amadey | e6564b70fa3d9a9e989ad7c1bb2b027f2e5447273c0bb64f84c7940828ecb0ed

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
Size

390KB
MD5

2d00f96e74fa01be6c570782f56ca124
SHA1

17ed1713ade7f79ea2ed1bb9130871ca56b0c072
SHA256

4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee
SHA512

6b359ebae2e3607603393e1ff2d950987194e77089ef6dee3513b17defc0c0d20950ce3554e76e68500e4b4ed23138bfdc922088881958a1dfe0a9c65e416575
SSDEEP

6144:KWy+bnr+rp0yN90QE0PZI9HwPGTICcWt4JZe6vzwYFeXx3Rhye2coLju:SMrvy90iXVztj1MNSeB+S

Score

10^/10

amadey healer redline lande dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe	healer
behavioral5/memory/1140-14-0x0000000000880000-0x000000000088A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p1280327.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p1280327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p1280327.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p1280327.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe	family_redline
behavioral5/memory/3904-33-0x0000000000F60000-0x0000000000F90000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

r1561163.exelegola.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	r1561163.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 8 IoCs

Processes:

z4763657.exep1280327.exer1561163.exelegola.exet1649035.exelegola.exelegola.exelegola.exe

pid process

4456 z4763657.exe
1140 p1280327.exe
4588 r1561163.exe
1512 legola.exe
3904 t1649035.exe
3108 legola.exe
4124 legola.exe
1804 legola.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p1280327.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1280327.exe

pid	process
4456	z4763657.exe
1140	p1280327.exe
4588	r1561163.exe
1512	legola.exe
3904	t1649035.exe
3108	legola.exe
4124	legola.exe
1804	legola.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p1280327.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exez4763657.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4763657.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

464 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2584 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p1280327.exe

pid process

1140 p1280327.exe
1140 p1280327.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p1280327.exe

description pid process

Token: SeDebugPrivilege 1140 p1280327.exe

pid	process
464	sc.exe

pid	process
2584	schtasks.exe

pid	process
1140	p1280327.exe
1140	p1280327.exe

description	pid	process
Token: SeDebugPrivilege	1140	p1280327.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exez4763657.exer1561163.exelegola.execmd.exe

description	pid	process	target process
PID 4496 wrote to memory of 4456	4496	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	z4763657.exe
PID 4496 wrote to memory of 4456	4496	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	z4763657.exe
PID 4496 wrote to memory of 4456	4496	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	z4763657.exe
PID 4456 wrote to memory of 1140	4456	z4763657.exe	p1280327.exe
PID 4456 wrote to memory of 1140	4456	z4763657.exe	p1280327.exe
PID 4456 wrote to memory of 4588	4456	z4763657.exe	r1561163.exe
PID 4456 wrote to memory of 4588	4456	z4763657.exe	r1561163.exe
PID 4456 wrote to memory of 4588	4456	z4763657.exe	r1561163.exe
PID 4588 wrote to memory of 1512	4588	r1561163.exe	legola.exe
PID 4588 wrote to memory of 1512	4588	r1561163.exe	legola.exe
PID 4588 wrote to memory of 1512	4588	r1561163.exe	legola.exe
PID 4496 wrote to memory of 3904	4496	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	t1649035.exe
PID 4496 wrote to memory of 3904	4496	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	t1649035.exe
PID 4496 wrote to memory of 3904	4496	4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe	t1649035.exe
PID 1512 wrote to memory of 2584	1512	legola.exe	schtasks.exe
PID 1512 wrote to memory of 2584	1512	legola.exe	schtasks.exe
PID 1512 wrote to memory of 2584	1512	legola.exe	schtasks.exe
PID 1512 wrote to memory of 2536	1512	legola.exe	cmd.exe
PID 1512 wrote to memory of 2536	1512	legola.exe	cmd.exe
PID 1512 wrote to memory of 2536	1512	legola.exe	cmd.exe
PID 2536 wrote to memory of 4884	2536	cmd.exe	cmd.exe
PID 2536 wrote to memory of 4884	2536	cmd.exe	cmd.exe
PID 2536 wrote to memory of 4884	2536	cmd.exe	cmd.exe
PID 2536 wrote to memory of 1356	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 1356	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 1356	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 4100	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 4100	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 4100	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 5004	2536	cmd.exe	cmd.exe
PID 2536 wrote to memory of 5004	2536	cmd.exe	cmd.exe
PID 2536 wrote to memory of 5004	2536	cmd.exe	cmd.exe
PID 2536 wrote to memory of 2760	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 2760	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 2760	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 864	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 864	2536	cmd.exe	cacls.exe
PID 2536 wrote to memory of 864	2536	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
"C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2584
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2536
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4884
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:1356
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:4100
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:5004
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:2760
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:864
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
  2⤵
  - Executes dropped EXE
  PID:3904

