amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe
Size

430KB
MD5

0f6e4957b21205acdba137d49309cbe0
SHA1

9ebf7a5cf45f9171f36df9f46038512e6856a7b3
SHA256

7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015
SHA512

52047a008295322c22a308772256b16221ed2c8556b8e85bfffb275a9a00879cb81b092f9652037d9e79e79bec64881fbc8d8630e9260bc9e664e4e713e459ca
SSDEEP

12288:AMrey901WT4iQGvoin9GqfDfJoTBLrt4zC8Z:uy+QgG7b7xogew

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral12/memory/2240-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe	family_redline
behavioral12/memory/3504-31-0x0000000000200000-0x0000000000230000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

r9555951.exeexplonde.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	r9555951.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 8 IoCs

Processes:

z6580387.exeq5344718.exer9555951.exeexplonde.exes4529838.exeexplonde.exeexplonde.exeexplonde.exe

pid process

2008 z6580387.exe
1240 q5344718.exe
5012 r9555951.exe
4688 explonde.exe
3504 s4529838.exe
408 explonde.exe
1928 explonde.exe
4684 explonde.exe

pid	process
2008	z6580387.exe
1240	q5344718.exe
5012	r9555951.exe
4688	explonde.exe
3504	s4529838.exe
408	explonde.exe
1928	explonde.exe
4684	explonde.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z6580387.exe7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6580387.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q5344718.exe

description pid process target process

PID 1240 set thread context of 2240 1240 q5344718.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2724 1240 WerFault.exe q5344718.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

412 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2240 AppLaunch.exe
2240 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2240 AppLaunch.exe

description	pid	process	target process
PID 1240 set thread context of 2240	1240	q5344718.exe	AppLaunch.exe

pid	pid_target	process	target process
2724	1240	WerFault.exe	q5344718.exe

pid	process
412	schtasks.exe

pid	process
2240	AppLaunch.exe
2240	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2240	AppLaunch.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exez6580387.exeq5344718.exer9555951.exeexplonde.execmd.exe

description	pid	process	target process
PID 4308 wrote to memory of 2008	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	z6580387.exe
PID 4308 wrote to memory of 2008	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	z6580387.exe
PID 4308 wrote to memory of 2008	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	z6580387.exe
PID 2008 wrote to memory of 1240	2008	z6580387.exe	q5344718.exe
PID 2008 wrote to memory of 1240	2008	z6580387.exe	q5344718.exe
PID 2008 wrote to memory of 1240	2008	z6580387.exe	q5344718.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 1240 wrote to memory of 2240	1240	q5344718.exe	AppLaunch.exe
PID 2008 wrote to memory of 5012	2008	z6580387.exe	r9555951.exe
PID 2008 wrote to memory of 5012	2008	z6580387.exe	r9555951.exe
PID 2008 wrote to memory of 5012	2008	z6580387.exe	r9555951.exe
PID 5012 wrote to memory of 4688	5012	r9555951.exe	explonde.exe
PID 5012 wrote to memory of 4688	5012	r9555951.exe	explonde.exe
PID 5012 wrote to memory of 4688	5012	r9555951.exe	explonde.exe
PID 4308 wrote to memory of 3504	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	s4529838.exe
PID 4308 wrote to memory of 3504	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	s4529838.exe
PID 4308 wrote to memory of 3504	4308	7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe	s4529838.exe
PID 4688 wrote to memory of 412	4688	explonde.exe	schtasks.exe
PID 4688 wrote to memory of 412	4688	explonde.exe	schtasks.exe
PID 4688 wrote to memory of 412	4688	explonde.exe	schtasks.exe
PID 4688 wrote to memory of 3948	4688	explonde.exe	cmd.exe
PID 4688 wrote to memory of 3948	4688	explonde.exe	cmd.exe
PID 4688 wrote to memory of 3948	4688	explonde.exe	cmd.exe
PID 3948 wrote to memory of 1204	3948	cmd.exe	cmd.exe
PID 3948 wrote to memory of 1204	3948	cmd.exe	cmd.exe
PID 3948 wrote to memory of 1204	3948	cmd.exe	cmd.exe
PID 3948 wrote to memory of 2140	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 2140	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 2140	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 1924	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 1924	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 1924	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 4572	3948	cmd.exe	cmd.exe
PID 3948 wrote to memory of 4572	3948	cmd.exe	cmd.exe
PID 3948 wrote to memory of 4572	3948	cmd.exe	cmd.exe
PID 3948 wrote to memory of 3456	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 3456	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 3456	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 4296	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 4296	3948	cmd.exe	cacls.exe
PID 3948 wrote to memory of 4296	3948	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe
"C:\Users\Admin\AppData\Local\Temp\7974488bc67afaac8d23b7341dc9f5768ae9f7551986b8176038e4384fade015.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4308

