amadey | 21675cef02c5d516a93f59d70c16d083ffa8be9792fa8f40e53212708d321c6d

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe
Size

539KB
MD5

a45778de16313f7bdf760c890122347f
SHA1

5c1544de791cd35041106e4bdf7b5f3c5a0c9c65
SHA256

a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e
SHA512

1efee5745ad4741b77309bde7c0063ba3d8a4b8eba44489acea81a8df89b89ccd657256c6305e47064840078d747670ef29dff093e2d107b60e002104c1a2af3
SSDEEP

12288:1MrPy906oA/07qnoBKRBSCaNRi5iNeTwwmZsFwF8vu:uyavqnogMQnZwF8G

Score

10^/10

amadey redline 59b440 mrak evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

g0009234.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	g0009234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g0009234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g0009234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g0009234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g0009234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g0009234.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7693563.exe	family_redline
behavioral17/memory/2944-65-0x00000000001F0000-0x0000000000220000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

h3444670.exesaves.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	h3444670.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 7 IoCs

Processes:

x6275139.exeg0009234.exeh3444670.exesaves.exei7693563.exesaves.exesaves.exe

pid process

3248 x6275139.exe
2756 g0009234.exe
2584 h3444670.exe
2828 saves.exe
2944 i7693563.exe
1436 saves.exe
4380 saves.exe

pid	process
3248	x6275139.exe
2756	g0009234.exe
2584	h3444670.exe
2828	saves.exe
2944	i7693563.exe
1436	saves.exe
4380	saves.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

g0009234.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	g0009234.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	g0009234.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exex6275139.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6275139.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3292 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

g0009234.exe

pid process

2756 g0009234.exe
2756 g0009234.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

g0009234.exe

description pid process

Token: SeDebugPrivilege 2756 g0009234.exe

pid	process
3292	schtasks.exe

pid	process
2756	g0009234.exe
2756	g0009234.exe

description	pid	process
Token: SeDebugPrivilege	2756	g0009234.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exex6275139.exeh3444670.exesaves.execmd.exe

description	pid	process	target process
PID 3344 wrote to memory of 3248	3344	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe	x6275139.exe
PID 3344 wrote to memory of 3248	3344	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe	x6275139.exe
PID 3344 wrote to memory of 3248	3344	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe	x6275139.exe
PID 3248 wrote to memory of 2756	3248	x6275139.exe	g0009234.exe
PID 3248 wrote to memory of 2756	3248	x6275139.exe	g0009234.exe
PID 3248 wrote to memory of 2756	3248	x6275139.exe	g0009234.exe
PID 3248 wrote to memory of 2584	3248	x6275139.exe	h3444670.exe
PID 3248 wrote to memory of 2584	3248	x6275139.exe	h3444670.exe
PID 3248 wrote to memory of 2584	3248	x6275139.exe	h3444670.exe
PID 2584 wrote to memory of 2828	2584	h3444670.exe	saves.exe
PID 2584 wrote to memory of 2828	2584	h3444670.exe	saves.exe
PID 2584 wrote to memory of 2828	2584	h3444670.exe	saves.exe
PID 3344 wrote to memory of 2944	3344	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe	i7693563.exe
PID 3344 wrote to memory of 2944	3344	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe	i7693563.exe
PID 3344 wrote to memory of 2944	3344	a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe	i7693563.exe
PID 2828 wrote to memory of 3292	2828	saves.exe	schtasks.exe
PID 2828 wrote to memory of 3292	2828	saves.exe	schtasks.exe
PID 2828 wrote to memory of 3292	2828	saves.exe	schtasks.exe
PID 2828 wrote to memory of 3404	2828	saves.exe	cmd.exe
PID 2828 wrote to memory of 3404	2828	saves.exe	cmd.exe
PID 2828 wrote to memory of 3404	2828	saves.exe	cmd.exe
PID 3404 wrote to memory of 2248	3404	cmd.exe	cmd.exe
PID 3404 wrote to memory of 2248	3404	cmd.exe	cmd.exe
PID 3404 wrote to memory of 2248	3404	cmd.exe	cmd.exe
PID 3404 wrote to memory of 4560	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 4560	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 4560	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 2540	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 2540	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 2540	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 684	3404	cmd.exe	cmd.exe
PID 3404 wrote to memory of 684	3404	cmd.exe	cmd.exe
PID 3404 wrote to memory of 684	3404	cmd.exe	cmd.exe
PID 3404 wrote to memory of 1840	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 1840	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 1840	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 1948	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 1948	3404	cmd.exe	cacls.exe
PID 3404 wrote to memory of 1948	3404	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe
"C:\Users\Admin\AppData\Local\Temp\a025c0e61987ac5dff969885b12ced5a1064ab0b0ae71e3751eb0331b3e6332e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3344

