amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe
Size

661KB
MD5

06107584f5a9cbaa5ae44873617a626b
SHA1

3787ed532fbbf131c175b567261349a5e9590819
SHA256

18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40
SHA512

8a7f0fc6a093a70af45db862210a70e5c2e4721acb05336234fb73e1cc74f5b52432501a79c957628dec5c7299b7fd073786d334d2e0b3d91361b5014830e300
SSDEEP

12288:YMrcy90okKUTUbNl7wArIzo+PIjDU7UWIubwEdhctQn+0i3MOLW:UybUT4ltrIztIjDUoycEdhcO+0i3MOq

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral4/files/0x00080000000235ff-26.dat	healer
behavioral4/memory/3248-28-0x00000000003E0000-0x00000000003EA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g8391775.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g8391775.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/files/0x00070000000235fd-43.dat	family_redline
behavioral4/memory/632-45-0x0000000000800000-0x0000000000830000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	h7851757.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 9 IoCs

pid	Process
3080	x1613566.exe
2360	x4152165.exe
1660	x1810121.exe
3248	g8391775.exe
2192	h7851757.exe
4408	explonde.exe
632	i1098442.exe
4384	explonde.exe
4024	explonde.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g8391775.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1613566.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x4152165.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x1810121.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4048	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3248	g8391775.exe
3248	g8391775.exe
3248	g8391775.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	g8391775.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3080	2596	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe	91
PID 2596 wrote to memory of 3080	2596	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe	91
PID 2596 wrote to memory of 3080	2596	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe	91
PID 3080 wrote to memory of 2360	3080	x1613566.exe	92
PID 3080 wrote to memory of 2360	3080	x1613566.exe	92
PID 3080 wrote to memory of 2360	3080	x1613566.exe	92
PID 2360 wrote to memory of 1660	2360	x4152165.exe	94
PID 2360 wrote to memory of 1660	2360	x4152165.exe	94
PID 2360 wrote to memory of 1660	2360	x4152165.exe	94
PID 1660 wrote to memory of 3248	1660	x1810121.exe	95
PID 1660 wrote to memory of 3248	1660	x1810121.exe	95
PID 1660 wrote to memory of 2192	1660	x1810121.exe	106
PID 1660 wrote to memory of 2192	1660	x1810121.exe	106
PID 1660 wrote to memory of 2192	1660	x1810121.exe	106
PID 2192 wrote to memory of 4408	2192	h7851757.exe	107
PID 2192 wrote to memory of 4408	2192	h7851757.exe	107
PID 2192 wrote to memory of 4408	2192	h7851757.exe	107
PID 2360 wrote to memory of 632	2360	x4152165.exe	108
PID 2360 wrote to memory of 632	2360	x4152165.exe	108
PID 2360 wrote to memory of 632	2360	x4152165.exe	108
PID 4408 wrote to memory of 2060	4408	explonde.exe	109
PID 4408 wrote to memory of 2060	4408	explonde.exe	109
PID 4408 wrote to memory of 2060	4408	explonde.exe	109
PID 4408 wrote to memory of 3724	4408	explonde.exe	111
PID 4408 wrote to memory of 3724	4408	explonde.exe	111
PID 4408 wrote to memory of 3724	4408	explonde.exe	111
PID 3724 wrote to memory of 2000	3724	cmd.exe	113
PID 3724 wrote to memory of 2000	3724	cmd.exe	113
PID 3724 wrote to memory of 2000	3724	cmd.exe	113
PID 3724 wrote to memory of 3504	3724	cmd.exe	114
PID 3724 wrote to memory of 3504	3724	cmd.exe	114
PID 3724 wrote to memory of 3504	3724	cmd.exe	114
PID 3724 wrote to memory of 4300	3724	cmd.exe	115
PID 3724 wrote to memory of 4300	3724	cmd.exe	115
PID 3724 wrote to memory of 4300	3724	cmd.exe	115
PID 3724 wrote to memory of 412	3724	cmd.exe	116
PID 3724 wrote to memory of 412	3724	cmd.exe	116
PID 3724 wrote to memory of 412	3724	cmd.exe	116
PID 3724 wrote to memory of 2280	3724	cmd.exe	117
PID 3724 wrote to memory of 2280	3724	cmd.exe	117
PID 3724 wrote to memory of 2280	3724	cmd.exe	117
PID 3724 wrote to memory of 2076	3724	cmd.exe	118
PID 3724 wrote to memory of 2076	3724	cmd.exe	118
PID 3724 wrote to memory of 2076	3724	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe
"C:\Users\Admin\AppData\Local\Temp\18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1613566.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1613566.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4152165.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4152165.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1810121.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1810121.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7851757.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7851757.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:2060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        8⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        8⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:412
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe
      4⤵
      Executes dropped EXE
      PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
1⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1613566.exe

