amadey | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe
Size

433KB
MD5

50b9db4007c61b38b491d12f1077842e
SHA1

681f65edc9f027e30d2e2a852bae01699270039a
SHA256

d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2
SHA512

77f3bc841d1e8f135e9cc3b443da58ce96bb567bf108dc4ef40ce9289c5fc92b7101bc77128158204f8eec03c6fd390bc65c19b3d1e877aaf817d2afae62e1b0
SSDEEP

12288:FMrKy90UBVIk3ZX7/PWuhM8O8zhs2SzgdYk:LyFBzi8Bf2k

Score

10^/10

amadey healer redline 59b440 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral18/files/0x000800000002343d-13.dat	healer
behavioral18/memory/2580-15-0x0000000000E80000-0x0000000000E8A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g7277976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g7277976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g7277976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g7277976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g7277976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g7277976.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral18/files/0x000700000002343b-30.dat	family_redline
behavioral18/memory/3964-32-0x0000000000CB0000-0x0000000000CE0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	h9113382.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 8 IoCs

pid	Process
3304	x1694417.exe
2580	g7277976.exe
3476	h9113382.exe
3500	saves.exe
3964	i5708919.exe
3240	saves.exe
3152	saves.exe
1980	saves.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g7277976.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1694417.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	g7277976.exe
2580	g7277976.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	g7277976.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3304	4068	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe	84
PID 4068 wrote to memory of 3304	4068	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe	84
PID 4068 wrote to memory of 3304	4068	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe	84
PID 3304 wrote to memory of 2580	3304	x1694417.exe	86
PID 3304 wrote to memory of 2580	3304	x1694417.exe	86
PID 3304 wrote to memory of 3476	3304	x1694417.exe	97
PID 3304 wrote to memory of 3476	3304	x1694417.exe	97
PID 3304 wrote to memory of 3476	3304	x1694417.exe	97
PID 3476 wrote to memory of 3500	3476	h9113382.exe	98
PID 3476 wrote to memory of 3500	3476	h9113382.exe	98
PID 3476 wrote to memory of 3500	3476	h9113382.exe	98
PID 4068 wrote to memory of 3964	4068	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe	99
PID 4068 wrote to memory of 3964	4068	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe	99
PID 4068 wrote to memory of 3964	4068	d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe	99
PID 3500 wrote to memory of 5076	3500	saves.exe	100
PID 3500 wrote to memory of 5076	3500	saves.exe	100
PID 3500 wrote to memory of 5076	3500	saves.exe	100
PID 3500 wrote to memory of 1220	3500	saves.exe	102
PID 3500 wrote to memory of 1220	3500	saves.exe	102
PID 3500 wrote to memory of 1220	3500	saves.exe	102
PID 1220 wrote to memory of 3680	1220	cmd.exe	104
PID 1220 wrote to memory of 3680	1220	cmd.exe	104
PID 1220 wrote to memory of 3680	1220	cmd.exe	104
PID 1220 wrote to memory of 4492	1220	cmd.exe	105
PID 1220 wrote to memory of 4492	1220	cmd.exe	105
PID 1220 wrote to memory of 4492	1220	cmd.exe	105
PID 1220 wrote to memory of 1268	1220	cmd.exe	106
PID 1220 wrote to memory of 1268	1220	cmd.exe	106
PID 1220 wrote to memory of 1268	1220	cmd.exe	106
PID 1220 wrote to memory of 2256	1220	cmd.exe	107
PID 1220 wrote to memory of 2256	1220	cmd.exe	107
PID 1220 wrote to memory of 2256	1220	cmd.exe	107
PID 1220 wrote to memory of 1172	1220	cmd.exe	108
PID 1220 wrote to memory of 1172	1220	cmd.exe	108
PID 1220 wrote to memory of 1172	1220	cmd.exe	108
PID 1220 wrote to memory of 1644	1220	cmd.exe	109
PID 1220 wrote to memory of 1644	1220	cmd.exe	109
PID 1220 wrote to memory of 1644	1220	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe
"C:\Users\Admin\AppData\Local\Temp\d304eb3331ed5f7542898adf235b0119e5ae9bf4622b4c36147856e87a8ec8e2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1694417.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1694417.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7277976.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7277976.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9113382.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9113382.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
      "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:5076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1220
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3680
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        6⤵
        
