amadey | a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe
Size

390KB
MD5

ac4ef0a8163aa70cb3fb5a2c03402872
SHA1

1f1ce96331c7c08e874f90e466a2617aa1295cfe
SHA256

cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e
SHA512

65e603525a657b938a3a0bef0faae91a787e00c8f28670e3113090340c8f982291e01455756e46b5e4abca68cc8598d8887f8b30c984b444f03b18a102c44e54
SSDEEP

6144:KYy+bnr+Vp0yN90QEjJh/9hdzrnZ9YgDCV4ZfWb33aY3sJ41IwTSU3VqAtGay:8Mr9y90RblfzPtDCV4tyHsJh5AtGay

Score

10^/10

amadey healer redline lande dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://5.42.92.67

Attributes

install_dir
ebb444342c
install_file
legola.exe
strings_key
5680b049188ecacbfa57b1b29c2f35a7
url_paths
/norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

77.91.124.84:19071

Attributes

auth_value
9fa41701c47df37786234f3373f21208

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral20/files/0x0008000000023446-12.dat	healer
behavioral20/memory/2904-14-0x0000000000150000-0x000000000015A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p7461725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p7461725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p7461725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p7461725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p7461725.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p7461725.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral20/files/0x0007000000023444-31.dat	family_redline
behavioral20/memory/2852-33-0x0000000000280000-0x00000000002B0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	r4230051.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	legola.exe

Executes dropped EXE 7 IoCs

pid	Process
4716	z0002160.exe
2904	p7461725.exe
1332	r4230051.exe
376	legola.exe
2852	t8092700.exe
3288	legola.exe
3460	legola.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p7461725.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0002160.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	p7461725.exe
2904	p7461725.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	p7461725.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4716	2960	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe	84
PID 2960 wrote to memory of 4716	2960	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe	84
PID 2960 wrote to memory of 4716	2960	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe	84
PID 4716 wrote to memory of 2904	4716	z0002160.exe	85
PID 4716 wrote to memory of 2904	4716	z0002160.exe	85
PID 4716 wrote to memory of 1332	4716	z0002160.exe	96
PID 4716 wrote to memory of 1332	4716	z0002160.exe	96
PID 4716 wrote to memory of 1332	4716	z0002160.exe	96
PID 1332 wrote to memory of 376	1332	r4230051.exe	97
PID 1332 wrote to memory of 376	1332	r4230051.exe	97
PID 1332 wrote to memory of 376	1332	r4230051.exe	97
PID 2960 wrote to memory of 2852	2960	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe	98
PID 2960 wrote to memory of 2852	2960	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe	98
PID 2960 wrote to memory of 2852	2960	cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe	98
PID 376 wrote to memory of 3600	376	legola.exe	99
PID 376 wrote to memory of 3600	376	legola.exe	99
PID 376 wrote to memory of 3600	376	legola.exe	99
PID 376 wrote to memory of 556	376	legola.exe	101
PID 376 wrote to memory of 556	376	legola.exe	101
PID 376 wrote to memory of 556	376	legola.exe	101
PID 556 wrote to memory of 3856	556	cmd.exe	103
PID 556 wrote to memory of 3856	556	cmd.exe	103
PID 556 wrote to memory of 3856	556	cmd.exe	103
PID 556 wrote to memory of 2196	556	cmd.exe	104
PID 556 wrote to memory of 2196	556	cmd.exe	104
PID 556 wrote to memory of 2196	556	cmd.exe	104
PID 556 wrote to memory of 3372	556	cmd.exe	105
PID 556 wrote to memory of 3372	556	cmd.exe	105
PID 556 wrote to memory of 3372	556	cmd.exe	105
PID 556 wrote to memory of 912	556	cmd.exe	106
PID 556 wrote to memory of 912	556	cmd.exe	106
PID 556 wrote to memory of 912	556	cmd.exe	106
PID 556 wrote to memory of 2228	556	cmd.exe	107
PID 556 wrote to memory of 2228	556	cmd.exe	107
PID 556 wrote to memory of 2228	556	cmd.exe	107
PID 556 wrote to memory of 4004	556	cmd.exe	108
PID 556 wrote to memory of 4004	556	cmd.exe	108
PID 556 wrote to memory of 4004	556	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe
"C:\Users\Admin\AppData\Local\Temp\cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0002160.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0002160.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7461725.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7461725.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4230051.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4230051.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3600
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3856
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:N"
        6⤵
        
