amadey | 9f4cee8892544b3b9090f5a7288e0a353e34bada2f75253f19bfebaefa1f0f53

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe
Size

812KB
MD5

f7e69c620af0bbd5653d5fc8405ba587
SHA1

73008bbde185403def406416c45415afe1cef642
SHA256

208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf
SHA512

07be351902a0d7ba7fffc00fa18688a052df745c669439a03da3becfded56c445085848621951b3023cc1f145620a65a761fcb41472b5a50568366ee5e900e1b
SSDEEP

24576:ryTEwKx9ELd2lTQ9TgFldOrHWzB3Ka6m:eUgLo5Q9Ttr2zBj6

Score

10^/10

amadey healer redline fb0fb8 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral5/files/0x0008000000023443-33.dat	healer
behavioral5/memory/4596-35-0x0000000000010000-0x000000000001A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q7598939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q7598939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q7598939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q7598939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q7598939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q7598939.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x000700000002343e-53.dat	family_redline
behavioral5/memory/3464-55-0x0000000000BE0000-0x0000000000C10000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	s9048188.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 11 IoCs

pid	Process
4104	z9304195.exe
1992	z3494869.exe
3060	z6971693.exe
3504	z9127346.exe
4596	q7598939.exe
1620	r4835343.exe
1480	s9048188.exe
3768	explonde.exe
3464	t4248552.exe
612	explonde.exe
5040	explonde.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q7598939.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6971693.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z9127346.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9304195.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3494869.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	q7598939.exe
4596	q7598939.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	q7598939.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4104	208	208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe	83
PID 208 wrote to memory of 4104	208	208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe	83
PID 208 wrote to memory of 4104	208	208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe	83
PID 4104 wrote to memory of 1992	4104	z9304195.exe	84
PID 4104 wrote to memory of 1992	4104	z9304195.exe	84
PID 4104 wrote to memory of 1992	4104	z9304195.exe	84
PID 1992 wrote to memory of 3060	1992	z3494869.exe	85
PID 1992 wrote to memory of 3060	1992	z3494869.exe	85
PID 1992 wrote to memory of 3060	1992	z3494869.exe	85
PID 3060 wrote to memory of 3504	3060	z6971693.exe	86
PID 3060 wrote to memory of 3504	3060	z6971693.exe	86
PID 3060 wrote to memory of 3504	3060	z6971693.exe	86
PID 3504 wrote to memory of 4596	3504	z9127346.exe	87
PID 3504 wrote to memory of 4596	3504	z9127346.exe	87
PID 3504 wrote to memory of 1620	3504	z9127346.exe	97
PID 3504 wrote to memory of 1620	3504	z9127346.exe	97
PID 3060 wrote to memory of 1480	3060	z6971693.exe	99
PID 3060 wrote to memory of 1480	3060	z6971693.exe	99
PID 3060 wrote to memory of 1480	3060	z6971693.exe	99
PID 1480 wrote to memory of 3768	1480	s9048188.exe	100
PID 1480 wrote to memory of 3768	1480	s9048188.exe	100
PID 1480 wrote to memory of 3768	1480	s9048188.exe	100
PID 1992 wrote to memory of 3464	1992	z3494869.exe	101
PID 1992 wrote to memory of 3464	1992	z3494869.exe	101
PID 1992 wrote to memory of 3464	1992	z3494869.exe	101
PID 3768 wrote to memory of 2164	3768	explonde.exe	102
PID 3768 wrote to memory of 2164	3768	explonde.exe	102
PID 3768 wrote to memory of 2164	3768	explonde.exe	102
PID 3768 wrote to memory of 3344	3768	explonde.exe	104
PID 3768 wrote to memory of 3344	3768	explonde.exe	104
PID 3768 wrote to memory of 3344	3768	explonde.exe	104
PID 3344 wrote to memory of 1880	3344	cmd.exe	106
PID 3344 wrote to memory of 1880	3344	cmd.exe	106
PID 3344 wrote to memory of 1880	3344	cmd.exe	106
PID 3344 wrote to memory of 4928	3344	cmd.exe	107
PID 3344 wrote to memory of 4928	3344	cmd.exe	107
PID 3344 wrote to memory of 4928	3344	cmd.exe	107
PID 3344 wrote to memory of 3488	3344	cmd.exe	108
PID 3344 wrote to memory of 3488	3344	cmd.exe	108
PID 3344 wrote to memory of 3488	3344	cmd.exe	108
PID 3344 wrote to memory of 3476	3344	cmd.exe	109
PID 3344 wrote to memory of 3476	3344	cmd.exe	109
PID 3344 wrote to memory of 3476	3344	cmd.exe	109
PID 3344 wrote to memory of 4332	3344	cmd.exe	110
PID 3344 wrote to memory of 4332	3344	cmd.exe	110
PID 3344 wrote to memory of 4332	3344	cmd.exe	110
PID 3344 wrote to memory of 3448	3344	cmd.exe	111
PID 3344 wrote to memory of 3448	3344	cmd.exe	111
PID 3344 wrote to memory of 3448	3344	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe
"C:\Users\Admin\AppData\Local\Temp\208bd49be44846fa019a8a4b21da09b934676de6c05e6688624fa6608f3917cf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9304195.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9304195.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3494869.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3494869.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6971693.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6971693.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9127346.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9127346.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7598939.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7598939.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4835343.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4835343.exe
        6⤵
        Executes dropped EXE
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9048188.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9048188.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        8⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        8⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4248552.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4248552.exe
      4⤵
      Executes dropped EXE
      PID:3464

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:612

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9304195.exe

Filesize
677KB

MD5
cac280b5885269da41baf8aecfb8fe6e

SHA1
24136fe18cc9499142f730cf3d0819f3de7b2bce

SHA256
da746ba29da48ff094d2cf04ad0fd4c4add09535e3d0b3fb4a5ac0a8f91e1aa2

SHA512
c44d23751c375b306e4da913864e28ff36c4a558cd5fb2a7911128faa59814ac3c767dfbd65d3415d0eac4b09420627701e7a5ab676f906ff845e18b79c9d009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3494869.exe

Filesize
494KB

MD5
fef24f4ea1a396378565f6a2b6105d3c

SHA1
75a31bcb8a4dd570175b7bacc14afbbfc5aaa203

SHA256
866e293a736918cc90086406accb3b89fc7c3e997aecb9c9b2e72f03524673a6

SHA512
c6318f99b2f269726f0bda150120636c1c124d3ac7f26cedc6d166f7f52b0482bcc53e7c452432ee501a2ad19d282102969ef7fbcd965ac862dfe7973d12e957

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4248552.exe

Filesize
175KB

MD5
f6bbf7779c82f6d6d8e0b2c11270b580

SHA1
33e3537728ef5e7f82957467e799036fca7b5ba4

SHA256
2a31288a816e86852ae7752541335a4e27b713d736aa30bd90821736a684c80f

SHA512
1b9f44c971ef48c0968e8ce943c11b6a94a5b33d77d93b89f77e3c6e8c2e0cdbbdf89d1537d40d4f16184c56002ba7d50e4d7f47d7469825f06275c8cf998ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6971693.exe

Filesize
339KB

MD5
7cdd58b5158a0182216027e21fd2607d

SHA1
c00d6dbe5e5dd5c238a5b13206915155747c4f4c

SHA256
fe4b13c65d97b1936c2302513a271a01e8ffed92f7a4fcfadf26075b6a0f4fed

SHA512
2f047fa3732359cf536e7f4f7d7860e9c019389150d3dabac237bdb6e6e2ef53ae205e81af99994c4caeab714c983815b7aad5e3d25a66ca18e8207fb173fdfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9048188.exe

Filesize
219KB

MD5
fb5501aaada20cc2c23924482b9b773f

SHA1
aca06d91bfeb9691088f1568afe65af3546ecdcc

SHA256
8b70969ea4dc2a2c7dbed4e1e655c295de173e4b0a3680062f91746a08bc6f00

SHA512
5bfa8522410c1cab99fbd1bd8967eee7bf5a741cb527d48db187206821084faa75dac099f3e053b4c7ec8db5a57ee0d3239ae8405225f4227e194ba16234d3fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9127346.exe

Filesize
157KB

MD5
04b5188b64125c0892346056e16355a0

SHA1
dc461ff33be1894432476d98c4d2c09e0459f300

SHA256
5250e9e73ab8fbd060ce2d824b021f7b796646337bf33ca75cf164f48e53282b

SHA512
169670c8c3744dbd94dc4fd9585f9a1b5d2e415d3709235912496a767bd9636b41d6c534d95b5c3eccea663db708aa7a22ffb2402daf7da9c0f6e17e79b9dcb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7598939.exe

Filesize
11KB

MD5
f53dad119013acb06f4fd3e93a724065

SHA1
f22fa1aacedb1d95a7c56b4d570b3a7a88b9f1bf

SHA256
4da084c70aac2e578fa72442175d8bcfe21e1fc04446922958c809fd783de34b

SHA512
f1b3e9229265d5b0383474a1e2d07c3caee0644ed2e7c44e97637b5a4f4313dd919a175d64b5855a0fb9785f35c68ec610295168250045b6427d45670aee0225

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4835343.exe

Filesize
36KB

MD5
8eea1af363eb4f0b7750cae836c9073d

SHA1
fcf7ded42777a83be47437dfe82cf0dfd3eb3d9b

SHA256
e0360fbf802b5009640d5f5e9df59e2026a4cfd84a794bc13d07daf910eca856

SHA512
434d2d3e3b779c75707bc6ad16bb8f1ebfb6a8689c68838b588b9ccf1d56f71c8e82874fe2758d6c41c12b99b2ee13dd4a622c1782519ba6fc2654a792346e9c

Download Submit
memory/3464-55-0x0000000000BE0000-0x0000000000C10000-memory.dmp

Filesize
192KB

Download
memory/3464-56-0x0000000002EC0000-0x0000000002EC6000-memory.dmp

Filesize
24KB

Download
memory/3464-57-0x0000000005B80000-0x0000000006198000-memory.dmp

Filesize
6.1MB

Download
memory/3464-58-0x0000000005670000-0x000000000577A000-memory.dmp

Filesize
1.0MB

Download
memory/3464-59-0x0000000005580000-0x0000000005592000-memory.dmp

Filesize
72KB

Download
memory/3464-60-0x00000000055E0000-0x000000000561C000-memory.dmp

Filesize
240KB

Download
memory/3464-61-0x0000000005620000-0x000000000566C000-memory.dmp

Filesize
304KB

Download
memory/4596-35-0x0000000000010000-0x000000000001A000-memory.dmp

Filesize
40KB

Download