amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe
Size

661KB
MD5

06107584f5a9cbaa5ae44873617a626b
SHA1

3787ed532fbbf131c175b567261349a5e9590819
SHA256

18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40
SHA512

8a7f0fc6a093a70af45db862210a70e5c2e4721acb05336234fb73e1cc74f5b52432501a79c957628dec5c7299b7fd073786d334d2e0b3d91361b5014830e300
SSDEEP

12288:YMrcy90okKUTUbNl7wArIzo+PIjDU7UWIubwEdhctQn+0i3MOLW:UybUT4ltrIztIjDUoycEdhcO+0i3MOq

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe	healer
behavioral4/memory/1672-28-0x0000000000D50000-0x0000000000D5A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

g8391775.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g8391775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g8391775.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g8391775.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe	family_redline
behavioral4/memory/4844-45-0x00000000009F0000-0x0000000000A20000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

h7851757.exeexplonde.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	h7851757.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 9 IoCs

Processes:

x1613566.exex4152165.exex1810121.exeg8391775.exeh7851757.exeexplonde.exei1098442.exeexplonde.exeexplonde.exe

pid	process
444	x1613566.exe
1004	x4152165.exe
1692	x1810121.exe
1672	g8391775.exe
3096	h7851757.exe
2256	explonde.exe
4844	i1098442.exe
1920	explonde.exe
4464	explonde.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

g8391775.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g8391775.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g8391775.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exex1613566.exex4152165.exex1810121.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1613566.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x4152165.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x1810121.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3852 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

g8391775.exe

pid process

1672 g8391775.exe
1672 g8391775.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

g8391775.exe

description pid process

Token: SeDebugPrivilege 1672 g8391775.exe

pid	process
3852	schtasks.exe

pid	process
1672	g8391775.exe
1672	g8391775.exe

description	pid	process
Token: SeDebugPrivilege	1672	g8391775.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exex1613566.exex4152165.exex1810121.exeh7851757.exeexplonde.execmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 444	1652	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe	x1613566.exe
PID 1652 wrote to memory of 444	1652	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe	x1613566.exe
PID 1652 wrote to memory of 444	1652	18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe	x1613566.exe
PID 444 wrote to memory of 1004	444	x1613566.exe	x4152165.exe
PID 444 wrote to memory of 1004	444	x1613566.exe	x4152165.exe
PID 444 wrote to memory of 1004	444	x1613566.exe	x4152165.exe
PID 1004 wrote to memory of 1692	1004	x4152165.exe	x1810121.exe
PID 1004 wrote to memory of 1692	1004	x4152165.exe	x1810121.exe
PID 1004 wrote to memory of 1692	1004	x4152165.exe	x1810121.exe
PID 1692 wrote to memory of 1672	1692	x1810121.exe	g8391775.exe
PID 1692 wrote to memory of 1672	1692	x1810121.exe	g8391775.exe
PID 1692 wrote to memory of 3096	1692	x1810121.exe	h7851757.exe
PID 1692 wrote to memory of 3096	1692	x1810121.exe	h7851757.exe
PID 1692 wrote to memory of 3096	1692	x1810121.exe	h7851757.exe
PID 3096 wrote to memory of 2256	3096	h7851757.exe	explonde.exe
PID 3096 wrote to memory of 2256	3096	h7851757.exe	explonde.exe
PID 3096 wrote to memory of 2256	3096	h7851757.exe	explonde.exe
PID 1004 wrote to memory of 4844	1004	x4152165.exe	i1098442.exe
PID 1004 wrote to memory of 4844	1004	x4152165.exe	i1098442.exe
PID 1004 wrote to memory of 4844	1004	x4152165.exe	i1098442.exe
PID 2256 wrote to memory of 3852	2256	explonde.exe	schtasks.exe
PID 2256 wrote to memory of 3852	2256	explonde.exe	schtasks.exe
PID 2256 wrote to memory of 3852	2256	explonde.exe	schtasks.exe
PID 2256 wrote to memory of 224	2256	explonde.exe	cmd.exe
PID 2256 wrote to memory of 224	2256	explonde.exe	cmd.exe
PID 2256 wrote to memory of 224	2256	explonde.exe	cmd.exe
PID 224 wrote to memory of 652	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 652	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 652	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 1576	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 1576	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 1576	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 4900	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 4900	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 4900	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 1416	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 1416	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 1416	224	cmd.exe	cmd.exe
PID 224 wrote to memory of 3868	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 3868	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 3868	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 4908	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 4908	224	cmd.exe	cacls.exe
PID 224 wrote to memory of 4908	224	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe
"C:\Users\Admin\AppData\Local\Temp\18c958ac2546c1661c9e22160d98271416eb758de547c310b4383874d4384f40.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1613566.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1613566.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4152165.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4152165.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1810121.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1810121.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7851757.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7851757.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:652
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        8⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        8⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe
      4⤵
      Executes dropped EXE
      PID:4844

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1613566.exe

Filesize
556KB

MD5
5c5df4f2a752d6002d9826da20d6fd78

SHA1
0e66996338bd3123e56e78acae81da950717469c

SHA256
fcaa7fff803c1be1872548bcaa5a2b8f71bdd6e8112a4d49e19841cd72f47e5a

SHA512
93ec9371ad0ba96fc0851d6d3ad200de9791e41c54764c2ae38a76ce01fc18eeb8b035c5a1a3ca96a47eda4e12819e62c86293ef23ef21a4c7f65e947148100b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4152165.exe

Filesize
390KB

MD5
8acb2dce99363b4da5308fa2d0160bf0

SHA1
263009c7900ffdd40dc20a15f4851c1c5faedbe9

SHA256
876e98ca52a90b1a45930f73d418b9c58f283dc01ea8ae838e396d6924e7f511

SHA512
c1dadcc345608613b958d774459148912fdeb32d60879ee582c0252748c0db6212522d4e6ea1f4ae5a4177453d5c146ac5c0980c646bb0529f280caa549d4c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1098442.exe

Filesize
175KB

MD5
04a7bb21ad08aa47d3f528a48dead7d1

SHA1
878ef1fcc5b8e8e79954ebb88f61afc593d7befe

SHA256
992fc655169c834a13aa63ea7069bfd878203c3a1eba3baced7aa1dfbdbe5fad

SHA512
d55d248dd5600707dafa43164a5727180191c87df79234f7302c1d13f5170bf193e99ebe391e16703fa37ddea0c92c281ba2aa0efbe80d8e9356e62b31b580b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1810121.exe

Filesize
234KB

MD5
84f02f639e6ffb7c4f54533f3f5e0609

SHA1
2add2d18202573912b05b51879b2c15212445f2c

SHA256
67bd7e6637854f65ff30c28413db3083d9c46e7fbfd0510fa0ff59141b675953

SHA512
850407df7ac5a7847a6a96f2245143e227390d536000beff4a4c8db147fa88290d7d916b1bf96ab4f7fe3e377e0bcca55cb98ac7db2454678ab5aabbc79da59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8391775.exe

Filesize
11KB

MD5
f2c8e3af2ba8b386a0945d85a144c855

SHA1
a017785845b85c44c281f101aafdb3644d136fd1

SHA256
44810476bce3b817f11a8fb17c5aeda7b015776e74cc871cf4c8bcdae24f6d0e

SHA512
f945d5075fa332c4243328ec3aafd72e681cc1f6f0b902054268d35ce94fd0c38b299c5b0b7f4968223bfb5d551c9bf019c9539a6c3f508350f3e9ad2530264c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7851757.exe

Filesize
219KB

MD5
fbd81c54616b9775ca8fa7c211d61b06

SHA1
263ca5b4db050946a9d3b1262dd4afc1d8ccb9df

SHA256
9a0e3fa81a70e3dd2009f4060535adbde321c9d25ef3bd232ce97ca5241cb618

SHA512
6c328dd3cd9abe0165ac56d0d9695f8cadef7a593c155e8b0390f44412f5b528b2182c2e8b9a146515a60e5426591caa9bf741851a3eb43ab452251de6b51215

Download Submit
memory/1672-28-0x0000000000D50000-0x0000000000D5A000-memory.dmp

Filesize
40KB

Download
memory/4844-45-0x00000000009F0000-0x0000000000A20000-memory.dmp

Filesize
192KB

Download
memory/4844-46-0x00000000076A0000-0x00000000076A6000-memory.dmp

Filesize
24KB

Download
memory/4844-47-0x0000000005A40000-0x0000000006058000-memory.dmp

Filesize
6.1MB

Download
memory/4844-48-0x0000000005570000-0x000000000567A000-memory.dmp

Filesize
1.0MB

Download
memory/4844-49-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/4844-50-0x0000000005500000-0x000000000553C000-memory.dmp

Filesize
240KB

Download
memory/4844-51-0x0000000005680000-0x00000000056CC000-memory.dmp

Filesize
304KB

Download