        PID:4492
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        6⤵
        
        PID:1268
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2256
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        6⤵
        
        PID:1172
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        6⤵
        
        PID:1644
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5708919.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5708919.exe
  2⤵
  - Executes dropped EXE
  PID:3964

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5708919.exe

Filesize
174KB

MD5
f7b8a6fa296c8357143764d0fcc0622e

SHA1
c7e9f06756fc93baf86e4a7b402a29518ab2ae26

SHA256
747c087b3fde3b182a28524632e6de2a400980712290ebec0bf77fb1a60cdafc

SHA512
b1b337b6892c27ecf2aa93af8b5934100c92578f904b23bec0e96d8e975ea3373300a92b05e1f0037850aea45623c1cf81d7c7e92a3c299a01cab51ccb709a19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1694417.exe

Filesize
277KB

MD5
16ff80cdfa0aea5bce3a88820f37ff80

SHA1
93fe928dec7974962441d2cb4ad6435863394bee

SHA256
fbe698274bc5cdc9a12580a6e636c8fce33f71aaa9bb1176605b29cd6b9a82b4

SHA512
27742530015e9c10482d53c818fb52bb57b1f19825b58f7397cb145b22c9591470aa9c1a7f0c0a65a6f7c90306dd7c16b2a07da895e3acdf76a94fc2c2dcf6e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7277976.exe

Filesize
11KB

MD5
eead17d3376defc1b833e4f41378de64

SHA1
16cbe2843eb639e2ef9a6eb241abd1e319fc6665

SHA256
67efc7a9be0966299d6baf23eec28665784efeccce75a4e49b0901ae5b6b7c27

SHA512
60f7a06523779896c379bd4d1473c5e0199a1b075058737dc3c1ce72c07ff9f8000b29a91b0ff20e3df95db272224ce7f3052e192ce2a9d12cb7d4848bc26b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9113382.exe

Filesize
337KB

MD5
84e09c1301b3944c40d5ccfb4363a26d

SHA1
aeee1d61573aa06d9ccd75bf00abb8d495fbb707

SHA256
0cebef5469dff268b160d51b170a46d4aeb50c9de68400f4b5d46615809a0d34

SHA512
ffc848a8b5ffd50e6fb6528c26fd234c2e75594941962ab87fffcdb95ba86ad95369567c298cfc66c25d29ee350647ed566e8a01aebab0c0efea1308dfc2d852

Download Submit
memory/2580-14-0x00007FFAEE033000-0x00007FFAEE035000-memory.dmp

Filesize
8KB

Download
memory/2580-15-0x0000000000E80000-0x0000000000E8A000-memory.dmp

Filesize
40KB

Download
memory/3964-32-0x0000000000CB0000-0x0000000000CE0000-memory.dmp

Filesize
192KB

Download
memory/3964-33-0x0000000002FE0000-0x0000000002FE6000-memory.dmp

Filesize
24KB

Download
memory/3964-34-0x0000000005DD0000-0x00000000063E8000-memory.dmp

Filesize
6.1MB

Download
memory/3964-35-0x00000000058C0000-0x00000000059CA000-memory.dmp

Filesize
1.0MB

Download
memory/3964-36-0x0000000005760000-0x0000000005772000-memory.dmp

Filesize
72KB

Download
memory/3964-37-0x00000000057F0000-0x000000000582C000-memory.dmp

Filesize
240KB

Download
memory/3964-38-0x0000000005830000-0x000000000587C000-memory.dmp

Filesize
304KB

Download