amadey | ac90002ec144a6c8c89c45137265a202aeef6b583cef01223b622e10b4c4b797

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
Size

704KB
MD5

b7141f47266f8fb53311b5a5eab29e92
SHA1

c3f6fd7ea5e23c826639ee2657a4adc55645e60b
SHA256

8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8
SHA512

053bd538bc0a33d42c9bcb76d6026f83a60c91a466feb7d2e6f945f3e86bdfe731bc462f2b18df9806d1ddc5b02d140ffdddf7e0b27c18c8b2056728b4cd38ed
SSDEEP

12288:KMrOy90VPnlz2wBiDoLCPE5itsvhGIkO1ObIf/D5Sv5rjnnS+bgumM:cyw2wNW8zp7LlXirjnS+x

Score

10^/10

amadey healer redline 59b440 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe	healer
behavioral10/memory/1604-28-0x00000000006F0000-0x00000000006FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

g1613759.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g1613759.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g1613759.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe	family_redline
behavioral10/memory/4552-45-0x0000000000340000-0x0000000000370000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

h7894235.exesaves.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	h7894235.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 9 IoCs

Processes:

x2073413.exex5005161.exex5605402.exeg1613759.exeh7894235.exesaves.exei5854270.exesaves.exesaves.exe

pid process

220 x2073413.exe
3560 x5005161.exe
1428 x5605402.exe
1604 g1613759.exe
3852 h7894235.exe
2516 saves.exe
4552 i5854270.exe
4064 saves.exe
4948 saves.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

g1613759.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g1613759.exe

pid	process
220	x2073413.exe
3560	x5005161.exe
1428	x5605402.exe
1604	g1613759.exe
3852	h7894235.exe
2516	saves.exe
4552	i5854270.exe
4064	saves.exe
4948	saves.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g1613759.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exex2073413.exex5005161.exex5605402.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2073413.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5005161.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x5605402.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

212 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

g1613759.exe

pid process

1604 g1613759.exe
1604 g1613759.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

g1613759.exe

description pid process

Token: SeDebugPrivilege 1604 g1613759.exe

pid	process
212	schtasks.exe

pid	process
1604	g1613759.exe
1604	g1613759.exe

description	pid	process
Token: SeDebugPrivilege	1604	g1613759.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exex2073413.exex5005161.exex5605402.exeh7894235.exesaves.execmd.exe

description	pid	process	target process
PID 3040 wrote to memory of 220	3040	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe	x2073413.exe
PID 3040 wrote to memory of 220	3040	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe	x2073413.exe
PID 3040 wrote to memory of 220	3040	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe	x2073413.exe
PID 220 wrote to memory of 3560	220	x2073413.exe	x5005161.exe
PID 220 wrote to memory of 3560	220	x2073413.exe	x5005161.exe
PID 220 wrote to memory of 3560	220	x2073413.exe	x5005161.exe
PID 3560 wrote to memory of 1428	3560	x5005161.exe	x5605402.exe
PID 3560 wrote to memory of 1428	3560	x5005161.exe	x5605402.exe
PID 3560 wrote to memory of 1428	3560	x5005161.exe	x5605402.exe
PID 1428 wrote to memory of 1604	1428	x5605402.exe	g1613759.exe
PID 1428 wrote to memory of 1604	1428	x5605402.exe	g1613759.exe
PID 1428 wrote to memory of 3852	1428	x5605402.exe	h7894235.exe
PID 1428 wrote to memory of 3852	1428	x5605402.exe	h7894235.exe
PID 1428 wrote to memory of 3852	1428	x5605402.exe	h7894235.exe
PID 3852 wrote to memory of 2516	3852	h7894235.exe	saves.exe
PID 3852 wrote to memory of 2516	3852	h7894235.exe	saves.exe
PID 3852 wrote to memory of 2516	3852	h7894235.exe	saves.exe
PID 3560 wrote to memory of 4552	3560	x5005161.exe	i5854270.exe
PID 3560 wrote to memory of 4552	3560	x5005161.exe	i5854270.exe
PID 3560 wrote to memory of 4552	3560	x5005161.exe	i5854270.exe
PID 2516 wrote to memory of 212	2516	saves.exe	schtasks.exe
PID 2516 wrote to memory of 212	2516	saves.exe	schtasks.exe
PID 2516 wrote to memory of 212	2516	saves.exe	schtasks.exe
PID 2516 wrote to memory of 1920	2516	saves.exe	cmd.exe
PID 2516 wrote to memory of 1920	2516	saves.exe	cmd.exe
PID 2516 wrote to memory of 1920	2516	saves.exe	cmd.exe
PID 1920 wrote to memory of 4244	1920	cmd.exe	cmd.exe
PID 1920 wrote to memory of 4244	1920	cmd.exe	cmd.exe
PID 1920 wrote to memory of 4244	1920	cmd.exe	cmd.exe
PID 1920 wrote to memory of 2892	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2892	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2892	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2980	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2980	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2980	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2704	1920	cmd.exe	cmd.exe
PID 1920 wrote to memory of 2704	1920	cmd.exe	cmd.exe
PID 1920 wrote to memory of 2704	1920	cmd.exe	cmd.exe
PID 1920 wrote to memory of 1996	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 1996	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 1996	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2104	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2104	1920	cmd.exe	cacls.exe
PID 1920 wrote to memory of 2104	1920	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
"C:\Users\Admin\AppData\Local\Temp\8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2073413.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2073413.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:220

