amadey | ac90002ec144a6c8c89c45137265a202aeef6b583cef01223b622e10b4c4b797

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
Size

704KB
MD5

b7141f47266f8fb53311b5a5eab29e92
SHA1

c3f6fd7ea5e23c826639ee2657a4adc55645e60b
SHA256

8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8
SHA512

053bd538bc0a33d42c9bcb76d6026f83a60c91a466feb7d2e6f945f3e86bdfe731bc462f2b18df9806d1ddc5b02d140ffdddf7e0b27c18c8b2056728b4cd38ed
SSDEEP

12288:KMrOy90VPnlz2wBiDoLCPE5itsvhGIkO1ObIf/D5Sv5rjnnS+bgumM:cyw2wNW8zp7LlXirjnS+x

Score

10^/10

amadey healer redline 59b440 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral10/files/0x0008000000023434-27.dat	healer
behavioral10/memory/1160-28-0x0000000000100000-0x000000000010A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g1613759.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g1613759.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral10/files/0x0007000000023432-43.dat	family_redline
behavioral10/memory/4476-45-0x00000000000D0000-0x0000000000100000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	h7894235.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 10 IoCs

pid	Process
2116	x2073413.exe
3284	x5005161.exe
1960	x5605402.exe
1160	g1613759.exe
1872	h7894235.exe
4464	saves.exe
4476	i5854270.exe
4224	saves.exe
2956	saves.exe
1472	saves.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g1613759.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2073413.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5005161.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x5605402.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1160	g1613759.exe
1160	g1613759.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	g1613759.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 2116	3696	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe	83
PID 3696 wrote to memory of 2116	3696	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe	83
PID 3696 wrote to memory of 2116	3696	8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe	83
PID 2116 wrote to memory of 3284	2116	x2073413.exe	84
PID 2116 wrote to memory of 3284	2116	x2073413.exe	84
PID 2116 wrote to memory of 3284	2116	x2073413.exe	84
PID 3284 wrote to memory of 1960	3284	x5005161.exe	85
PID 3284 wrote to memory of 1960	3284	x5005161.exe	85
PID 3284 wrote to memory of 1960	3284	x5005161.exe	85
PID 1960 wrote to memory of 1160	1960	x5605402.exe	86
PID 1960 wrote to memory of 1160	1960	x5605402.exe	86
PID 1960 wrote to memory of 1872	1960	x5605402.exe	97
PID 1960 wrote to memory of 1872	1960	x5605402.exe	97
PID 1960 wrote to memory of 1872	1960	x5605402.exe	97
PID 1872 wrote to memory of 4464	1872	h7894235.exe	98
PID 1872 wrote to memory of 4464	1872	h7894235.exe	98
PID 1872 wrote to memory of 4464	1872	h7894235.exe	98
PID 3284 wrote to memory of 4476	3284	x5005161.exe	99
PID 3284 wrote to memory of 4476	3284	x5005161.exe	99
PID 3284 wrote to memory of 4476	3284	x5005161.exe	99
PID 4464 wrote to memory of 3760	4464	saves.exe	100
PID 4464 wrote to memory of 3760	4464	saves.exe	100
PID 4464 wrote to memory of 3760	4464	saves.exe	100
PID 4464 wrote to memory of 4084	4464	saves.exe	102
PID 4464 wrote to memory of 4084	4464	saves.exe	102
PID 4464 wrote to memory of 4084	4464	saves.exe	102
PID 4084 wrote to memory of 2248	4084	cmd.exe	104
PID 4084 wrote to memory of 2248	4084	cmd.exe	104
PID 4084 wrote to memory of 2248	4084	cmd.exe	104
PID 4084 wrote to memory of 3912	4084	cmd.exe	105
PID 4084 wrote to memory of 3912	4084	cmd.exe	105
PID 4084 wrote to memory of 3912	4084	cmd.exe	105
PID 4084 wrote to memory of 2160	4084	cmd.exe	106
PID 4084 wrote to memory of 2160	4084	cmd.exe	106
PID 4084 wrote to memory of 2160	4084	cmd.exe	106
PID 4084 wrote to memory of 4376	4084	cmd.exe	107
PID 4084 wrote to memory of 4376	4084	cmd.exe	107
PID 4084 wrote to memory of 4376	4084	cmd.exe	107
PID 4084 wrote to memory of 1476	4084	cmd.exe	108
PID 4084 wrote to memory of 1476	4084	cmd.exe	108
PID 4084 wrote to memory of 1476	4084	cmd.exe	108
PID 4084 wrote to memory of 2396	4084	cmd.exe	109
PID 4084 wrote to memory of 2396	4084	cmd.exe	109
PID 4084 wrote to memory of 2396	4084	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
"C:\Users\Admin\AppData\Local\Temp\8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2073413.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2073413.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5005161.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5005161.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5605402.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5605402.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7894235.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7894235.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:3760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        8⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        8⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        8⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        8⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe
      4⤵
      Executes dropped EXE
      PID:4476

