amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe
Size

705KB
MD5

d1388cb2ca131829495ce7e0da1e099d
SHA1

0e238acf0d5ea9508f95be2f29b1344845595f50
SHA256

1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8
SHA512

64ed4eea3f6203f4ef339571ed0cdd0198d530392b8a64d48d9bba8e4091c59a527d212b31cb8f26d6703fb0a87fc38d637fcd35c7109f530b1b897fc26acfc0
SSDEEP

12288:xMrvy90+1oTVjWwJxPFVSNqnoYD7FkwS9Rv9tZLaQGXI8hRA+l:ay/1oT9W4PKNqnoeGRn1aQGXdhRnl

Score

10^/10

amadey redline 59b440 mrak evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g8095685.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g8095685.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g8095685.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g8095685.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g8095685.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	g8095685.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x00070000000233f1-66.dat	family_redline
behavioral5/memory/1380-68-0x0000000000E30000-0x0000000000E60000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	saves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	h3921594.exe

Executes dropped EXE 8 IoCs

pid	Process
3124	x9266683.exe
3956	x8553548.exe
1012	g8095685.exe
528	h3921594.exe
2608	saves.exe
1380	i2177399.exe
1896	saves.exe
1032	saves.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	g8095685.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	g8095685.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9266683.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8553548.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	g8095685.exe
1012	g8095685.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1012	g8095685.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3124	4380	1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe	82
PID 4380 wrote to memory of 3124	4380	1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe	82
PID 4380 wrote to memory of 3124	4380	1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe	82
PID 3124 wrote to memory of 3956	3124	x9266683.exe	83
PID 3124 wrote to memory of 3956	3124	x9266683.exe	83
PID 3124 wrote to memory of 3956	3124	x9266683.exe	83
PID 3956 wrote to memory of 1012	3956	x8553548.exe	84
PID 3956 wrote to memory of 1012	3956	x8553548.exe	84
PID 3956 wrote to memory of 1012	3956	x8553548.exe	84
PID 3956 wrote to memory of 528	3956	x8553548.exe	89
PID 3956 wrote to memory of 528	3956	x8553548.exe	89
PID 3956 wrote to memory of 528	3956	x8553548.exe	89
PID 528 wrote to memory of 2608	528	h3921594.exe	90
PID 528 wrote to memory of 2608	528	h3921594.exe	90
PID 528 wrote to memory of 2608	528	h3921594.exe	90
PID 3124 wrote to memory of 1380	3124	x9266683.exe	91
PID 3124 wrote to memory of 1380	3124	x9266683.exe	91
PID 3124 wrote to memory of 1380	3124	x9266683.exe	91
PID 2608 wrote to memory of 5004	2608	saves.exe	92
PID 2608 wrote to memory of 5004	2608	saves.exe	92
PID 2608 wrote to memory of 5004	2608	saves.exe	92
PID 2608 wrote to memory of 1476	2608	saves.exe	94
PID 2608 wrote to memory of 1476	2608	saves.exe	94
PID 2608 wrote to memory of 1476	2608	saves.exe	94
PID 1476 wrote to memory of 652	1476	cmd.exe	96
PID 1476 wrote to memory of 652	1476	cmd.exe	96
PID 1476 wrote to memory of 652	1476	cmd.exe	96
PID 1476 wrote to memory of 3132	1476	cmd.exe	97
PID 1476 wrote to memory of 3132	1476	cmd.exe	97
PID 1476 wrote to memory of 3132	1476	cmd.exe	97
PID 1476 wrote to memory of 1048	1476	cmd.exe	98
PID 1476 wrote to memory of 1048	1476	cmd.exe	98
PID 1476 wrote to memory of 1048	1476	cmd.exe	98
PID 1476 wrote to memory of 3924	1476	cmd.exe	99
PID 1476 wrote to memory of 3924	1476	cmd.exe	99
PID 1476 wrote to memory of 3924	1476	cmd.exe	99
PID 1476 wrote to memory of 3852	1476	cmd.exe	100
PID 1476 wrote to memory of 3852	1476	cmd.exe	100
PID 1476 wrote to memory of 3852	1476	cmd.exe	100
PID 1476 wrote to memory of 5044	1476	cmd.exe	101
PID 1476 wrote to memory of 5044	1476	cmd.exe	101
PID 1476 wrote to memory of 5044	1476	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe
"C:\Users\Admin\AppData\Local\Temp\1ae5f47f1c4c38ae30421b7b2d3551cc7678aa01afe0501ade7019fa35f63be8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9266683.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9266683.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8553548.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8553548.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8095685.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8095685.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h3921594.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h3921594.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2608
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:5004
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:652
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        7⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        7⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        7⤵
        
        PID:5044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i2177399.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i2177399.exe
    3⤵
    - Executes dropped EXE
    PID:1380

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1896

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9266683.exe

Filesize
539KB

MD5
a941a46da87d6102a732b7c490bb8289

SHA1
9a54716c3dbcae560eebe65b9091e4c57d6d30c1

SHA256
8a967f9a1a179b6c61251386e77a0182da62aa2f384ffabf71bc172b7774b122

SHA512
7f97bd084870f6a30ad797bf88bec5a5a5edcead854e67d27dc119e4fc31ef8ed0de105c0b7b9218bb3534b6d05a669fc4ad9d4b51538058b281e0d636824fc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i2177399.exe

Filesize
173KB

MD5
561fa141d9ef0a046f46f8f30d7b9bbb

SHA1
270eb0fe9abcdb86d9f3ede94614190ba76dd025

SHA256
add28a3659047629bf52e5318dbeda9ba2e4ba2db763ec4b3a429b0e8752fd2d

SHA512
791c8d1d289ad321abeeef1431a7aeaeea395f90dd111bbc5199c3ef5baa7028b1b81a7bea0298acf551a7e57b16db0572175b1a6d8a527681582fca54b97293

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8553548.exe

Filesize
384KB

MD5
138419899544e92272c4bb44573705bc

SHA1
ca1ee2555a525deb290de35d195a325cf302bf47

SHA256
92ca3cd8aed9eae1b1abbe610963805bab76017df7e31653f09883a178fde7a4

SHA512
dc513803c4316ba940d1d9f1c1035f35edf377b195d94ae54cefaa20c833cac80aca3a2457877300616986c24dcbd04455265ee5fecee7092f7878dde635830d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8095685.exe

Filesize
185KB

MD5
6a1eba09d6315fab55beece7bd17e4d8

SHA1
74894a486de574c7ea626fc8cf9bf1cbd212b989

SHA256
4fa08f01bfdb4a7651eeea10c6dcb25429d354739b9687d51f0562bce918d7ef

SHA512
b855b2bd2304344ae9e6450f9521707618716c7c81eabe7d5bbfbe424143ff0901718b2958c0557c103b406c3e06326526ed94b1006cf22dd04744705ac6668d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h3921594.exe

Filesize
336KB

MD5
eee57ab41f73686b078be171aeec01f1

SHA1
dd2081b2db35fa8e48a5e2be6f649ed7643b33a2

SHA256
791f86bfa1384650d2b900e8ac855138fcecb93a39695c3936ea8e81256f0426

SHA512
082a3ad850d2d12cfa75ffc414e7f610908c1822fb616cc9d81e40178d644458eba0a74d24e72709c76ce4c5fb6d7597a715bd3da74aee35b087e81ce33b09ea

Download Submit
memory/1012-29-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-31-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-23-0x0000000002460000-0x000000000247C000-memory.dmp

Filesize
112KB

Download
memory/1012-51-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-49-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-47-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-45-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-43-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-41-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-40-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-37-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-35-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-33-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-25-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-27-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-24-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/1012-22-0x0000000004BA0000-0x0000000005144000-memory.dmp

Filesize
5.6MB

Download
memory/1012-21-0x0000000002090000-0x00000000020AE000-memory.dmp

Filesize
120KB

Download
memory/1380-68-0x0000000000E30000-0x0000000000E60000-memory.dmp

Filesize
192KB

Download
memory/1380-69-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/1380-70-0x0000000005E00000-0x0000000006418000-memory.dmp

Filesize
6.1MB

Download
memory/1380-71-0x00000000058F0000-0x00000000059FA000-memory.dmp

Filesize
1.0MB

Download
memory/1380-72-0x00000000055A0000-0x00000000055B2000-memory.dmp

Filesize
72KB

Download
memory/1380-73-0x0000000005820000-0x000000000585C000-memory.dmp

Filesize
240KB

Download
memory/1380-74-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download