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6275139.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6275139.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3248

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0009234.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0009234.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3444670.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3444670.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
5⤵
- Creates scheduled task(s)
PID:3292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:3404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2248

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:N"
6⤵
PID:4560

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:R" /E
6⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:684

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:N"
6⤵
PID:1840

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:R" /E
6⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7693563.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7693563.exe
2⤵
- Executes dropped EXE
PID:2944

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4380

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7693563.exe
Filesize
173KB

MD5
256ff37205e473df17a94ac4124bcbd3

SHA1
10156e81765bad8b6bab124a8d3fc42f55864e51

SHA256
b5e451dc86781ad98f1d86d3d96e1fb61e6b48242bd4f106402f69e1ef7e1d9f

SHA512
cc246f9c79fcf4746fc58b1be1dab3f4941fcd82bbcb5f91911f0e86cb14853a6176cb119cad2126ea0c146c20c823a9c7ee89ac731c1a3fe0441ff4703731c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6275139.exe
Filesize
384KB

MD5
505daad07a1ad98a666dcbc386d7239d

SHA1
86805ddaa1de086e53898337738734630dfb5c9e

SHA256
ac4e3896b136603cb0c7133d7530ad7f68b5b40fc6099840a6342c082cace3ec

SHA512
b2bc758d8085f1d357473bc2e181480c028ff3c82550e9927bec1d18f2b30a8694244e9a8255836f3516d9861ba732232728eaefb0248212e9105c3d87ee7891

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0009234.exe
Filesize
185KB

MD5
a39dea187a59762212d62cf760d928b2

SHA1
db6f60b5405c803fcc6fdf71b706e88e5a738415

SHA256
d99e422e8ec3906e23172586ed4598fc0a688844ea2cba71a20086c460d6a805

SHA512
77c78a66df1aa8a095c230d64b5629e459266a149dc98fe3b37adc99c1d0041f443cabd96d52445e9b0929fa364f1d7bd6fb2cfbc77ce9c00c7a44a88ee9b8f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3444670.exe
Filesize
336KB

MD5
7466ba3b591d7b7901d9f982a2bac556

SHA1
e223e08ecf3834ab0be1c61fe92b06e97279e5a0

SHA256
3f99b316b12aaaac5a490985f51022edd91055664ccbb79a84e5108cb0743957

SHA512
beb20cea85025baef06570e96c169bccf54c16239620136e623ef1ebd291754f6f312eb2c6a1901276579837cfa0539c5b97a41528088c76ff0b8afe99f4db3e

Download Submit
memory/2756-47-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-25-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-18-0x0000000002670000-0x000000000268C000-memory.dmp

Filesize
112KB

Download
memory/2756-19-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/2756-16-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/2756-45-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-43-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-41-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-39-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-37-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-35-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-33-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-31-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-29-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-27-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-17-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/2756-23-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-21-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-20-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/2756-49-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/2756-15-0x00000000021E0000-0x00000000021FE000-memory.dmp

Filesize
120KB

Download
memory/2756-14-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2944-65-0x00000000001F0000-0x0000000000220000-memory.dmp

Filesize
192KB

Download
memory/2944-66-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2944-67-0x0000000005170000-0x0000000005788000-memory.dmp

Filesize
6.1MB

Download
memory/2944-68-0x0000000004C60000-0x0000000004D6A000-memory.dmp

Filesize
1.0MB

Download
memory/2944-69-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/2944-70-0x0000000004BD0000-0x0000000004C0C000-memory.dmp

Filesize
240KB

Download
memory/2944-71-0x0000000004D70000-0x0000000004DBC000-memory.dmp

Filesize
304KB

Download