        PID:2196
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legola.exe" /P "Admin:R" /E
        6⤵
        
        PID:3372
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:912
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        6⤵
        
        PID:2228
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        6⤵
        
        PID:4004
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t8092700.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t8092700.exe
  2⤵
  - Executes dropped EXE
  PID:2852

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3288

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
1⤵
- Executes dropped EXE
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t8092700.exe

Filesize
174KB

MD5
9ea5066fba88295b8970cfc7e781262d

SHA1
ce9e09c83eea46ea9c00a21035921f2d2b4c92c4

SHA256
594ac1ff85516aec772a488593d20f245b1f1fc80121fe55e49e8986398c9d5d

SHA512
e36deb07737a9e76f30e6adc7bba13204f2e32e67505fdd5ef588da6090cdf76166d07b86ea0aab09b3d71c701f437cade780f2f073aea586227b423294ce8cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0002160.exe

Filesize
234KB

MD5
9773524af852d66ae1bda1f57e51ac38

SHA1
652cdb9d2381ebfadd7e1bff0f4927fd8698f7de

SHA256
7715b1f6048505c72cf6442f540f05fd3b3b4156a9de7a453d195b548e57d04d

SHA512
dac54854d13faef59968d138d0333c8d6d05c62f6f67b28d297019ed633649a471b9144dcf6b8ccf3ebd74442c82d3378114e45de376cde6e56ba296b33811ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7461725.exe

Filesize
13KB

MD5
9713cf3d15464788e30ddcf58a99b7fc

SHA1
a8607e692a7924bb8bafe0e4470410123fb0fde4

SHA256
5c9341bb1a86ce1c6c4b3fd107ead9a10bb386d9576ea39361bef30c62d01e4c

SHA512
b9069be2cd495bcd6a47867f18f05666bb6e34af102089921885a32a4f627b04918949673f88625e4c312bffdd9533fbb92f4e5145ff20b5cd347a3b574d1b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4230051.exe

Filesize
224KB

MD5
ce53192381dc6520d37bf9460e728892

SHA1
ad5cf0012e70eb1b16a6e8d5d1781b28c70dfe63

SHA256
28d224e0b67307cd5b5d8e99ca75f949252adff8ca8000c0d72e9e525e1ceff2

SHA512
a6840a9bd65cf83cbe95fcd8e2e623c009a198f2d8bb043ec2af84c965ee94783a7cad9097bea217236dbc9541e5b836b70c46a128a0cd3d51328127aa3be40d

Download Submit
memory/2852-36-0x0000000004EA0000-0x0000000004FAA000-memory.dmp

Filesize
1.0MB

Download
memory/2852-33-0x0000000000280000-0x00000000002B0000-memory.dmp

Filesize
192KB

Download
memory/2852-34-0x00000000025B0000-0x00000000025B6000-memory.dmp

Filesize
24KB

Download
memory/2852-35-0x00000000053B0000-0x00000000059C8000-memory.dmp

Filesize
6.1MB

Download
memory/2852-37-0x0000000004D40000-0x0000000004D52000-memory.dmp

Filesize
72KB

Download
memory/2852-38-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

Filesize
240KB

Download
memory/2852-39-0x0000000004E10000-0x0000000004E5C000-memory.dmp

Filesize
304KB

Download
memory/2904-15-0x00007FF862833000-0x00007FF862835000-memory.dmp

Filesize
8KB

Download
memory/2904-14-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download