amadey | 0ff9bc0436d6052b24d3174a3e4aeb590fa03a5b78a09d0b6a5a4084006891e2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe
Size

390KB
MD5

11154b27576c4246f2e8eb83278bc984
SHA1

83b173354ca803be9f5fdf756544b600dc3fb825
SHA256

6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed
SHA512

7451cbe817cb1e6482209b82c13db65be7a1933f1cba91d279fb6bc69821b3b7447f28ec179cfcff923abf1266b1808bdf8d2d0012c5de4d5412dfa9258d1786
SSDEEP

6144:KNy+bnr+Sp0yN90QEhBDbF8ftda/5ONdFSA/rtWX3X0ijvDrJMFWDsC8:zMrey90dDhywwMADkH9pMF1C8

Score

10^/10

amadey healer redline lande dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral8/files/0x00080000000234a7-13.dat	healer
behavioral8/memory/5000-14-0x0000000000120000-0x000000000012A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p5617583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p5617583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p5617583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p5617583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p5617583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p5617583.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x00070000000234a5-31.dat	family_redline
behavioral8/memory/2272-33-0x0000000000FB0000-0x0000000000FE0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	legola.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	r5327652.exe

Executes dropped EXE 8 IoCs

pid	Process
3216	z5787480.exe
5000	p5617583.exe
1544	r5327652.exe
4748	legola.exe
2272	t4172059.exe
3500	legola.exe
2856	legola.exe
4232	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p5617583.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5787480.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5000	p5617583.exe
5000	p5617583.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	p5617583.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3216	2680	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe	83
PID 2680 wrote to memory of 3216	2680	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe	83
PID 2680 wrote to memory of 3216	2680	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe	83
PID 3216 wrote to memory of 5000	3216	z5787480.exe	84
PID 3216 wrote to memory of 5000	3216	z5787480.exe	84
PID 3216 wrote to memory of 1544	3216	z5787480.exe	95
PID 3216 wrote to memory of 1544	3216	z5787480.exe	95
PID 3216 wrote to memory of 1544	3216	z5787480.exe	95
PID 1544 wrote to memory of 4748	1544	r5327652.exe	97
PID 1544 wrote to memory of 4748	1544	r5327652.exe	97
PID 1544 wrote to memory of 4748	1544	r5327652.exe	97
PID 2680 wrote to memory of 2272	2680	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe	98
PID 2680 wrote to memory of 2272	2680	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe	98
PID 2680 wrote to memory of 2272	2680	6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe	98
PID 4748 wrote to memory of 2324	4748	legola.exe	99
PID 4748 wrote to memory of 2324	4748	legola.exe	99
PID 4748 wrote to memory of 2324	4748	legola.exe	99
PID 4748 wrote to memory of 4876	4748	legola.exe	101
PID 4748 wrote to memory of 4876	4748	legola.exe	101
PID 4748 wrote to memory of 4876	4748	legola.exe	101
PID 4876 wrote to memory of 3960	4876	cmd.exe	103
PID 4876 wrote to memory of 3960	4876	cmd.exe	103
PID 4876 wrote to memory of 3960	4876	cmd.exe	103
PID 4876 wrote to memory of 1152	4876	cmd.exe	104
PID 4876 wrote to memory of 1152	4876	cmd.exe	104
PID 4876 wrote to memory of 1152	4876	cmd.exe	104
PID 4876 wrote to memory of 4004	4876	cmd.exe	105
PID 4876 wrote to memory of 4004	4876	cmd.exe	105
PID 4876 wrote to memory of 4004	4876	cmd.exe	105
PID 4876 wrote to memory of 2864	4876	cmd.exe	106
PID 4876 wrote to memory of 2864	4876	cmd.exe	106
PID 4876 wrote to memory of 2864	4876	cmd.exe	106
PID 4876 wrote to memory of 4396	4876	cmd.exe	107
PID 4876 wrote to memory of 4396	4876	cmd.exe	107
PID 4876 wrote to memory of 4396	4876	cmd.exe	107
PID 4876 wrote to memory of 624	4876	cmd.exe	108
PID 4876 wrote to memory of 624	4876	cmd.exe	108
PID 4876 wrote to memory of 624	4876	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe
"C:\Users\Admin\AppData\Local\Temp\6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5787480.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5787480.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5617583.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5617583.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5327652.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5327652.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4876
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3960
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:1152
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:4004
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2864
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:4396
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:624
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4172059.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4172059.exe
  2⤵
  - Executes dropped EXE
  PID:2272

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3500

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4172059.exe

Filesize
173KB

MD5
e0593e8679d77ab968e27b829f45bcbd

SHA1
a00272b2457e7b03075eb4ee1793613295396d76

SHA256
08fbfc3da43662389a9f28a0bf7447814929bb85401e1249326fdb62ec4a5d61

SHA512
f58274b538abe162be7625b5596fd6920201460e513b41f6ddcb25bbf9a31df1862b7e0051748588ffb0d9dbb2ace8c1570e5e55ce297c898bf9179195da94e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5787480.exe

Filesize
234KB

MD5
694b7729637837e43eb014d4d2c968a6

SHA1
c2bba306b840849aa140633836ced0605db95793

SHA256
dd7b0e511c99d37d76ec1481d6d6b7c2ce687b548941818de00975b112032114

SHA512
d178e85ee9b3b72af324dceae997a1c056e0e5f4e13a36eb2c0fdbf8cf343798c43f128bd459a5e5f31520ddc7128ac949bd78c92d22476edb18ec43249cd0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5617583.exe

Filesize
12KB

MD5
93bcba22f06df8fb86c113973eb20f15

SHA1
a8eed1517b821fe413cba650de349607f73b8c69

SHA256
8322ca1167bd88052e7a2c26eaf5b0d34494d1b899aa5efa4c4f0aaf515151fc

SHA512
14cb24f0c2539160764d932a3f7a43c72acb95a7b4009f975f7f2fb04749735151fc5fb84f2599de162cabe37f43ac1ec4fbe51c14f3e049329a377720f52960

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5327652.exe

Filesize
224KB

MD5
823b21cc3d3a79887e49212dac643a4f

SHA1
f37b4e8f86bc68eaf50362865799270d972f27b9

SHA256
7aab0b2e1ab9e3d05b1e84b50d502f69f540d07da3143db53e636343997deb12

SHA512
e57c6fca50b51d336cd38019db71c0f557690305d5f6dacd248d97a1710a36c7ae5a5bd388353227f789316bb672ae7390ca4782222408b569bf5e24a904b184

Download Submit
memory/2272-36-0x0000000005A50000-0x0000000005B5A000-memory.dmp

Filesize
1.0MB

Download
memory/2272-33-0x0000000000FB0000-0x0000000000FE0000-memory.dmp

Filesize
192KB

Download
memory/2272-34-0x0000000003280000-0x0000000003286000-memory.dmp

Filesize
24KB

Download
memory/2272-35-0x0000000005F60000-0x0000000006578000-memory.dmp

Filesize
6.1MB

Download
memory/2272-37-0x0000000005940000-0x0000000005952000-memory.dmp

Filesize
72KB

Download
memory/2272-38-0x00000000059A0000-0x00000000059DC000-memory.dmp

Filesize
240KB

Download
memory/2272-39-0x00000000059E0000-0x0000000005A2C000-memory.dmp

Filesize
304KB

Download
memory/5000-15-0x00007FF9EB593000-0x00007FF9EB595000-memory.dmp

Filesize
8KB

Download
memory/5000-14-0x0000000000120000-0x000000000012A000-memory.dmp

Filesize
40KB

Download