amadey | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe
Size

437KB
MD5

4706f66d2e76da2ba34e3bf258ffba15
SHA1

ab71090e08967118015963985f2f1df2c603f1f3
SHA256

7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e
SHA512

9ae987c7af0509c9ff0d3cef44eab0a8499f930b42a71183306a081a66fd5b128c8a3508dcad251281a7bbcf2cc0154a6be44d64bc47e80c46afd972fac58790
SSDEEP

12288:9Mrfy90uxpbCC8SLD5x/rKR6EXYp71uwXC:Ky372C8SLD5x/rKgEA1uwy

Score

10^/10

amadey redline 59b440 mrak infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral14/files/0x0007000000023433-24.dat	family_redline
behavioral14/memory/4236-26-0x0000000000B30000-0x0000000000B60000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	l0302418.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 6 IoCs

pid	Process
4708	y7464232.exe
4964	l0302418.exe
1696	saves.exe
4236	n1537617.exe
5084	saves.exe
2028	saves.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7464232.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
980	schtasks.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4708	832	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe	82
PID 832 wrote to memory of 4708	832	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe	82
PID 832 wrote to memory of 4708	832	7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe	82
PID 4708 wrote to memory of 4964	4708	y7464232.exe	83
PID 4708 wrote to memory of 4964	4708	y7464232.exe	83
PID 4708 wrote to memory of 4964	4708	y7464232.exe	83
PID 4964 wrote to memory of 1696	4964	l0302418.exe	84
PID 4964 wrote to memory of 1696	4964	l0302418.exe	84
PID 4964 wrote to memory of 1696	4964	l0302418.exe	84
PID 4708 wrote to memory of 4236	4708	y7464232.exe	85
PID 4708 wrote to memory of 4236	4708	y7464232.exe	85
PID 4708 wrote to memory of 4236	4708	y7464232.exe	85
PID 1696 wrote to memory of 980	1696	saves.exe	86
PID 1696 wrote to memory of 980	1696	saves.exe	86
PID 1696 wrote to memory of 980	1696	saves.exe	86
PID 1696 wrote to memory of 2712	1696	saves.exe	88
PID 1696 wrote to memory of 2712	1696	saves.exe	88
PID 1696 wrote to memory of 2712	1696	saves.exe	88
PID 2712 wrote to memory of 4488	2712	cmd.exe	90
PID 2712 wrote to memory of 4488	2712	cmd.exe	90
PID 2712 wrote to memory of 4488	2712	cmd.exe	90
PID 2712 wrote to memory of 4796	2712	cmd.exe	91
PID 2712 wrote to memory of 4796	2712	cmd.exe	91
PID 2712 wrote to memory of 4796	2712	cmd.exe	91
PID 2712 wrote to memory of 2068	2712	cmd.exe	92
PID 2712 wrote to memory of 2068	2712	cmd.exe	92
PID 2712 wrote to memory of 2068	2712	cmd.exe	92
PID 2712 wrote to memory of 1892	2712	cmd.exe	93
PID 2712 wrote to memory of 1892	2712	cmd.exe	93
PID 2712 wrote to memory of 1892	2712	cmd.exe	93
PID 2712 wrote to memory of 4080	2712	cmd.exe	94
PID 2712 wrote to memory of 4080	2712	cmd.exe	94
PID 2712 wrote to memory of 4080	2712	cmd.exe	94
PID 2712 wrote to memory of 2144	2712	cmd.exe	95
PID 2712 wrote to memory of 2144	2712	cmd.exe	95
PID 2712 wrote to memory of 2144	2712	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe
"C:\Users\Admin\AppData\Local\Temp\7cd3eb4cd6f49efea0958d092cf89c4360141c9e96cf89f3bd4042291e628b0e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7464232.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7464232.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0302418.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0302418.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
      "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4488
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        6⤵
        
        PID:4796
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        6⤵
        
        PID:2068
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1892
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        6⤵
        
        PID:4080
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        6⤵
        
        PID:2144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe
    3⤵
    - Executes dropped EXE
    PID:4236

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:5084

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7464232.exe

Filesize
331KB

MD5
d9c02ab5e49ebf8e926c3c5e2bb2a1db

SHA1
91d1443cef87f863912102b0f065b17fdefcb8cb

SHA256
f40e46012a6bd9dc6a10bb43082d257353b48f75d8d6d67249cb317a257d8f60

SHA512
cd3489087787918ff908fc4855f0abce3a57988afcd6228169a16460e1685328b1bebd7b7a9932bdc7ac2bc75283d1707231443707745769b41e76cd5a14264b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0302418.exe

Filesize
337KB

MD5
f9bdf1012722abca238ce17e9d37ca8f

SHA1
f2e821343120281131e50e261fc9e1b92598f2e5

SHA256
46c7c9a5925228f818e7939c25e97a59f2faccaa567022bb02d063119cddad6e

SHA512
5daf68f034c2f1d37c87de46e780054901c2702e1bb0860548f5b2e9784d0e499ca36c5f2e0d807b92ae4a9fabf60b0e5caf6d8ba712e37893aa2abe0b957639

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n1537617.exe

Filesize
174KB

MD5
3d7783a2e6e8a79bb4cbefe8f2a0a02a

SHA1
1896b81f6615b834d2fded733ea77066442fdc70

SHA256
bb95cd83473988c9644c5eba47a2b1d420519a3dafd7de4eff82661eae15b042

SHA512
a1d0f049fb92efd850d43446d266dfe7a26c0ccbafbef90e89ca08cfc6f629954a69fe6d9287e4c6cfc4f5b8d16ea1b840c644895c382fe5fd9c4daa19fa8978

Download Submit
memory/4236-26-0x0000000000B30000-0x0000000000B60000-memory.dmp

Filesize
192KB

Download
memory/4236-27-0x0000000001230000-0x0000000001236000-memory.dmp

Filesize
24KB

Download
memory/4236-28-0x0000000005C70000-0x0000000006288000-memory.dmp

Filesize
6.1MB

Download
memory/4236-29-0x0000000005760000-0x000000000586A000-memory.dmp

Filesize
1.0MB

Download
memory/4236-30-0x00000000054E0000-0x00000000054F2000-memory.dmp

Filesize
72KB

Download
memory/4236-31-0x0000000005650000-0x000000000568C000-memory.dmp

Filesize
240KB

Download
memory/4236-32-0x00000000056A0000-0x00000000056EC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads