of 2572	3824	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe	85
PID 3824 wrote to memory of 2572	3824	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe	85
PID 3824 wrote to memory of 2572	3824	291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe	85
PID 4156 wrote to memory of 4900	4156	legola.exe	86
PID 4156 wrote to memory of 4900	4156	legola.exe	86
PID 4156 wrote to memory of 4900	4156	legola.exe	86
PID 4156 wrote to memory of 4004	4156	legola.exe	88
PID 4156 wrote to memory of 4004	4156	legola.exe	88
PID 4156 wrote to memory of 4004	4156	legola.exe	88
PID 4004 wrote to memory of 2796	4004	cmd.exe	90
PID 4004 wrote to memory of 2796	4004	cmd.exe	90
PID 4004 wrote to memory of 2796	4004	cmd.exe	90
PID 4004 wrote to memory of 1836	4004	cmd.exe	91
PID 4004 wrote to memory of 1836	4004	cmd.exe	91
PID 4004 wrote to memory of 1836	4004	cmd.exe	91
PID 4004 wrote to memory of 1792	4004	cmd.exe	92
PID 4004 wrote to memory of 1792	4004	cmd.exe	92
PID 4004 wrote to memory of 1792	4004	cmd.exe	92
PID 4004 wrote to memory of 2072	4004	cmd.exe	93
PID 4004 wrote to memory of 2072	4004	cmd.exe	93
PID 4004 wrote to memory of 2072	4004	cmd.exe	93
PID 4004 wrote to memory of 4108	4004	cmd.exe	94
PID 4004 wrote to memory of 4108	4004	cmd.exe	94
PID 4004 wrote to memory of 4108	4004	cmd.exe	94
PID 4004 wrote to memory of 1040	4004	cmd.exe	95
PID 4004 wrote to memory of 1040	4004	cmd.exe	95
PID 4004 wrote to memory of 1040	4004	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe
"C:\Users\Admin\AppData\Local\Temp\291dafd2314b673e9b81ee6bd583911db702f910a342dc716c49ce5922bcefe9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5122173.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5122173.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0325083.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0325083.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8518801.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8518801.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4900
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2796
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:1836
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:1792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2072
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:4108
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:1040
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6871409.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6871409.exe
  2⤵
  - Executes dropped EXE
  PID:2572

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3800

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6871409.exe

Filesize
175KB

MD5
970e3821ef9afd1524f5b33eaea8e55e

SHA1
aa2b5030fb5b5f25444fb93ca4898e221cb1aff8

SHA256
1b35e9e69ec0b6d0ade01d02b0286aaa650de52baa762f4ca16ae7883cd7f383

SHA512
f18a1f9cae5adfff1db15494b95e9fc38bff58c3b8a04c7cf5fb78fc7d2a178e63bf5295d6736f1cff47630f57e489eff102c2ea83abdd7067bb41d2479ea3cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5122173.exe

Filesize
234KB

MD5
7a4f386b3f970a49ff029fb30c6a4fa6

SHA1
3f00f04552f530acabbceff7efc92bc6b183adf0

SHA256
05cd256ee302eae28d56eefb16769d804ab1f5e1b7139a66326424e0f57d828f

SHA512
4bced7ddf5e041e9856e625ba5bb04a0308d2f2628817f49e03176095f5b161e505e11d82bc0e79e4a3b78149164e242757e0ab7940da40a1d29807707bcadd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0325083.exe

Filesize
13KB

MD5
6c98170d0c9c87557809d76e3100fc77

SHA1
b882e2a85d27983ad9a5426247b38d1166348ef2

SHA256
8ba8f5ed83112bcd9d068b859be2909df8e495bf9aedaae69207cbef1e4a4dd2

SHA512
24f97d2a55f3f763d336ddab65c708ee4878cc511be9b9971e6ed416462e2a4fce1cd2d6a4883f037527e92d3221e6b1791cd7a8b2e9953bb20c23e913b6a088

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8518801.exe

Filesize
224KB

MD5
18287e3811909c07a3c9a83fee583ff4

SHA1
e23b57a71eb77aad1ed53f41e8d71f8f3cee2329

SHA256
659097b813a97ae1fd10b02af8bc7c7e00e0e173eaf74c98018d8845606c047e

SHA512
1814baa2b58779e2bb6a3548ea54d0afc6ddfeaab11716c36655af0697cbb7537ad0a1b99c5f75aa29137cf2d339ab1e8501aebee1f0ded5726ad46d8abc7bad

Download Submit
memory/2572-36-0x0000000005530000-0x000000000563A000-memory.dmp

Filesize
1.0MB

Download
memory/2572-33-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/2572-34-0x0000000002C80000-0x0000000002C86000-memory.dmp

Filesize
24KB

Download
memory/2572-35-0x0000000005A40000-0x0000000006058000-memory.dmp

Filesize
6.1MB

Download
memory/2572-37-0x0000000005440000-0x0000000005452000-memory.dmp

Filesize
72KB

Download
memory/2572-38-0x00000000054A0000-0x00000000054DC000-memory.dmp

Filesize
240KB

Download
memory/2572-39-0x00000000054E0000-0x000000000552C000-memory.dmp

Filesize
304KB

Download
memory/5072-14-0x00007FFB79123000-0x00007FFB79125000-memory.dmp

Filesize
8KB

Download
memory/5072-15-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

Filesize
40KB

Download