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5005161.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5005161.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5605402.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5605402.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7894235.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7894235.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
7⤵
- Creates scheduled task(s)
PID:212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
7⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:4244

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:N"
8⤵
PID:2892

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:R" /E
8⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:2704

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:N"
8⤵
PID:1996

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:R" /E
8⤵
PID:2104

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe
4⤵
- Executes dropped EXE
PID:4552

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2073413.exe
Filesize
598KB

MD5
5fe322b4d116f4b56d74005dd92fce44

SHA1
9fb9ad0caaf58117fe6d35552f184e9834924f17

SHA256
ef612565479a301f1cfcc4f8fb83c9e32ff4fca6e8c3b3db7fc416c969e0fad7

SHA512
fc798a20747ff99c7df7ce7dc6fd942824c621f9685076d4f0babc346d35ff5110b67011aee606339fb7ee591b702240116c756e26ac67214f9f7a13c0bcff7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5005161.exe
Filesize
433KB

MD5
1de051420bd6e6997fb4cdc08496f0bd

SHA1
de9ca5983333c01c9c812ac05b83b7dcf47f2317

SHA256
e578bac33480ee22001c12cb4ce56491e31246204e40e32ad3046863c0cc32eb

SHA512
8e3bc9eadaab092c6462b574a02351bc1c5978a0d8cceb5d5ad8491d3039c2d334e8fff10fa74013c259133e3a38c9d323369575b0d77943438d6f1eb4560cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe
Filesize
174KB

MD5
8e36e82a52f0943cb00f58aed5493ef4

SHA1
94e83e2ed9e3800507cb5340a0aa68c22db509ed

SHA256
9d1bb7e3cccefc94e4a2e7b6f707ecd34fea92b7ebcf94b109c3830149a4a852

SHA512
d247942df8b792caca6e421efca37b1beac5e327501b26197843d235febcf549b105406c326446704867e1ce2650764512f3d076ad2f9130cd6a731858705c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5605402.exe
Filesize
277KB

MD5
03d46264c8de795277527f92a571bc21

SHA1
3ce74fa4164a5a518523e9de756b956cca8c2f7a

SHA256
fdfb573902da552b912d1ef4f5a02f031842b39de38e65ca5b745b2f73aeeea0

SHA512
526ecca1f7f71fefb968ac9c2d7063b852cb7bc0d56b3794f62d7d7057b17f4bfa3044cd84bc6a7ded76b9af8db731be5d272aecfce344c311310c4a6ac023a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe
Filesize
11KB

MD5
156146d82dcc5dd050a5f3e1fda1627b

SHA1
3528e1d56b2c3f44f00a3866eccee4d0f83f3147

SHA256
797716cd799c196bdb354d1466c57a01f543ab98300af711f0ece92207be3a60

SHA512
dd12ba0be6a2697fd68aae5baea9d0f37b1aab3cbd378e5aac2769c3c36eda4973544353eac453a4c20b38c981e971b7fca49dfde9361fd2e29f7e9b0776d86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7894235.exe
Filesize
338KB

MD5
b56156c57f48d2574e645b8f428213f6

SHA1
9631a543f9d55504818d9f56f555c17d0a568db2

SHA256
2c9ee508f56ee427de7136b0e3bda08066109d6e55c7d3be36c4eac452e20e45

SHA512
f46fc0f3ee322737a32658fb5dc1e9c289f8270ea3ecf67ab6b6c177e2b6114f2ca193e13037aeb3be09daaf3dc9e194afa6e924dbbf6d45c93b33990e910660

Download Submit
memory/1604-28-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/4552-45-0x0000000000340000-0x0000000000370000-memory.dmp

Filesize
192KB

Download
memory/4552-46-0x0000000004C20000-0x0000000004C26000-memory.dmp

Filesize
24KB

Download
memory/4552-47-0x000000000A630000-0x000000000AC48000-memory.dmp

Filesize
6.1MB

Download
memory/4552-48-0x000000000A1B0000-0x000000000A2BA000-memory.dmp

Filesize
1.0MB

Download
memory/4552-49-0x000000000A0E0000-0x000000000A0F2000-memory.dmp

Filesize
72KB

Download
memory/4552-50-0x000000000A140000-0x000000000A17C000-memory.dmp

Filesize
240KB

Download
memory/4552-51-0x00000000025A0000-0x00000000025EC000-memory.dmp

Filesize
304KB

Download