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:464

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe

Filesize
174KB

MD5
6031d2b63a9ba8752c1f761f764435a8

SHA1
ccbe4b4cc1ca749608ad0b5a9ba77b66e414cede

SHA256
c4d3bee83333cdf60f6d329c2583643db4439db62583a5fa2d4eff17a1ae13e3

SHA512
9fe233a0c6f44ad8ff160c007c6d81484e9afffdcbc707285594f9965821a961fe28754b4da2f5e34884abadbf00f5b347825450541d199700de9ff94b2c7bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe

Filesize
234KB

MD5
d9607af6726ade173eff154940caf1b6

SHA1
d083816e1455d9b2964d007c9344f8739a26952a

SHA256
0d7b7b2df1c4380d28f39f6d1bf4574c393658df66eb6ae7e4da82556bf3d9a4

SHA512
94cf37a2428dab11a6678987787e84cf67314aa74a5dff6b1457be180c3b7c0cf59371a538c2be4e20af34177c533d911008baf10067e610a46affb5620e289c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe

Filesize
13KB

MD5
e3e75031d0e39505ed432a196cc418f5

SHA1
13fad2d1ed1a5d2d47397a3d7ee024061bc3a690

SHA256
0b7746585a83c221a064e3a81bd9885cdbb10de4bf3f3d0fd44421ecce838c48

SHA512
a46b44977b3e58e07ef67945ef72980d8fe5bceaf86f86e27173f6c96d4bda5cc8d8ddeac90eb417ee17427afba414abe570f26d18aee525fa8802eb64a2855a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe

Filesize
224KB

MD5
eb3b429d21756dbe557fc8bcd82f4d64

SHA1
e621b5506d1d54d5fadef00aba0985d157e4b3fb

SHA256
779ef2f7698e7d637ff300bab9f7180aa4381bf7889d29dfc596a9298fa33887

SHA512
7209c8d47d7923841002af9b9517fa14b375fb4f4dce238d12091e1ef8baf47215f30762e24f4e0a479454a95d105e060ac70227baabfc72ca7cf2355f03b3e4

Download Submit
memory/1140-14-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/1140-15-0x00007FFFFCFF3000-0x00007FFFFCFF5000-memory.dmp

Filesize
8KB

Download
memory/3904-33-0x0000000000F60000-0x0000000000F90000-memory.dmp

Filesize
192KB

Download
memory/3904-34-0x0000000003290000-0x0000000003296000-memory.dmp

Filesize
24KB

Download
memory/3904-35-0x0000000006030000-0x0000000006648000-memory.dmp

Filesize
6.1MB

Download
memory/3904-36-0x0000000005B20000-0x0000000005C2A000-memory.dmp

Filesize
1.0MB

Download
memory/3904-37-0x0000000005A30000-0x0000000005A42000-memory.dmp

Filesize
72KB

Download
memory/3904-38-0x0000000005A90000-0x0000000005ACC000-memory.dmp

Filesize
240KB

Download
memory/3904-39-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

Filesize
304KB

Download