amadey | 21675cef02c5d516a93f59d70c16d083ffa8be9792fa8f40e53212708d321c6d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe
Size

1.0MB
MD5

6cc79e163b32f15cef6c4e5254345f67
SHA1

559c8d313f487ec11d210d7a1b9c0baf9ac73ac0
SHA256

3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb
SHA512

59cb6804045b9c2453f03d7999152ab0c31eef5aede7c8ead7f4ed5534761da95da32de4a79a8f74efd4f1b01fe412072dc4787a7c79093ab1f647a8e49e7104
SSDEEP

24576:DyxSt7M+4AkPGTHr3VJbC31Weo6ho9zXVe1Grw:WQ9M+4NPuHzV0l+hF

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral7/memory/1528-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/files/0x000700000002342c-49.dat	family_redline
behavioral7/memory/3680-51-0x00000000007A0000-0x00000000007D0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	r5267054.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 10 IoCs

pid	Process
3056	z6325768.exe
2420	z6973675.exe
1456	z6210643.exe
4208	z5225053.exe
3640	q0075145.exe
1672	r5267054.exe
2400	explonde.exe
3680	s7304034.exe
4244	explonde.exe
4276	explonde.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z5225053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6325768.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z6973675.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6210643.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 1528	3640	q0075145.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	3640	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1528	AppLaunch.exe
1528	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	AppLaunch.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3056	744	3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe	82
PID 744 wrote to memory of 3056	744	3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe	82
PID 744 wrote to memory of 3056	744	3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe	82
PID 3056 wrote to memory of 2420	3056	z6325768.exe	85
PID 3056 wrote to memory of 2420	3056	z6325768.exe	85
PID 3056 wrote to memory of 2420	3056	z6325768.exe	85
PID 2420 wrote to memory of 1456	2420	z6973675.exe	86
PID 2420 wrote to memory of 1456	2420	z6973675.exe	86
PID 2420 wrote to memory of 1456	2420	z6973675.exe	86
PID 1456 wrote to memory of 4208	1456	z6210643.exe	87
PID 1456 wrote to memory of 4208	1456	z6210643.exe	87
PID 1456 wrote to memory of 4208	1456	z6210643.exe	87
PID 4208 wrote to memory of 3640	4208	z5225053.exe	88
PID 4208 wrote to memory of 3640	4208	z5225053.exe	88
PID 4208 wrote to memory of 3640	4208	z5225053.exe	88
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 3640 wrote to memory of 1528	3640	q0075145.exe	90
PID 4208 wrote to memory of 1672	4208	z5225053.exe	96
PID 4208 wrote to memory of 1672	4208	z5225053.exe	96
PID 4208 wrote to memory of 1672	4208	z5225053.exe	96
PID 1672 wrote to memory of 2400	1672	r5267054.exe	97
PID 1672 wrote to memory of 2400	1672	r5267054.exe	97
PID 1672 wrote to memory of 2400	1672	r5267054.exe	97
PID 1456 wrote to memory of 3680	1456	z6210643.exe	98
PID 1456 wrote to memory of 3680	1456	z6210643.exe	98
PID 1456 wrote to memory of 3680	1456	z6210643.exe	98
PID 2400 wrote to memory of 2356	2400	explonde.exe	99
PID 2400 wrote to memory of 2356	2400	explonde.exe	99
PID 2400 wrote to memory of 2356	2400	explonde.exe	99
PID 2400 wrote to memory of 1692	2400	explonde.exe	101
PID 2400 wrote to memory of 1692	2400	explonde.exe	101
PID 2400 wrote to memory of 1692	2400	explonde.exe	101
PID 1692 wrote to memory of 4244	1692	cmd.exe	103
PID 1692 wrote to memory of 4244	1692	cmd.exe	103
PID 1692 wrote to memory of 4244	1692	cmd.exe	103
PID 1692 wrote to memory of 404	1692	cmd.exe	104
PID 1692 wrote to memory of 404	1692	cmd.exe	104
PID 1692 wrote to memory of 404	1692	cmd.exe	104
PID 1692 wrote to memory of 4928	1692	cmd.exe	105
PID 1692 wrote to memory of 4928	1692	cmd.exe	105
PID 1692 wrote to memory of 4928	1692	cmd.exe	105
PID 1692 wrote to memory of 2008	1692	cmd.exe	106
PID 1692 wrote to memory of 2008	1692	cmd.exe	106
PID 1692 wrote to memory of 2008	1692	cmd.exe	106
PID 1692 wrote to memory of 3436	1692	cmd.exe	107
PID 1692 wrote to memory of 3436	1692	cmd.exe	107
PID 1692 wrote to memory of 3436	1692	cmd.exe	107
PID 1692 wrote to memory of 1504	1692	cmd.exe	108
PID 1692 wrote to memory of 1504	1692	cmd.exe	108
PID 1692 wrote to memory of 1504	1692	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe
"C:\Users\Admin\AppData\Local\Temp\3bd30de35b2caa677c1a1d8eeb9a0878d3c396425a4501d3fc280590146a7efb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6325768.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6325768.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6973675.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6973675.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6210643.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6210643.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5225053.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5225053.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075145.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075145.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 148
        7⤵
        Program crash
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5267054.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5267054.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        8⤵
        Creates scheduled task(s)
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        9⤵
        
