amadey | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe
Size

600KB
MD5

92caeb092fe661984d6b5938db1e3d2c
SHA1

aab1602e93402605ae2f28b22ff993873730532a
SHA256

2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb
SHA512

76aeb5a9753b57d6cecc4474965e0a623ab13ab5ca9439c2ce2d43797afded16c738fb0339789edf61bf6ce59c7df884ed120c57c1ed29536643d3df8be638f9
SSDEEP

12288:JMr+y90odZgZUSkyiUAl6cKF/e7oVrKRQEXFp7GDlSAEkObTn94b:fyhrPqAQc2G7oNKeEnGDQMOd4b

Score

10^/10

amadey mystic redline 59b440 mrak infostealer persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1422656.exe	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9711648.exe	family_redline
behavioral4/memory/888-36-0x0000000000350000-0x0000000000380000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

saves.exeb3737668.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	saves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	b3737668.exe

Executes dropped EXE 9 IoCs

Processes:

v2378133.exev4916712.exeb3737668.exesaves.exec1422656.exed9711648.exesaves.exesaves.exesaves.exe

pid process

3100 v2378133.exe
4320 v4916712.exe
1620 b3737668.exe
1728 saves.exe
2036 c1422656.exe
888 d9711648.exe
4064 saves.exe
3500 saves.exe
3344 saves.exe

pid	process
3100	v2378133.exe
4320	v4916712.exe
1620	b3737668.exe
1728	saves.exe
2036	c1422656.exe
888	d9711648.exe
4064	saves.exe
3500	saves.exe
3344	saves.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exev2378133.exev4916712.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2378133.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4916712.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3132 schtasks.exe

pid	process
3132	schtasks.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exev2378133.exev4916712.exeb3737668.exesaves.execmd.exe

description	pid	process	target process
PID 2308 wrote to memory of 3100	2308	2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe	v2378133.exe
PID 2308 wrote to memory of 3100	2308	2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe	v2378133.exe
PID 2308 wrote to memory of 3100	2308	2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe	v2378133.exe
PID 3100 wrote to memory of 4320	3100	v2378133.exe	v4916712.exe
PID 3100 wrote to memory of 4320	3100	v2378133.exe	v4916712.exe
PID 3100 wrote to memory of 4320	3100	v2378133.exe	v4916712.exe
PID 4320 wrote to memory of 1620	4320	v4916712.exe	b3737668.exe
PID 4320 wrote to memory of 1620	4320	v4916712.exe	b3737668.exe
PID 4320 wrote to memory of 1620	4320	v4916712.exe	b3737668.exe
PID 1620 wrote to memory of 1728	1620	b3737668.exe	saves.exe
PID 1620 wrote to memory of 1728	1620	b3737668.exe	saves.exe
PID 1620 wrote to memory of 1728	1620	b3737668.exe	saves.exe
PID 4320 wrote to memory of 2036	4320	v4916712.exe	c1422656.exe
PID 4320 wrote to memory of 2036	4320	v4916712.exe	c1422656.exe
PID 4320 wrote to memory of 2036	4320	v4916712.exe	c1422656.exe
PID 1728 wrote to memory of 3132	1728	saves.exe	schtasks.exe
PID 1728 wrote to memory of 3132	1728	saves.exe	schtasks.exe
PID 1728 wrote to memory of 3132	1728	saves.exe	schtasks.exe
PID 3100 wrote to memory of 888	3100	v2378133.exe	d9711648.exe
PID 3100 wrote to memory of 888	3100	v2378133.exe	d9711648.exe
PID 3100 wrote to memory of 888	3100	v2378133.exe	d9711648.exe
PID 1728 wrote to memory of 2328	1728	saves.exe	cmd.exe
PID 1728 wrote to memory of 2328	1728	saves.exe	cmd.exe
PID 1728 wrote to memory of 2328	1728	saves.exe	cmd.exe
PID 2328 wrote to memory of 2112	2328	cmd.exe	cmd.exe
PID 2328 wrote to memory of 2112	2328	cmd.exe	cmd.exe
PID 2328 wrote to memory of 2112	2328	cmd.exe	cmd.exe
PID 2328 wrote to memory of 4108	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 4108	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 4108	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 5016	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 5016	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 5016	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 1144	2328	cmd.exe	cmd.exe
PID 2328 wrote to memory of 1144	2328	cmd.exe	cmd.exe
PID 2328 wrote to memory of 1144	2328	cmd.exe	cmd.exe
PID 2328 wrote to memory of 640	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 640	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 640	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 788	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 788	2328	cmd.exe	cacls.exe
PID 2328 wrote to memory of 788	2328	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe
"C:\Users\Admin\AppData\Local\Temp\2469003f42fad7f59b70f7ba006c65ee5db3798dfa579f761b047cd449e394fb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2378133.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2378133.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3100

