amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe
Size

430KB
MD5

0f6e4957b21205acdba137d49309cbe0
SHA1

9ebf7a5cf45f9171f36df9f46038512e6856a7b3
SHA256

7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015
SHA512

52047a008295322c22a308772256b16221ed2c8556b8e85bfffb275a9a00879cb81b092f9652037d9e79e79bec64881fbc8d8630e9260bc9e664e4e713e459ca
SSDEEP

12288:AMrey901WT4iQGvoin9GqfDfJoTBLrt4zC8Z:uy+QgG7b7xogew

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral12/memory/2240-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x000700000002349b-29.dat	family_redline
behavioral12/memory/3504-31-0x0000000000200000-0x0000000000230000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	r9555951.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 8 IoCs

pid	Process
2008	z6580387.exe
1240	q5344718.exe
5012	r9555951.exe
4688	explonde.exe
3504	s4529838.exe
408	explonde.exe
1928	explonde.exe
4684	explonde.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6580387.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 2240	1240	q5344718.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	1240	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	AppLaunch.exe
2240	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	AppLaunch.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2008	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	83
PID 4308 wrote to memory of 2008	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	83
PID 4308 wrote to memory of 2008	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	83
PID 2008 wrote to memory of 1240	2008	z6580387.exe	84
PID 2008 wrote to memory of 1240	2008	z6580387.exe	84
PID 2008 wrote to memory of 1240	2008	z6580387.exe	84
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 1240 wrote to memory of 2240	1240	q5344718.exe	86
PID 2008 wrote to memory of 5012	2008	z6580387.exe	92
PID 2008 wrote to memory of 5012	2008	z6580387.exe	92
PID 2008 wrote to memory of 5012	2008	z6580387.exe	92
PID 5012 wrote to memory of 4688	5012	r9555951.exe	93
PID 5012 wrote to memory of 4688	5012	r9555951.exe	93
PID 5012 wrote to memory of 4688	5012	r9555951.exe	93
PID 4308 wrote to memory of 3504	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	94
PID 4308 wrote to memory of 3504	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	94
PID 4308 wrote to memory of 3504	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	94
PID 4688 wrote to memory of 412	4688	explonde.exe	95
PID 4688 wrote to memory of 412	4688	explonde.exe	95
PID 4688 wrote to memory of 412	4688	explonde.exe	95
PID 4688 wrote to memory of 3948	4688	explonde.exe	97
PID 4688 wrote to memory of 3948	4688	explonde.exe	97
PID 4688 wrote to memory of 3948	4688	explonde.exe	97
PID 3948 wrote to memory of 1204	3948	cmd.exe	99
PID 3948 wrote to memory of 1204	3948	cmd.exe	99
PID 3948 wrote to memory of 1204	3948	cmd.exe	99
PID 3948 wrote to memory of 2140	3948	cmd.exe	100
PID 3948 wrote to memory of 2140	3948	cmd.exe	100
PID 3948 wrote to memory of 2140	3948	cmd.exe	100
PID 3948 wrote to memory of 1924	3948	cmd.exe	101
PID 3948 wrote to memory of 1924	3948	cmd.exe	101
PID 3948 wrote to memory of 1924	3948	cmd.exe	101
PID 3948 wrote to memory of 4572	3948	cmd.exe	102
PID 3948 wrote to memory of 4572	3948	cmd.exe	102
PID 3948 wrote to memory of 4572	3948	cmd.exe	102
PID 3948 wrote to memory of 3456	3948	cmd.exe	103
PID 3948 wrote to memory of 3456	3948	cmd.exe	103
PID 3948 wrote to memory of 3456	3948	cmd.exe	103
PID 3948 wrote to memory of 4296	3948	cmd.exe	104
PID 3948 wrote to memory of 4296	3948	cmd.exe	104
PID 3948 wrote to memory of 4296	3948	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe
"C:\Users\Admin\AppData\Local\Temp\7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6580387.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6580387.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5344718.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5344718.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 136
      4⤵
      Program crash
      PID:2724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9555951.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9555951.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
      "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:412
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3948
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1204
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        6⤵
        
        PID:2140
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        6⤵
        
        PID:1924
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4572
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        6⤵
        
        PID:3456
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        6⤵
        
        PID:4296
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe
  2⤵
  - Executes dropped EXE
  PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1240 -ip 1240
1⤵
PID:4008

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:408

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe

Filesize
176KB

MD5
cc683d963449b3b83f2aa6dc4fbfb176

SHA1
5195000b4265797cdaca6e24d0df2dbef98cc717

SHA256
460ff67608441a0b4c581694bf0743d5297d0d856c1ef40de7326c14ac9d73c7

SHA512
1d6fe811429dee9d93239b9406bd2c7eebbfe467b090bb38c5e88856d4d005a7b2f2d752712923525c1d1c08322bab54fd4f584c8d5965991fdd77e4bcc7556a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6580387.exe

Filesize
274KB

MD5
03087956a7024912c0d42180d390a61d

SHA1
6a21397671af467892382fed6c7f5ad3cfe7347a

SHA256
6065bda34586254df44b8a27840dc06d78e34904c5af3fcc6c2f83735cf8a34b

SHA512
243c23214ff26dfbcb12b6478813f0cecc9ff8d7e827281892b1ae7f92dd478935c3770999ac341fa6f0338fa9905646f08b04bfc20045b11ded4a00be7ca6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5344718.exe

Filesize
135KB

MD5
6cb58f9d45e116e873c68ab5cf973df4

SHA1
21d6dc96390fa0cd9b03f0bc2d8a11d60c4512f9

SHA256
85eb4e3e6ba254ecfff7c059224ce58366e7a51584561f2c69bdcd60f2acfc50

SHA512
fdc24e7d5c408d7123b7fbf323526142a7fbd40ff9cc37ad051b429dd00cbc28bd0b606ae67c9a0f2cc8d4253bf07a27ab179636762c6560e4f2bea93660e114

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9555951.exe

Filesize
221KB

MD5
4ae3876bc59dbb56422de26e01335e6b

SHA1
2660f7fa807015ddcf6fb9640f04cf99485689b6

SHA256
9dc6c9f9b5ce3db655b62f3100978fc1a46cd239fd8d1d906f6fd3791caf68e8

SHA512
85c0d78e1ad1b3ced66321ba7cb29992e9c34ade2307549b8322cf8881548bb556f2a798c76a9c0b4c8bcf4125d62d63e6a71e49d2ca838c643316538873296a

Download Submit
memory/2240-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2240-15-0x0000000073FCE000-0x0000000073FCF000-memory.dmp

Filesize
4KB

Download
memory/3504-31-0x0000000000200000-0x0000000000230000-memory.dmp

Filesize
192KB

Download
memory/3504-32-0x00000000049E0000-0x00000000049E6000-memory.dmp

Filesize
24KB

Download
memory/3504-33-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/3504-34-0x0000000004CF0000-0x0000000004DFA000-memory.dmp

Filesize
1.0MB

Download
memory/3504-35-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/3504-36-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download
memory/3504-37-0x0000000004C30000-0x0000000004C7C000-memory.dmp

Filesize
304KB

Download