        PID:404
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        9⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        9⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        9⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7304034.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7304034.exe
        5⤵
        Executes dropped EXE
        
        PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3640 -ip 3640
1⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6325768.exe

Filesize
845KB

MD5
ab3d964d888055654b9b0f0f318cbc14

SHA1
e63f906f2233599524f1be35f74b3e400b2758ff

SHA256
c6529044cbe3c9c3cc846d83be59503bb46235d0e6121e07a68327053c773385

SHA512
e5732026cb450ca10dd5d0967c8760c8dab9f2cc61e117ed2e3ae8eaf92d53bfd69ca679e82f106367af2bbd3c046b5ce45bb91ca003b75ffd484391f392bc7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6973675.exe

Filesize
613KB

MD5
6d60bb35c95d84ea319cb4c77e97bf5c

SHA1
dae9b1a01e7146ebd2f82ddf712ea44cd16caec4

SHA256
7685e5f7b55cef404478ace74ecaa6596b325d3c6c6b039549e9fdaa51b42c42

SHA512
b88228ab02dd3e284f64fa65d96ceefba35d1fa75d0d13d08fe8f5e6a05bde6150e4a2e3dba8e6efd4b332a78e9135f12b840683c7bcfec2313c474170d14bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6210643.exe

Filesize
430KB

MD5
194630026bdada0d33003c99b0d143a3

SHA1
05862430b7977b6011c62253abe5e3dea95807c2

SHA256
970dbc459d910421ee8cad146e81f1d0d25a904ff9d96df279836078057f028e

SHA512
09c83a93a1dac58ae056dd002e369431c62fd27fee4e747708145a45f9063b99f36af8ce766d5f9348a6ad67ea91414f264334bd32e502725178ff26ea02b7ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7304034.exe

Filesize
176KB

MD5
71e0b700c4353f40506247ede9c56c42

SHA1
c4fedd12efb94af1d7030bce04196a92734c5ba4

SHA256
b1c211dcb884e98a40f2ba6b8d4c7a4c6fc8e38b2d09daf8ad3de48e1340a18c

SHA512
e3dac70344ddde7d3efa116d5f30c722d5c79ca666cdb7e7b7fb83df4d6a7f05abc7b62d6964e85a91c6d43963d1d331638bbf20fe0a6babf541631d144bf58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5225053.exe

Filesize
274KB

MD5
2f221fcb33435f0c52e55419ffa2890b

SHA1
bdac971abea6cbc20091929853731465c6a64f36

SHA256
79c768743244dbd0c06dc387ac8cb5c29052e4b6ac2ed505f01847ee2412b853

SHA512
b26c5fb18f3bf39adca86dca65bc6c7823d431525f14ab7438f20d4c3a4e42fc267e3726492b68bde7cac87893e80863e01beb545c0f7a27f46a22523cfa7bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075145.exe

Filesize
135KB

MD5
1e00637b4c832b2a87d51165c39c6e3c

SHA1
e947b685093eae6fed07ba5398f4942a0d37459a

SHA256
a6c90d82c78ac9f6ce9bbc5f5b3d263724b13e9201e8109daa1645fa84b44da5

SHA512
3ff0973522a84b12d762160c7a950e5be329c9489e143278f3f21be832c6d1bc6e6bd3c4f3cc1872e360388bd791544fd3d1befe7a07303b5cd4911dcc63394e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5267054.exe

Filesize
221KB

MD5
4d557acee791326abafa851a1d740da5

SHA1
509798e04fc1e2f56ff5d9910026489b53ed96f4

SHA256
2c3a6f861700cee20505f6dd7f6050984a57e2a1dcfa00f6951ad2d10fc9eafe

SHA512
684d8a3ce2edf44392c6b2e19d0e08aa7ed21823c845360d42b90b00db2261a0a1d0299901fae7784f6ae3ba087acc29e1c5671436aab1f83554d20923c1c7da

Download Submit
memory/1528-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3680-51-0x00000000007A0000-0x00000000007D0000-memory.dmp

Filesize
192KB

Download
memory/3680-52-0x0000000000F50000-0x0000000000F56000-memory.dmp

Filesize
24KB

Download
memory/3680-53-0x0000000005830000-0x0000000005E48000-memory.dmp

Filesize
6.1MB

Download
memory/3680-54-0x0000000005330000-0x000000000543A000-memory.dmp

Filesize
1.0MB

Download
memory/3680-55-0x0000000005260000-0x0000000005272000-memory.dmp

Filesize
72KB

Download
memory/3680-56-0x00000000052C0000-0x00000000052FC000-memory.dmp

Filesize
240KB

Download
memory/3680-57-0x0000000005440000-0x000000000548C000-memory.dmp

Filesize
304KB

Download