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4916712.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4916712.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3737668.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3737668.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
6⤵
- Creates scheduled task(s)
PID:3132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2112

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:N"
7⤵
PID:4108

C:\Windows\SysWOW64\cacls.exe
CACLS "saves.exe" /P "Admin:R" /E
7⤵
PID:5016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1144

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:N"
7⤵
PID:640

C:\Windows\SysWOW64\cacls.exe
CACLS "..\b40d11255d" /P "Admin:R" /E
7⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1422656.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1422656.exe
4⤵
- Executes dropped EXE
PID:2036

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9711648.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9711648.exe
3⤵
- Executes dropped EXE
PID:888

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3500

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2378133.exe

Filesize
475KB

MD5
a6cba3983691b63782055d6a5e8d568e

SHA1
eb7c0479ca7e2277d64af94116fc7c794fafedc9

SHA256
0cad3d06292b2e69338c9795ea680ee9aa73b6b53b3c893f69b591d7495d3cab

SHA512
cbda81d6455a1bd04b7fe98766776d15fa67d65917776399b054560bacca4e898d03e75f7d0a57deeaa1b3044afd8ea16542a1c4f964f1c92fad38208b6b5844

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9711648.exe

Filesize
173KB

MD5
3746b82fd2c0730d82a029824aca537b

SHA1
c869654d5abc34dfcecf5cb7f988b74ba0c3a381

SHA256
38a34d128bbd7405d2d9f90f532af35c28023c5362b830b3267a529b39188d86

SHA512
4d3af4a02d4749d556f4f246d3d756c09403a03bf6c1c1e8a68308b63e751d34bf1ed4844addefea5aeeb848fc88098737f7ef0b189e10694f494001f6b09062

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4916712.exe

Filesize
320KB

MD5
19b7368e3063539f75c22561487a6a91

SHA1
2644acb5025da4b9c94451ce177dd47aff9609d0

SHA256
e3fa594d84c3226c70e1deb782a5a8ea254152f17b8455d49923c16646ebf739

SHA512
b6d2e5febef2b66603a5daeb3c81349e9ec1657492040c5c088b657af5fc00ca3157945b743615449bc2a45be07820e5ef1315bf5d997b9831eca7d662cf95e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3737668.exe

Filesize
336KB

MD5
5caa9161da052af9a42bb1e1ba21f727

SHA1
81331a141dd208881173587c7cddf77389d97a79

SHA256
523ac0d13ca3604f47bca59a2543837a96d76d709fd376c34ef217f753a459b8

SHA512
8ba3665b84a33ee0a991a4001c9b1beaba8a63edb56db6723358a1b5a185d56d73fcf4927fcbc38a731e83a206a5224186d9a33f4944ef60613f991ad1d55a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1422656.exe

Filesize
141KB

MD5
0f64d4502c9ed8177a82b3bea893e56e

SHA1
97a7e92543f6c48950fe4a45325e89a7c35a05ce

SHA256
953191bb67e00845e433e49297bb8fa2b90cadd0d6645da2e145ed71261e91be

SHA512
5fa163380f06ebfdcc6a003f4c996f21994d9890e893403a881d56d8613707d4c2071995a34905daa503801cf764002166e6d2600db920fa8e75e396cda110e4

Download Submit
memory/888-36-0x0000000000350000-0x0000000000380000-memory.dmp

Filesize
192KB

Download
memory/888-37-0x0000000006FC0000-0x0000000006FC6000-memory.dmp

Filesize
24KB

Download
memory/888-38-0x0000000005260000-0x0000000005878000-memory.dmp

Filesize
6.1MB

Download
memory/888-39-0x0000000004D90000-0x0000000004E9A000-memory.dmp

Filesize
1.0MB

Download
memory/888-40-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/888-41-0x0000000004D20000-0x0000000004D5C000-memory.dmp

Filesize
240KB

Download
memory/888-42-0x0000000004EA0000-0x0000000004EEC000-memory.dmp

Filesize
304KB

Download