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:2956

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2073413.exe

Filesize
598KB

MD5
5fe322b4d116f4b56d74005dd92fce44

SHA1
9fb9ad0caaf58117fe6d35552f184e9834924f17

SHA256
ef612565479a301f1cfcc4f8fb83c9e32ff4fca6e8c3b3db7fc416c969e0fad7

SHA512
fc798a20747ff99c7df7ce7dc6fd942824c621f9685076d4f0babc346d35ff5110b67011aee606339fb7ee591b702240116c756e26ac67214f9f7a13c0bcff7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5005161.exe

Filesize
433KB

MD5
1de051420bd6e6997fb4cdc08496f0bd

SHA1
de9ca5983333c01c9c812ac05b83b7dcf47f2317

SHA256
e578bac33480ee22001c12cb4ce56491e31246204e40e32ad3046863c0cc32eb

SHA512
8e3bc9eadaab092c6462b574a02351bc1c5978a0d8cceb5d5ad8491d3039c2d334e8fff10fa74013c259133e3a38c9d323369575b0d77943438d6f1eb4560cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5854270.exe

Filesize
174KB

MD5
8e36e82a52f0943cb00f58aed5493ef4

SHA1
94e83e2ed9e3800507cb5340a0aa68c22db509ed

SHA256
9d1bb7e3cccefc94e4a2e7b6f707ecd34fea92b7ebcf94b109c3830149a4a852

SHA512
d247942df8b792caca6e421efca37b1beac5e327501b26197843d235febcf549b105406c326446704867e1ce2650764512f3d076ad2f9130cd6a731858705c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5605402.exe

Filesize
277KB

MD5
03d46264c8de795277527f92a571bc21

SHA1
3ce74fa4164a5a518523e9de756b956cca8c2f7a

SHA256
fdfb573902da552b912d1ef4f5a02f031842b39de38e65ca5b745b2f73aeeea0

SHA512
526ecca1f7f71fefb968ac9c2d7063b852cb7bc0d56b3794f62d7d7057b17f4bfa3044cd84bc6a7ded76b9af8db731be5d272aecfce344c311310c4a6ac023a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1613759.exe

Filesize
11KB

MD5
156146d82dcc5dd050a5f3e1fda1627b

SHA1
3528e1d56b2c3f44f00a3866eccee4d0f83f3147

SHA256
797716cd799c196bdb354d1466c57a01f543ab98300af711f0ece92207be3a60

SHA512
dd12ba0be6a2697fd68aae5baea9d0f37b1aab3cbd378e5aac2769c3c36eda4973544353eac453a4c20b38c981e971b7fca49dfde9361fd2e29f7e9b0776d86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7894235.exe

Filesize
338KB

MD5
b56156c57f48d2574e645b8f428213f6

SHA1
9631a543f9d55504818d9f56f555c17d0a568db2

SHA256
2c9ee508f56ee427de7136b0e3bda08066109d6e55c7d3be36c4eac452e20e45

SHA512
f46fc0f3ee322737a32658fb5dc1e9c289f8270ea3ecf67ab6b6c177e2b6114f2ca193e13037aeb3be09daaf3dc9e194afa6e924dbbf6d45c93b33990e910660

Download Submit
memory/1160-28-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/4476-45-0x00000000000D0000-0x0000000000100000-memory.dmp

Filesize
192KB

Download
memory/4476-46-0x00000000023C0000-0x00000000023C6000-memory.dmp

Filesize
24KB

Download
memory/4476-47-0x00000000050C0000-0x00000000056D8000-memory.dmp

Filesize
6.1MB

Download
memory/4476-48-0x0000000004BB0000-0x0000000004CBA000-memory.dmp

Filesize
1.0MB

Download
memory/4476-49-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4476-50-0x0000000004AE0000-0x0000000004B1C000-memory.dmp

Filesize
240KB

Download
memory/4476-51-0x0000000004B20000-0x0000000004B6C000-memory.dmp

Filesize
304KB

Download