amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe
Size

1.1MB
MD5

296963a8b99e4ba04646550244f1d6f5
SHA1

967b51348c19d16f36cda82e504359e55cdd0d1b
SHA256

01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e
SHA512

61025f0d033233a8d4a5b73adb77227237b71f79b04a5656fff7cc4c51554645e6ac12a9fb11a87304316b8f73184e1822525d88c63e209e53406a7a5a2789e5
SSDEEP

24576:0yYO7vqvACYYG7D2KgE+poyBsFzk3uuFXhCqqkeNi9o+lydEGt:DYO7v/LYGH2KgE+3izeBiF

Score

10^/10

amadey mystic redline 59b440 mrak infostealer persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023427-32.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023424-34.dat	family_redline
behavioral1/memory/4356-36-0x0000000000F60000-0x0000000000F90000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	l7030952.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 8 IoCs

pid	Process
1172	y7348515.exe
4460	y0390933.exe
4988	l7030952.exe
4444	saves.exe
3080	m4640011.exe
4356	n8180012.exe
464	saves.exe
4308	saves.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7348515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0390933.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3768	schtasks.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1172	4896	01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe	83
PID 4896 wrote to memory of 1172	4896	01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe	83
PID 4896 wrote to memory of 1172	4896	01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe	83
PID 1172 wrote to memory of 4460	1172	y7348515.exe	84
PID 1172 wrote to memory of 4460	1172	y7348515.exe	84
PID 1172 wrote to memory of 4460	1172	y7348515.exe	84
PID 4460 wrote to memory of 4988	4460	y0390933.exe	85
PID 4460 wrote to memory of 4988	4460	y0390933.exe	85
PID 4460 wrote to memory of 4988	4460	y0390933.exe	85
PID 4988 wrote to memory of 4444	4988	l7030952.exe	87
PID 4988 wrote to memory of 4444	4988	l7030952.exe	87
PID 4988 wrote to memory of 4444	4988	l7030952.exe	87
PID 4460 wrote to memory of 3080	4460	y0390933.exe	88
PID 4460 wrote to memory of 3080	4460	y0390933.exe	88
PID 4460 wrote to memory of 3080	4460	y0390933.exe	88
PID 1172 wrote to memory of 4356	1172	y7348515.exe	89
PID 1172 wrote to memory of 4356	1172	y7348515.exe	89
PID 1172 wrote to memory of 4356	1172	y7348515.exe	89
PID 4444 wrote to memory of 3768	4444	saves.exe	90
PID 4444 wrote to memory of 3768	4444	saves.exe	90
PID 4444 wrote to memory of 3768	4444	saves.exe	90
PID 4444 wrote to memory of 4696	4444	saves.exe	92
PID 4444 wrote to memory of 4696	4444	saves.exe	92
PID 4444 wrote to memory of 4696	4444	saves.exe	92
PID 4696 wrote to memory of 4620	4696	cmd.exe	94
PID 4696 wrote to memory of 4620	4696	cmd.exe	94
PID 4696 wrote to memory of 4620	4696	cmd.exe	94
PID 4696 wrote to memory of 1100	4696	cmd.exe	95
PID 4696 wrote to memory of 1100	4696	cmd.exe	95
PID 4696 wrote to memory of 1100	4696	cmd.exe	95
PID 4696 wrote to memory of 4968	4696	cmd.exe	96
PID 4696 wrote to memory of 4968	4696	cmd.exe	96
PID 4696 wrote to memory of 4968	4696	cmd.exe	96
PID 4696 wrote to memory of 3216	4696	cmd.exe	97
PID 4696 wrote to memory of 3216	4696	cmd.exe	97
PID 4696 wrote to memory of 3216	4696	cmd.exe	97
PID 4696 wrote to memory of 1020	4696	cmd.exe	98
PID 4696 wrote to memory of 1020	4696	cmd.exe	98
PID 4696 wrote to memory of 1020	4696	cmd.exe	98
PID 4696 wrote to memory of 4212	4696	cmd.exe	99
PID 4696 wrote to memory of 4212	4696	cmd.exe	99
PID 4696 wrote to memory of 4212	4696	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe
"C:\Users\Admin\AppData\Local\Temp\01f1d397eef76f3dd4c0d5121d6596a6ff410ea7e8fe3ebd913d701f9928557e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7348515.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7348515.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0390933.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0390933.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7030952.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7030952.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4444
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3768
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        7⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        7⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        7⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        7⤵
        
        PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4640011.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4640011.exe
      4⤵
      Executes dropped EXE
      PID:3080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n8180012.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n8180012.exe
    3⤵
    - Executes dropped EXE
    PID:4356

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:464

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7348515.exe

Filesize
475KB

MD5
dc67955232582423944b9084a3fe40b6

SHA1
6853067e8e1488f14b42b46bbeac762e6615a745

SHA256
6d0fa1e069825ed196530acff1740b733562e476b38cc1c06d41726306e45d84

SHA512
ce1e46b7a505716c9455caf8d0d4c25fbcfd1bd8c1ffa10ed06778eefbd29420382eb584b66f2027f39ae23447a6fc1b51248716d805b54962085db500d8cb45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n8180012.exe

Filesize
174KB

MD5
52d4f52112d66991fc6ef91eee1e90c8

SHA1
70f1c1829a4e731232683f1c89dbc00532544ae6

SHA256
9e2a8e580a7a823131e3a903449b3e3c8ee10aa8cfc9c80b8663f03a68646323

SHA512
d7637badfd207464ceaa95431807104cf259de66efb42ca9029940326d3e82e6984a93b6701a1698a39ce4aec9bed0ad48b90bcff437542ef3eab46e049065e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0390933.exe

Filesize
320KB

MD5
b5e89308f9a662f5729d4ef6ed0e0eef

SHA1
4bd7811c99a78add832672235b15d94ef8294153

SHA256
82b7da5f772b5c57b371c17c0999a01926afd6f4caf6ae69d7392486aed9cffd

SHA512
ed625b87d8216154b3d13301cace396d2da918cfacc8b4fef463339c33a6c23e61c18117bfb6636595e04b10ffc78178a84a47be3e6d254bd0a734116cc3b4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7030952.exe

Filesize
336KB

MD5
ac22e608a9fa5aed8173a4fe51695c9f

SHA1
48efdc17cf980e0f240b34d460781e44f5bd8e64

SHA256
31def241453a6f2e6c2ca631670d7d8215fd4a93fe171c0f000a7aac945b8e28

SHA512
fdf25bd3045c8de45a5398df3c79291fc1184b0f337a41e306ba190a652408ac89f609af50f5795e815267448d0e76b9909bd6b5f5b7546339bfdc6e37975504

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4640011.exe

Filesize
141KB

MD5
0580809442a840417d01eb59f983e658

SHA1
0096ae9d105a8d0b9b6b04f93a507238e8621fb9

SHA256
1d8d6828c45a5ee102229d52c764b5ae9682e4ce2da84147765087d9de48f6f2

SHA512
c5c1dd917637ba233d847adb31cecbc39e78060e9ed95aa9a6317eebadda8bd856f3317fa7193c486647ec4f42f28408e231feb6ee29f6bcfb46741a30dfe5f4

Download Submit
memory/4356-36-0x0000000000F60000-0x0000000000F90000-memory.dmp

Filesize
192KB

Download
memory/4356-37-0x0000000003290000-0x0000000003296000-memory.dmp

Filesize
24KB

Download
memory/4356-38-0x0000000006030000-0x0000000006648000-memory.dmp

Filesize
6.1MB

Download
memory/4356-39-0x0000000005B20000-0x0000000005C2A000-memory.dmp

Filesize
1.0MB

Download
memory/4356-40-0x0000000005A30000-0x0000000005A42000-memory.dmp

Filesize
72KB

Download
memory/4356-41-0x0000000005A90000-0x0000000005ACC000-memory.dmp

Filesize
240KB

Download
memory/4356-42-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads