amadey | 9805f81a13aaa68a2026a38b70b1fdd1d76fee0ff63916c669d728c6e4dc3b7e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe
Size

390KB
MD5

50934aaf7bdeea19404491b568fad850
SHA1

4ca4dc3557f0a6e27595e1a72c33129ad3bec595
SHA256

7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00
SHA512

21caa908bcfc5cd3c4c2970ed8c92931887b2e0b3776c992bfd3b66aceff6060c5bc7d047119deb3796bb2107460490eefa3c8f09a6d7fe09e675d2d78909067
SSDEEP

6144:Kpy+bnr+op0yN90QEzksTLHBIoxvFznqrZatQxQqw5PgNpxCYqDNgOht541GvAY:HMrgy90emLHJvFzqrZavu061GvAY

Score

10^/10

amadey healer redline krast dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

77.91.68.68:19071

Attributes

auth_value
9059ea331e4599de3746df73ccb24514

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral12/files/0x0008000000023448-13.dat	healer
behavioral12/memory/872-14-0x0000000000340000-0x000000000034A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p9103114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9103114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9103114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9103114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9103114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9103114.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x0007000000023445-31.dat	family_redline
behavioral12/memory/4800-33-0x0000000000570000-0x00000000005A0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	r5038982.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 7 IoCs

pid	Process
1852	z9926521.exe
872	p9103114.exe
3796	r5038982.exe
1752	legola.exe
4800	t5987764.exe
2304	legola.exe
3256	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9103114.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9926521.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	p9103114.exe
872	p9103114.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	p9103114.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1852	2788	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe	82
PID 2788 wrote to memory of 1852	2788	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe	82
PID 2788 wrote to memory of 1852	2788	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe	82
PID 1852 wrote to memory of 872	1852	z9926521.exe	83
PID 1852 wrote to memory of 872	1852	z9926521.exe	83
PID 1852 wrote to memory of 3796	1852	z9926521.exe	100
PID 1852 wrote to memory of 3796	1852	z9926521.exe	100
PID 1852 wrote to memory of 3796	1852	z9926521.exe	100
PID 3796 wrote to memory of 1752	3796	r5038982.exe	101
PID 3796 wrote to memory of 1752	3796	r5038982.exe	101
PID 3796 wrote to memory of 1752	3796	r5038982.exe	101
PID 2788 wrote to memory of 4800	2788	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe	102
PID 2788 wrote to memory of 4800	2788	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe	102
PID 2788 wrote to memory of 4800	2788	7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe	102
PID 1752 wrote to memory of 2932	1752	legola.exe	103
PID 1752 wrote to memory of 2932	1752	legola.exe	103
PID 1752 wrote to memory of 2932	1752	legola.exe	103
PID 1752 wrote to memory of 2148	1752	legola.exe	105
PID 1752 wrote to memory of 2148	1752	legola.exe	105
PID 1752 wrote to memory of 2148	1752	legola.exe	105
PID 2148 wrote to memory of 4324	2148	cmd.exe	107
PID 2148 wrote to memory of 4324	2148	cmd.exe	107
PID 2148 wrote to memory of 4324	2148	cmd.exe	107
PID 2148 wrote to memory of 4380	2148	cmd.exe	108
PID 2148 wrote to memory of 4380	2148	cmd.exe	108
PID 2148 wrote to memory of 4380	2148	cmd.exe	108
PID 2148 wrote to memory of 4364	2148	cmd.exe	109
PID 2148 wrote to memory of 4364	2148	cmd.exe	109
PID 2148 wrote to memory of 4364	2148	cmd.exe	109
PID 2148 wrote to memory of 4304	2148	cmd.exe	110
PID 2148 wrote to memory of 4304	2148	cmd.exe	110
PID 2148 wrote to memory of 4304	2148	cmd.exe	110
PID 2148 wrote to memory of 1336	2148	cmd.exe	111
PID 2148 wrote to memory of 1336	2148	cmd.exe	111
PID 2148 wrote to memory of 1336	2148	cmd.exe	111
PID 2148 wrote to memory of 60	2148	cmd.exe	112
PID 2148 wrote to memory of 60	2148	cmd.exe	112
PID 2148 wrote to memory of 60	2148	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe
"C:\Users\Admin\AppData\Local\Temp\7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9926521.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9926521.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9103114.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9103114.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5038982.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5038982.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2148
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4324
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:4380
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:4364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4304
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:1336
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:60
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5987764.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5987764.exe
  2⤵
  - Executes dropped EXE
  PID:4800

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:2304

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t5987764.exe

Filesize
173KB

MD5
15149c6d0aff43ede34359653f5fae6a

SHA1
d6515db4e314c66c82963cbd6d27d68a457271ee

SHA256
83da6c158e6c3d578c0babbd1d83729d893c063bcd04ae6e37e7929c32057fd1

SHA512
1dd8a575228a3a8179f189e33e021a4ff61aee03d1ad48ad63c4fbe5b076d14097508adfd066e0b15da0bf340d50ad100e0a32ea88f3b12992b3f6bdf5303ce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9926521.exe

Filesize
234KB

MD5
436d2ef0497ce056d2ece3d4baef22ff

SHA1
b9ac8491a34e5c0c3ee52af680417b73cbd890fb

SHA256
6b35e0e95b742ffff19ae32a960d9b96a9c4cab9a0a173cfbe6cc514a2bab511

SHA512
a7f102e25531436ecb5e7df396aad750c06ed9be89fbd33795774071c4ea722980984afe90ff4027025f08c9792acd26927854c132c45328da45e00b1ddae9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9103114.exe

Filesize
11KB

MD5
c755c054cf26975aff241e348d6d5a18

SHA1
bb8e8cf98a257d4e4003582beeceb3a4c5cd14fa

SHA256
77b25f5737f539ca59287e399e5c0214c95ba2587f7cc37817dd4417e6eb7525

SHA512
9861e828f513c1a98a7be8b13778a7a10537bf015adc866a26c483afcb7bc122a4e5fbaa71f4b58258ce53c467c7c3ac3c9f6fa345467610de6eaedd1a57887e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5038982.exe

Filesize
223KB

MD5
101f1b777f9df6be4a2ae31c9c77f975

SHA1
478593ac2207ca064a11f73050f954b8a0b19613

SHA256
ad4c38474e05539c0f4dcca0c1f3e53e4e029b71f3f7be290331b37e61ee0777

SHA512
605b720e68da13853d372e5b69ad1d1616a9a97d94d7f936dfcc25b0fc66d4ab9b434f5995d57ceaeb6e4567c6f8e6f47f1bec704ea9d4958c838169e9f9589e

Download Submit
memory/872-15-0x00007FFB22363000-0x00007FFB22365000-memory.dmp

Filesize
8KB

Download
memory/872-14-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/4800-33-0x0000000000570000-0x00000000005A0000-memory.dmp

Filesize
192KB

Download
memory/4800-34-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Filesize
24KB

Download
memory/4800-35-0x0000000005640000-0x0000000005C58000-memory.dmp

Filesize
6.1MB

Download
memory/4800-36-0x0000000005130000-0x000000000523A000-memory.dmp

Filesize
1.0MB

Download
memory/4800-37-0x00000000029A0000-0x00000000029B2000-memory.dmp

Filesize
72KB

Download
memory/4800-38-0x0000000002A00000-0x0000000002A3C000-memory.dmp

Filesize
240KB

Download
memory/4800-39-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Filesize
304KB

Download