Filesize
556KB

MD5
5c5df4f2a752d6002d9826da20d6fd78

SHA1
0e66996338bd3123e56e78acae81da950717469c

SHA256
fcaa7fff803c1be1872548bcaa5a2b8f71bdd6e8112a4d49e19841cd72f47e5a

SHA512
93ec9371ad0ba96fc0851d6d3ad200de9791e41c54764c2ae38a76ce01fc18eeb8b035c5a1a3ca96a47eda4e12819e62c86293ef23ef21a4c7f65e947148100b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4152165.exe

Filesize
390KB

MD5
8acb2dce99363b4da5308fa2d0160bf0

SHA1
263009c7900ffdd40dc20a15f4851c1c5faedbe9

SHA256
876e98ca52a90b1a45930f73d418b9c58f283dc01ea8ae838e396d6924e7f511

SHA512
c1dadcc345608613b958d774459148912fdeb32d60879ee582c0252748c0db6212522d4e6ea1f4ae5a4177453d5c146ac5c0980c646bb0529f280caa549d4c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe

Filesize
175KB

MD5
04a7bb21ad08aa47d3f528a48dead7d1

SHA1
878ef1fcc5b8e8e79954ebb88f61afc593d7befe

SHA256
992fc655169c834a13aa63ea7069bfd878203c3a1eba3baced7aa1dfbdbe5fad

SHA512
d55d248dd5600707dafa43164a5727180191c87df79234f7302c1d13f5170bf193e99ebe391e16703fa37ddea0c92c281ba2aa0efbe80d8e9356e62b31b580b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1810121.exe

Filesize
234KB

MD5
84f02f639e6ffb7c4f54533f3f5e0609

SHA1
2add2d18202573912b05b51879b2c15212445f2c

SHA256
67bd7e6637854f65ff30c28413db3083d9c46e7fbfd0510fa0ff59141b675953

SHA512
850407df7ac5a7847a6a96f2245143e227390d536000beff4a4c8db147fa88290d7d916b1bf96ab4f7fe3e377e0bcca55cb98ac7db2454678ab5aabbc79da59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe

Filesize
11KB

MD5
f2c8e3af2ba8b386a0945d85a144c855

SHA1
a017785845b85c44c281f101aafdb3644d136fd1

SHA256
44810476bce3b817f11a8fb17c5aeda7b015776e74cc871cf4c8bcdae24f6d0e

SHA512
f945d5075fa332c4243328ec3aafd72e681cc1f6f0b902054268d35ce94fd0c38b299c5b0b7f4968223bfb5d551c9bf019c9539a6c3f508350f3e9ad2530264c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7851757.exe

Filesize
219KB

MD5
fbd81c54616b9775ca8fa7c211d61b06

SHA1
263ca5b4db050946a9d3b1262dd4afc1d8ccb9df

SHA256
9a0e3fa81a70e3dd2009f4060535adbde321c9d25ef3bd232ce97ca5241cb618

SHA512
6c328dd3cd9abe0165ac56d0d9695f8cadef7a593c155e8b0390f44412f5b528b2182c2e8b9a146515a60e5426591caa9bf741851a3eb43ab452251de6b51215

Download Submit
memory/632-45-0x0000000000800000-0x0000000000830000-memory.dmp

Filesize
192KB

Download
memory/632-46-0x0000000002AB0000-0x0000000002AB6000-memory.dmp

Filesize
24KB

Download
memory/632-47-0x0000000005790000-0x0000000005DA8000-memory.dmp

Filesize
6.1MB

Download
memory/632-48-0x0000000005280000-0x000000000538A000-memory.dmp

Filesize
1.0MB

Download
memory/632-49-0x0000000005190000-0x00000000051A2000-memory.dmp

Filesize
72KB

Download
memory/632-50-0x00000000051F0000-0x000000000522C000-memory.dmp

Filesize
240KB

Download
memory/632-51-0x0000000005230000-0x000000000527C000-memory.dmp

Filesize
304KB

Download
memory/3248-28-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download