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6580387.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6580387.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5344718.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5344718.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 136
4⤵
- Program crash
PID:2724

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9555951.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9555951.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
5⤵
- Creates scheduled task(s)
PID:412

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:1204

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:N"
6⤵
PID:2140

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:R" /E
6⤵
PID:1924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4572

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
6⤵
PID:3456

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
6⤵
PID:4296

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe
2⤵
- Executes dropped EXE
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1240 -ip 1240
1⤵
PID:4008

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:408

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s4529838.exe
Filesize
176KB

MD5
cc683d963449b3b83f2aa6dc4fbfb176

SHA1
5195000b4265797cdaca6e24d0df2dbef98cc717

SHA256
460ff67608441a0b4c581694bf0743d5297d0d856c1ef40de7326c14ac9d73c7

SHA512
1d6fe811429dee9d93239b9406bd2c7eebbfe467b090bb38c5e88856d4d005a7b2f2d752712923525c1d1c08322bab54fd4f584c8d5965991fdd77e4bcc7556a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6580387.exe
Filesize
274KB

MD5
03087956a7024912c0d42180d390a61d

SHA1
6a21397671af467892382fed6c7f5ad3cfe7347a

SHA256
6065bda34586254df44b8a27840dc06d78e34904c5af3fcc6c2f83735cf8a34b

SHA512
243c23214ff26dfbcb12b6478813f0cecc9ff8d7e827281892b1ae7f92dd478935c3770999ac341fa6f0338fa9905646f08b04bfc20045b11ded4a00be7ca6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5344718.exe
Filesize
135KB

MD5
6cb58f9d45e116e873c68ab5cf973df4

SHA1
21d6dc96390fa0cd9b03f0bc2d8a11d60c4512f9

SHA256
85eb4e3e6ba254ecfff7c059224ce58366e7a51584561f2c69bdcd60f2acfc50

SHA512
fdc24e7d5c408d7123b7fbf323526142a7fbd40ff9cc37ad051b429dd00cbc28bd0b606ae67c9a0f2cc8d4253bf07a27ab179636762c6560e4f2bea93660e114

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9555951.exe
Filesize
221KB

MD5
4ae3876bc59dbb56422de26e01335e6b

SHA1
2660f7fa807015ddcf6fb9640f04cf99485689b6

SHA256
9dc6c9f9b5ce3db655b62f3100978fc1a46cd239fd8d1d906f6fd3791caf68e8

SHA512
85c0d78e1ad1b3ced66321ba7cb29992e9c34ade2307549b8322cf8881548bb556f2a798c76a9c0b4c8bcf4125d62d63e6a71e49d2ca838c643316538873296a

Download Submit
memory/2240-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2240-15-0x0000000073FCE000-0x0000000073FCF000-memory.dmp

Filesize
4KB

Download
memory/3504-31-0x0000000000200000-0x0000000000230000-memory.dmp

Filesize
192KB

Download
memory/3504-32-0x00000000049E0000-0x00000000049E6000-memory.dmp

Filesize
24KB

Download
memory/3504-33-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/3504-34-0x0000000004CF0000-0x0000000004DFA000-memory.dmp

Filesize
1.0MB

Download
memory/3504-35-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/3504-36-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download
memory/3504-37-0x0000000004C30000-0x0000000004C7C000-memory.dmp

Filesize
304KB

Download