amadey | b2e3ef893eb456057652ab4434c1204484055bd056354e8672fc45f069c32800

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe
Size

390KB
MD5

7029bd0b72ef68903ba7755403ef837c
SHA1

7e5fe966a2e74bc6e5ccff71339f8794ce8c4d7b
SHA256

4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573
SHA512

7e3df6771e74e7c26f4453cf89b5ef9dc0e0a184afd945b93f68c77221d63012b24a4de3e03b79bc82adf4cc12175f41cfb9c79d386651aed080eab1d7a84377
SSDEEP

6144:K7y+bnr+8p0yN90QES1d8f5qOkWcnZNbQR5zRPdQwiAZAKWJaLu5GIJwEUR:FMrUy90QfMQwNZQJEu5HJwEUR

Score

10^/10

amadey healer redline krast dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral9/files/0x00080000000233de-13.dat	healer
behavioral9/memory/1808-15-0x00000000000C0000-0x00000000000CA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9430155.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9430155.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9430155.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p9430155.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9430155.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9430155.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral9/files/0x00070000000233dc-31.dat	family_redline
behavioral9/memory/2340-33-0x0000000000490000-0x00000000004C0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	r5492609.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 7 IoCs

pid	Process
3140	z5418005.exe
1808	p9430155.exe
1592	r5492609.exe
1708	legola.exe
2340	t1301951.exe
2232	legola.exe
2968	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9430155.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5418005.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	p9430155.exe
1808	p9430155.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	p9430155.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3140	2376	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe	80
PID 2376 wrote to memory of 3140	2376	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe	80
PID 2376 wrote to memory of 3140	2376	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe	80
PID 3140 wrote to memory of 1808	3140	z5418005.exe	81
PID 3140 wrote to memory of 1808	3140	z5418005.exe	81
PID 3140 wrote to memory of 1592	3140	z5418005.exe	82
PID 3140 wrote to memory of 1592	3140	z5418005.exe	82
PID 3140 wrote to memory of 1592	3140	z5418005.exe	82
PID 1592 wrote to memory of 1708	1592	r5492609.exe	83
PID 1592 wrote to memory of 1708	1592	r5492609.exe	83
PID 1592 wrote to memory of 1708	1592	r5492609.exe	83
PID 2376 wrote to memory of 2340	2376	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe	84
PID 2376 wrote to memory of 2340	2376	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe	84
PID 2376 wrote to memory of 2340	2376	4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe	84
PID 1708 wrote to memory of 2560	1708	legola.exe	85
PID 1708 wrote to memory of 2560	1708	legola.exe	85
PID 1708 wrote to memory of 2560	1708	legola.exe	85
PID 1708 wrote to memory of 3236	1708	legola.exe	87
PID 1708 wrote to memory of 3236	1708	legola.exe	87
PID 1708 wrote to memory of 3236	1708	legola.exe	87
PID 3236 wrote to memory of 2824	3236	cmd.exe	89
PID 3236 wrote to memory of 2824	3236	cmd.exe	89
PID 3236 wrote to memory of 2824	3236	cmd.exe	89
PID 3236 wrote to memory of 3400	3236	cmd.exe	90
PID 3236 wrote to memory of 3400	3236	cmd.exe	90
PID 3236 wrote to memory of 3400	3236	cmd.exe	90
PID 3236 wrote to memory of 3772	3236	cmd.exe	91
PID 3236 wrote to memory of 3772	3236	cmd.exe	91
PID 3236 wrote to memory of 3772	3236	cmd.exe	91
PID 3236 wrote to memory of 2116	3236	cmd.exe	92
PID 3236 wrote to memory of 2116	3236	cmd.exe	92
PID 3236 wrote to memory of 2116	3236	cmd.exe	92
PID 3236 wrote to memory of 4316	3236	cmd.exe	93
PID 3236 wrote to memory of 4316	3236	cmd.exe	93
PID 3236 wrote to memory of 4316	3236	cmd.exe	93
PID 3236 wrote to memory of 3460	3236	cmd.exe	94
PID 3236 wrote to memory of 3460	3236	cmd.exe	94
PID 3236 wrote to memory of 3460	3236	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe
"C:\Users\Admin\AppData\Local\Temp\4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5418005.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5418005.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9430155.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9430155.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5492609.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5492609.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2560
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3236
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2824
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:3400
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:3772
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2116
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:4316
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:3460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1301951.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1301951.exe
  2⤵
  - Executes dropped EXE
  PID:2340

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:2232

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1301951.exe

Filesize
173KB

MD5
932ca9a7128632211c16057323fde623

SHA1
1c92154c5c71e5d381a2915d17a6bb7f09db6a7b

SHA256
ede47de65ed2c68e25ca49820dc425066f61d0e83c5fe05987e2741320787ff8

SHA512
b7e20e60734f73220c196b6d7140add8db458f282452a71585d85114316c6903dc04d756aafa1f2bf4536b35938d9cbad4f22690890a6f066825916690461294

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5418005.exe

Filesize
234KB

MD5
e49f20e120b351d247a3626f4fbf176b

SHA1
42692af535e023d014dc59cecb1a98d38382f71f

SHA256
e3e33451a995d8947da9f4d6e4ffb6df566fcc0d0b6ae342b03b2d7732117ed8

SHA512
07e05b4aa5fa600714bb7d73539387b5b9aa18040c1fd027329405abc4d9587d1defc910aa371429ff133f10a8e5d437a917ca4f455a8fa70a19f6144351ad8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9430155.exe

Filesize
11KB

MD5
d856e2a54c40acf61645d4fc57858e06

SHA1
4adda083305872bca81e5bcbe8b919870021ebf7

SHA256
b037083ba5bd964e0da761a64efa0793fa1141cc3213a0dddeb2d0ba0fc9f13b

SHA512
78d7c7912a9c551f6177a93704f29671bb84f5dee90705313881236dbff948a297f780c9d4fde102e91f28fc3dbe4d1b9f2f6a634d00e2319da17eea1d4c6caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5492609.exe

Filesize
223KB

MD5
783083e6c9816b1112c31a2a5921565a

SHA1
74060d022fbee34f9c3349f534342baf0425ec48

SHA256
f9077e17260577e42c0b09d55c9e173f28f06e054fcedcdff2141de81f8c7646

SHA512
ae93484ed26ce7e6717d54c2734eaaeebfe760604adc0ce62b9fd6ff5313b9cc25c2a6a4a034a18b1d436269d63382cd85428a72d78c0418b9450c975129a08f

Download Submit
memory/1808-14-0x00007FFD61033000-0x00007FFD61035000-memory.dmp

Filesize
8KB

Download
memory/1808-15-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/2340-33-0x0000000000490000-0x00000000004C0000-memory.dmp

Filesize
192KB

Download
memory/2340-34-0x00000000027E0000-0x00000000027E6000-memory.dmp

Filesize
24KB

Download
memory/2340-35-0x0000000005570000-0x0000000005B88000-memory.dmp

Filesize
6.1MB

Download
memory/2340-36-0x0000000005060000-0x000000000516A000-memory.dmp

Filesize
1.0MB

Download
memory/2340-37-0x0000000004F70000-0x0000000004F82000-memory.dmp

Filesize
72KB

Download
memory/2340-38-0x0000000004FD0000-0x000000000500C000-memory.dmp

Filesize
240KB

Download
memory/2340-39-0x0000000005010000-0x000000000505C000-memory.dmp

Filesize
304KB

Download