amadey | e6564b70fa3d9a9e989ad7c1bb2b027f2e5447273c0bb64f84c7940828ecb0ed

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
Size

390KB
MD5

2d00f96e74fa01be6c570782f56ca124
SHA1

17ed1713ade7f79ea2ed1bb9130871ca56b0c072
SHA256

4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee
SHA512

6b359ebae2e3607603393e1ff2d950987194e77089ef6dee3513b17defc0c0d20950ce3554e76e68500e4b4ed23138bfdc922088881958a1dfe0a9c65e416575
SSDEEP

6144:KWy+bnr+rp0yN90QE0PZI9HwPGTICcWt4JZe6vzwYFeXx3Rhye2coLju:SMrvy90iXVztj1MNSeB+S

Score

10^/10

amadey healer redline lande dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral5/files/0x0008000000023477-12.dat	healer
behavioral5/memory/3052-15-0x0000000000130000-0x000000000013A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p1280327.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p1280327.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x0007000000023475-31.dat	family_redline
behavioral5/memory/3988-33-0x0000000000730000-0x0000000000760000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	r1561163.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 7 IoCs

pid	Process
2536	z4763657.exe
3052	p1280327.exe
1656	r1561163.exe
3700	legola.exe
3988	t1649035.exe
2652	legola.exe
4500	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p1280327.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4763657.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3052	p1280327.exe
3052	p1280327.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	p1280327.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 2536	3324	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	84
PID 3324 wrote to memory of 2536	3324	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	84
PID 3324 wrote to memory of 2536	3324	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	84
PID 2536 wrote to memory of 3052	2536	z4763657.exe	85
PID 2536 wrote to memory of 3052	2536	z4763657.exe	85
PID 2536 wrote to memory of 1656	2536	z4763657.exe	96
PID 2536 wrote to memory of 1656	2536	z4763657.exe	96
PID 2536 wrote to memory of 1656	2536	z4763657.exe	96
PID 1656 wrote to memory of 3700	1656	r1561163.exe	97
PID 1656 wrote to memory of 3700	1656	r1561163.exe	97
PID 1656 wrote to memory of 3700	1656	r1561163.exe	97
PID 3324 wrote to memory of 3988	3324	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	98
PID 3324 wrote to memory of 3988	3324	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	98
PID 3324 wrote to memory of 3988	3324	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	98
PID 3700 wrote to memory of 2728	3700	legola.exe	99
PID 3700 wrote to memory of 2728	3700	legola.exe	99
PID 3700 wrote to memory of 2728	3700	legola.exe	99
PID 3700 wrote to memory of 1832	3700	legola.exe	101
PID 3700 wrote to memory of 1832	3700	legola.exe	101
PID 3700 wrote to memory of 1832	3700	legola.exe	101
PID 1832 wrote to memory of 3716	1832	cmd.exe	103
PID 1832 wrote to memory of 3716	1832	cmd.exe	103
PID 1832 wrote to memory of 3716	1832	cmd.exe	103
PID 1832 wrote to memory of 3480	1832	cmd.exe	104
PID 1832 wrote to memory of 3480	1832	cmd.exe	104
PID 1832 wrote to memory of 3480	1832	cmd.exe	104
PID 1832 wrote to memory of 1060	1832	cmd.exe	105
PID 1832 wrote to memory of 1060	1832	cmd.exe	105
PID 1832 wrote to memory of 1060	1832	cmd.exe	105
PID 1832 wrote to memory of 1748	1832	cmd.exe	106
PID 1832 wrote to memory of 1748	1832	cmd.exe	106
PID 1832 wrote to memory of 1748	1832	cmd.exe	106
PID 1832 wrote to memory of 624	1832	cmd.exe	107
PID 1832 wrote to memory of 624	1832	cmd.exe	107
PID 1832 wrote to memory of 624	1832	cmd.exe	107
PID 1832 wrote to memory of 3676	1832	cmd.exe	108
PID 1832 wrote to memory of 3676	1832	cmd.exe	108
PID 1832 wrote to memory of 3676	1832	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
"C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2728
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1832
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3716
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:3480
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:1060
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1748
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:624
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:3676
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
  2⤵
  - Executes dropped EXE
  PID:3988

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe

Filesize
174KB

MD5
6031d2b63a9ba8752c1f761f764435a8

SHA1
ccbe4b4cc1ca749608ad0b5a9ba77b66e414cede

SHA256
c4d3bee83333cdf60f6d329c2583643db4439db62583a5fa2d4eff17a1ae13e3

SHA512
9fe233a0c6f44ad8ff160c007c6d81484e9afffdcbc707285594f9965821a961fe28754b4da2f5e34884abadbf00f5b347825450541d199700de9ff94b2c7bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe

Filesize
234KB

MD5
d9607af6726ade173eff154940caf1b6

SHA1
d083816e1455d9b2964d007c9344f8739a26952a

SHA256
0d7b7b2df1c4380d28f39f6d1bf4574c393658df66eb6ae7e4da82556bf3d9a4

SHA512
94cf37a2428dab11a6678987787e84cf67314aa74a5dff6b1457be180c3b7c0cf59371a538c2be4e20af34177c533d911008baf10067e610a46affb5620e289c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe

Filesize
13KB

MD5
e3e75031d0e39505ed432a196cc418f5

SHA1
13fad2d1ed1a5d2d47397a3d7ee024061bc3a690

SHA256
0b7746585a83c221a064e3a81bd9885cdbb10de4bf3f3d0fd44421ecce838c48

SHA512
a46b44977b3e58e07ef67945ef72980d8fe5bceaf86f86e27173f6c96d4bda5cc8d8ddeac90eb417ee17427afba414abe570f26d18aee525fa8802eb64a2855a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe

Filesize
224KB

MD5
eb3b429d21756dbe557fc8bcd82f4d64

SHA1
e621b5506d1d54d5fadef00aba0985d157e4b3fb

SHA256
779ef2f7698e7d637ff300bab9f7180aa4381bf7889d29dfc596a9298fa33887

SHA512
7209c8d47d7923841002af9b9517fa14b375fb4f4dce238d12091e1ef8baf47215f30762e24f4e0a479454a95d105e060ac70227baabfc72ca7cf2355f03b3e4

Download Submit
memory/3052-14-0x00007FF959783000-0x00007FF959785000-memory.dmp

Filesize
8KB

Download
memory/3052-15-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/3988-33-0x0000000000730000-0x0000000000760000-memory.dmp

Filesize
192KB

Download
memory/3988-34-0x0000000002910000-0x0000000002916000-memory.dmp

Filesize
24KB

Download
memory/3988-35-0x00000000056F0000-0x0000000005D08000-memory.dmp

Filesize
6.1MB

Download
memory/3988-36-0x00000000051E0000-0x00000000052EA000-memory.dmp

Filesize
1.0MB

Download
memory/3988-37-0x00000000050D0000-0x00000000050E2000-memory.dmp

Filesize
72KB

Download
memory/3988-38-0x0000000005130000-0x000000000516C000-memory.dmp

Filesize
240KB

Download
memory/3988-39-0x0000000005170000-0x00000000051BC000-memory.dmp

Filesize
304KB

Download