amadey | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe
Size

437KB
MD5

4706f66d2e76da2ba34e3bf258ffba15
SHA1

ab71090e08967118015963985f2f1df2c603f1f3
SHA256

7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e
SHA512

9ae987c7af0509c9ff0d3cef44eab0a8499f930b42a71183306a081a66fd5b128c8a3508dcad251281a7bbcf2cc0154a6be44d64bc47e80c46afd972fac58790
SSDEEP

12288:9Mrfy90uxpbCC8SLD5x/rKR6EXYp71uwXC:Ky372C8SLD5x/rKgEA1uwy

Score

10^/10

amadey redline 59b440 mrak infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe	family_redline
behavioral14/memory/1484-26-0x0000000000340000-0x0000000000370000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

l0302418.exesaves.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	l0302418.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 7 IoCs

Processes:

y7464232.exel0302418.exesaves.exen1537617.exesaves.exesaves.exesaves.exe

pid process

1448 y7464232.exe
3976 l0302418.exe
2688 saves.exe
1484 n1537617.exe
1680 saves.exe
1080 saves.exe
3224 saves.exe

pid	process
1448	y7464232.exe
3976	l0302418.exe
2688	saves.exe
1484	n1537617.exe
1680	saves.exe
1080	saves.exe
3224	saves.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exey7464232.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7464232.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2180 schtasks.exe

pid	process
2180	schtasks.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exey7464232.exel0302418.exesaves.execmd.exe

description	pid	process	target process
PID 3588 wrote to memory of 1448	3588	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe	y7464232.exe
PID 3588 wrote to memory of 1448	3588	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe	y7464232.exe
PID 3588 wrote to memory of 1448	3588	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe	y7464232.exe
PID 1448 wrote to memory of 3976	1448	y7464232.exe	l0302418.exe
PID 1448 wrote to memory of 3976	1448	y7464232.exe	l0302418.exe
PID 1448 wrote to memory of 3976	1448	y7464232.exe	l0302418.exe
PID 3976 wrote to memory of 2688	3976	l0302418.exe	saves.exe
PID 3976 wrote to memory of 2688	3976	l0302418.exe	saves.exe
PID 3976 wrote to memory of 2688	3976	l0302418.exe	saves.exe
PID 1448 wrote to memory of 1484	1448	y7464232.exe	n1537617.exe
PID 1448 wrote to memory of 1484	1448	y7464232.exe	n1537617.exe
PID 1448 wrote to memory of 1484	1448	y7464232.exe	n1537617.exe
PID 2688 wrote to memory of 2180	2688	saves.exe	schtasks.exe
PID 2688 wrote to memory of 2180	2688	saves.exe	schtasks.exe
PID 2688 wrote to memory of 2180	2688	saves.exe	schtasks.exe
PID 2688 wrote to memory of 1616	2688	saves.exe	cmd.exe
PID 2688 wrote to memory of 1616	2688	saves.exe	cmd.exe
PID 2688 wrote to memory of 1616	2688	saves.exe	cmd.exe
PID 1616 wrote to memory of 4672	1616	cmd.exe	cmd.exe
PID 1616 wrote to memory of 4672	1616	cmd.exe	cmd.exe
PID 1616 wrote to memory of 4672	1616	cmd.exe	cmd.exe
PID 1616 wrote to memory of 868	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 868	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 868	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 1664	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 1664	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 1664	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 4844	1616	cmd.exe	cmd.exe
PID 1616 wrote to memory of 4844	1616	cmd.exe	cmd.exe
PID 1616 wrote to memory of 4844	1616	cmd.exe	cmd.exe
PID 1616 wrote to memory of 5032	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 5032	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 5032	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 3164	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 3164	1616	cmd.exe	cacls.exe
PID 1616 wrote to memory of 3164	1616	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe
"C:\Users\Admin\AppData\Local\Temp\7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3588

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7464232.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7464232.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0302418.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0302418.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
5⤵
- Creates scheduled task(s)
PID:2180

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4672

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:N"
6⤵
PID:868

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:R" /E
6⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4844

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:N"
6⤵
PID:5032

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:R" /E
6⤵
PID:3164

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe
3⤵
- Executes dropped EXE
PID:1484

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1080

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3224

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7464232.exe
Filesize
331KB

MD5
d9c02ab5e49ebf8e926c3c5e2bb2a1db

SHA1
91d1443cef87f863912102b0f065b17fdefcb8cb

SHA256
f40e46012a6bd9dc6a10bb43082d257353b48f75d8d6d67249cb317a257d8f60

SHA512
cd3489087787918ff908fc4855f0abce3a57988afcd6228169a16460e1685328b1bebd7b7a9932bdc7ac2bc75283d1707231443707745769b41e76cd5a14264b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0302418.exe
Filesize
337KB

MD5
f9bdf1012722abca238ce17e9d37ca8f

SHA1
f2e821343120281131e50e261fc9e1b92598f2e5

SHA256
46c7c9a5925228f818e7939c25e97a59f2faccaa567022bb02d063119cddad6e

SHA512
5daf68f034c2f1d37c87de46e780054901c2702e1bb0860548f5b2e9784d0e499ca36c5f2e0d807b92ae4a9fabf60b0e5caf6d8ba712e37893aa2abe0b957639

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe
Filesize
174KB

MD5
3d7783a2e6e8a79bb4cbefe8f2a0a02a

SHA1
1896b81f6615b834d2fded733ea77066442fdc70

SHA256
bb95cd83473988c9644c5eba47a2b1d420519a3dafd7de4eff82661eae15b042

SHA512
a1d0f049fb92efd850d43446d266dfe7a26c0ccbafbef90e89ca08cfc6f629954a69fe6d9287e4c6cfc4f5b8d16ea1b840c644895c382fe5fd9c4daa19fa8978

Download Submit
memory/1484-26-0x0000000000340000-0x0000000000370000-memory.dmp

Filesize
192KB

Download
memory/1484-27-0x0000000007130000-0x0000000007136000-memory.dmp

Filesize
24KB

Download
memory/1484-28-0x000000000A770000-0x000000000AD88000-memory.dmp

Filesize
6.1MB

Download
memory/1484-29-0x000000000A2F0000-0x000000000A3FA000-memory.dmp

Filesize
1.0MB

Download
memory/1484-30-0x000000000A220000-0x000000000A232000-memory.dmp

Filesize
72KB

Download
memory/1484-31-0x000000000A280000-0x000000000A2BC000-memory.dmp

Filesize
240KB

Download
memory/1484-32-0x00000000047A0000-0x00000000047EC000-memory.dmp

Filesize
304KB

Download