amadey | 8f7ecfcea350d8e91e6bb9083833f37b57aa78d15022b68c407055e2463bd982

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe
Size

1.0MB
MD5

ba3d04982933c6b5e4050768f8d27f0b
SHA1

3e7af9fd14b090eb598b58bc812338c23009db69
SHA256

26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2
SHA512

5fb8eb13c25e277be1932963e05577779035e1792f5704196593a6d4ceeb60e09f222623ab81feba01fe6bf00bcdd1602f7943a80c7cbca2e32a30cbaf44dd96
SSDEEP

24576:1yw7VWue42Icf3RTglp+BQ+Qkkpawj42cM/ov98jC:QwBWueVRTglo/PK/j41kov9a

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral3/memory/2012-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x0007000000023472-49.dat	family_redline
behavioral3/memory/3464-51-0x0000000000E60000-0x0000000000E90000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	r4692845.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 11 IoCs

pid	Process
4140	z2754612.exe
2056	z2645491.exe
4632	z6672216.exe
2000	z8378150.exe
3640	q5871135.exe
2304	r4692845.exe
4560	explonde.exe
3464	s7005503.exe
3232	explonde.exe
228	explonde.exe
1960	explonde.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2754612.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2645491.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6672216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z8378150.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 2012	3640	q5871135.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	3640	WerFault.exe	91

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2012	AppLaunch.exe
2012	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	AppLaunch.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4140	1020	26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe	85
PID 1020 wrote to memory of 4140	1020	26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe	85
PID 1020 wrote to memory of 4140	1020	26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe	85
PID 4140 wrote to memory of 2056	4140	z2754612.exe	86
PID 4140 wrote to memory of 2056	4140	z2754612.exe	86
PID 4140 wrote to memory of 2056	4140	z2754612.exe	86
PID 2056 wrote to memory of 4632	2056	z2645491.exe	87
PID 2056 wrote to memory of 4632	2056	z2645491.exe	87
PID 2056 wrote to memory of 4632	2056	z2645491.exe	87
PID 4632 wrote to memory of 2000	4632	z6672216.exe	89
PID 4632 wrote to memory of 2000	4632	z6672216.exe	89
PID 4632 wrote to memory of 2000	4632	z6672216.exe	89
PID 2000 wrote to memory of 3640	2000	z8378150.exe	91
PID 2000 wrote to memory of 3640	2000	z8378150.exe	91
PID 2000 wrote to memory of 3640	2000	z8378150.exe	91
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 3640 wrote to memory of 2012	3640	q5871135.exe	93
PID 2000 wrote to memory of 2304	2000	z8378150.exe	100
PID 2000 wrote to memory of 2304	2000	z8378150.exe	100
PID 2000 wrote to memory of 2304	2000	z8378150.exe	100
PID 2304 wrote to memory of 4560	2304	r4692845.exe	102
PID 2304 wrote to memory of 4560	2304	r4692845.exe	102
PID 2304 wrote to memory of 4560	2304	r4692845.exe	102
PID 4632 wrote to memory of 3464	4632	z6672216.exe	103
PID 4632 wrote to memory of 3464	4632	z6672216.exe	103
PID 4632 wrote to memory of 3464	4632	z6672216.exe	103
PID 4560 wrote to memory of 3644	4560	explonde.exe	104
PID 4560 wrote to memory of 3644	4560	explonde.exe	104
PID 4560 wrote to memory of 3644	4560	explonde.exe	104
PID 4560 wrote to memory of 4636	4560	explonde.exe	106
PID 4560 wrote to memory of 4636	4560	explonde.exe	106
PID 4560 wrote to memory of 4636	4560	explonde.exe	106
PID 4636 wrote to memory of 1452	4636	cmd.exe	108
PID 4636 wrote to memory of 1452	4636	cmd.exe	108
PID 4636 wrote to memory of 1452	4636	cmd.exe	108
PID 4636 wrote to memory of 5040	4636	cmd.exe	109
PID 4636 wrote to memory of 5040	4636	cmd.exe	109
PID 4636 wrote to memory of 5040	4636	cmd.exe	109
PID 4636 wrote to memory of 1396	4636	cmd.exe	110
PID 4636 wrote to memory of 1396	4636	cmd.exe	110
PID 4636 wrote to memory of 1396	4636	cmd.exe	110
PID 4636 wrote to memory of 5116	4636	cmd.exe	111
PID 4636 wrote to memory of 5116	4636	cmd.exe	111
PID 4636 wrote to memory of 5116	4636	cmd.exe	111
PID 4636 wrote to memory of 4628	4636	cmd.exe	112
PID 4636 wrote to memory of 4628	4636	cmd.exe	112
PID 4636 wrote to memory of 4628	4636	cmd.exe	112
PID 4636 wrote to memory of 4080	4636	cmd.exe	113
PID 4636 wrote to memory of 4080	4636	cmd.exe	113
PID 4636 wrote to memory of 4080	4636	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe
"C:\Users\Admin\AppData\Local\Temp\26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2754612.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2754612.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2645491.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2645491.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6672216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6672216.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8378150.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8378150.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5871135.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5871135.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 136
        7⤵
        Program crash
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4692845.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4692845.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        8⤵
        Creates scheduled task(s)
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        9⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        9⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        9⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        9⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7005503.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7005503.exe
        5⤵
        Executes dropped EXE
        
        PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3640 -ip 3640
1⤵
PID:8

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:228

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2754612.exe

Filesize
850KB

MD5
c751e10c732cc5bf2eedcd2813487ffa

SHA1
a3d13f13650262ff1841b53d58f59306a68f0708

SHA256
7c73768dbb0024a9cc70c99b0d8c6e02d7e9546d37e4b30179dad97261ba668b

SHA512
b78ed1fbce442eef74934fe2bdf59488a1d42495657726f25b5d4f2335c886d906125f822067381b9d78ee41a5c2af35404126029b799b6e82a1cfaa1f49bac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2645491.exe

Filesize
613KB

MD5
ae13e6504bf58173a6e6f18f0b9e8adb

SHA1
174be879f0787d5a9a2b310f5f27755ba6889687

SHA256
629b84c16cd202737daabf0edd413802d82a4d26ef52df5f80ff7b3fe2562444

SHA512
3dd36855231d62d0722f9e8dda8a169baf2c9af942afa32fc9945e22dc356111b8e84286764f6e950d19207d64b310a55e4d2890e375806c62fa67369b814bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6672216.exe

Filesize
430KB

MD5
7fa33dd9b62bf389c6f5c8f8027fb626

SHA1
26a94ca327753dce3e15cf016650e4d7adc36256

SHA256
c60768d9b0e26029b68c6842a1c25ae2002775dbb2a5b073f739129dd5dd46e7

SHA512
6041ccbf52073e28dacf43122d843a258a84a81f2f8b0cab185ae2d152ee26a960f35acbe56ee97207cd292e87350a752a0522bef7a3444e639cccd2d41c6544

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7005503.exe

Filesize
176KB

MD5
3ec4ca9ae67ef1b895a8891c2e791d05

SHA1
d41d124081c0c52df171567143529442270526d0

SHA256
36d844c42437c1527fc2bef29ed66977108eefaf740720e3e2e3dfdf155710ff

SHA512
968456e047df706dce30a296f9a37a75919b42399dfd736fb4caa04d720975485790ee6f8564aaab7c35e9f3e6bef86e5fa4c872419d385d4ed8759c3c4c1c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8378150.exe

Filesize
274KB

MD5
431affb77ccaa39b93ab4a151b823bc7

SHA1
93e38418ffa6dcd96b0e22d9639f946b44fe6384

SHA256
46556986ac5180d697f99a91a42f096e3d41f73622ec2320ee0a605a46372030

SHA512
7cb29c47742b8f6f66116f790116074e50dd7b2ecb07612361e7d7d3075380fc162be6cd25f9016fbb658fa400986849cd557f34cb3beeb5b8ce0182b3cc4fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5871135.exe

Filesize
135KB

MD5
78b0e7f4465d9703edfb15e42a706583

SHA1
5eb6ca47a581095ce3c641fb83d0569c78f74b2a

SHA256
d1e71fbaebc91ac288440e4ec92bc2e772cbfb3de71455198a4ffcbc7819483b

SHA512
ef80fd50943087dc408e0cc51fba6c060fe3d7f54936b7ab12ef07d08093c7d423b7424c675a1882b68d78ac9e4d06cb45f0360de8fe833e1ee59a85b1ba192c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4692845.exe

Filesize
221KB

MD5
12850cda424057e7028f2b8fc3acc611

SHA1
116a74f211cc77cd899b1e19df307fbd3e319d0a

SHA256
a2f6a0b068e2f33384c0ad8c0f4dd4be755005f5ca2598c7f52b1be4b39a58f5

SHA512
a606db4dcfdb410ade76087d61548e0820e6be9c8842b6d0cbf5c1c2a22a2e2ec532c273b242ca5aa7c3e68cc4417e1fbdd318c5d458166fc33cc1d8266ab152

Download Submit
memory/2012-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3464-51-0x0000000000E60000-0x0000000000E90000-memory.dmp

Filesize
192KB

Download
memory/3464-52-0x0000000001550000-0x0000000001556000-memory.dmp

Filesize
24KB

Download
memory/3464-53-0x0000000005E60000-0x0000000006478000-memory.dmp

Filesize
6.1MB

Download
memory/3464-54-0x0000000005950000-0x0000000005A5A000-memory.dmp

Filesize
1.0MB

Download
memory/3464-55-0x00000000057E0000-0x00000000057F2000-memory.dmp

Filesize
72KB

Download
memory/3464-56-0x0000000005880000-0x00000000058BC000-memory.dmp

Filesize
240KB

Download
memory/3464-57-0x00000000058C0000-0x000000000590C000-memory.dmp

Filesize
304KB

Download