amadey | d66c5907218da0e1082f3a1318226d1c5bab6bd1ebb57b034a817b4c35495ac8

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe
Size

829KB
MD5

1b57155273f2fd6a1393db1c43bbca12
SHA1

2a83532f4c0eb909b7dd5e17ba6d96000a951c32
SHA256

b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4
SHA512

73ae095fc68b9b9dc8154d5875c4ab7e284eed5dc6b55404ed47aaccf111f3ff5c2710d91093d89ee541c16a97daa2b9d74a4635c05453584a40a5f60cf726fc
SSDEEP

12288:qMriy90KjSj6O8hnnZgzVIQINDwaeAcJSJ3q91uTuhXWqlQmsWxGd6zluo:AyjjtGzxKDDJ3q91VhXHbVlP

Score

10^/10

amadey healer redline 59b440 mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6430512.exe	healer
behavioral15/memory/3828-35-0x0000000000860000-0x000000000086A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a6430512.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6430512.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6430512.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6430512.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6430512.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6430512.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6430512.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7839432.exe	family_redline
behavioral15/memory/4952-52-0x0000000000640000-0x0000000000670000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4375828.exesaves.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	b4375828.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 10 IoCs

Processes:

v8824938.exev0465841.exev6546568.exev7878387.exea6430512.exeb4375828.exesaves.exec7839432.exesaves.exesaves.exe

pid	process
3584	v8824938.exe
4224	v0465841.exe
872	v6546568.exe
4228	v7878387.exe
3828	a6430512.exe
3068	b4375828.exe
1464	saves.exe
4952	c7839432.exe
3076	saves.exe
3252	saves.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a6430512.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6430512.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6430512.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exev8824938.exev0465841.exev6546568.exev7878387.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8824938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0465841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v6546568.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v7878387.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

880 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a6430512.exe

pid process

3828 a6430512.exe
3828 a6430512.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6430512.exe

description pid process

Token: SeDebugPrivilege 3828 a6430512.exe

pid	process
880	schtasks.exe

pid	process
3828	a6430512.exe
3828	a6430512.exe

description	pid	process
Token: SeDebugPrivilege	3828	a6430512.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exev8824938.exev0465841.exev6546568.exev7878387.exeb4375828.exesaves.execmd.exe

description	pid	process	target process
PID 3168 wrote to memory of 3584	3168	b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe	v8824938.exe
PID 3168 wrote to memory of 3584	3168	b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe	v8824938.exe
PID 3168 wrote to memory of 3584	3168	b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe	v8824938.exe
PID 3584 wrote to memory of 4224	3584	v8824938.exe	v0465841.exe
PID 3584 wrote to memory of 4224	3584	v8824938.exe	v0465841.exe
PID 3584 wrote to memory of 4224	3584	v8824938.exe	v0465841.exe
PID 4224 wrote to memory of 872	4224	v0465841.exe	v6546568.exe
PID 4224 wrote to memory of 872	4224	v0465841.exe	v6546568.exe
PID 4224 wrote to memory of 872	4224	v0465841.exe	v6546568.exe
PID 872 wrote to memory of 4228	872	v6546568.exe	v7878387.exe
PID 872 wrote to memory of 4228	872	v6546568.exe	v7878387.exe
PID 872 wrote to memory of 4228	872	v6546568.exe	v7878387.exe
PID 4228 wrote to memory of 3828	4228	v7878387.exe	a6430512.exe
PID 4228 wrote to memory of 3828	4228	v7878387.exe	a6430512.exe
PID 4228 wrote to memory of 3068	4228	v7878387.exe	b4375828.exe
PID 4228 wrote to memory of 3068	4228	v7878387.exe	b4375828.exe
PID 4228 wrote to memory of 3068	4228	v7878387.exe	b4375828.exe
PID 3068 wrote to memory of 1464	3068	b4375828.exe	saves.exe
PID 3068 wrote to memory of 1464	3068	b4375828.exe	saves.exe
PID 3068 wrote to memory of 1464	3068	b4375828.exe	saves.exe
PID 872 wrote to memory of 4952	872	v6546568.exe	c7839432.exe
PID 872 wrote to memory of 4952	872	v6546568.exe	c7839432.exe
PID 872 wrote to memory of 4952	872	v6546568.exe	c7839432.exe
PID 1464 wrote to memory of 880	1464	saves.exe	schtasks.exe
PID 1464 wrote to memory of 880	1464	saves.exe	schtasks.exe
PID 1464 wrote to memory of 880	1464	saves.exe	schtasks.exe
PID 1464 wrote to memory of 1876	1464	saves.exe	cmd.exe
PID 1464 wrote to memory of 1876	1464	saves.exe	cmd.exe
PID 1464 wrote to memory of 1876	1464	saves.exe	cmd.exe
PID 1876 wrote to memory of 2468	1876	cmd.exe	cmd.exe
PID 1876 wrote to memory of 2468	1876	cmd.exe	cmd.exe
PID 1876 wrote to memory of 2468	1876	cmd.exe	cmd.exe
PID 1876 wrote to memory of 2328	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 2328	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 2328	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 116	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 116	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 116	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 2900	1876	cmd.exe	cmd.exe
PID 1876 wrote to memory of 2900	1876	cmd.exe	cmd.exe
PID 1876 wrote to memory of 2900	1876	cmd.exe	cmd.exe
PID 1876 wrote to memory of 2360	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 2360	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 2360	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 208	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 208	1876	cmd.exe	cacls.exe
PID 1876 wrote to memory of 208	1876	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe
"C:\Users\Admin\AppData\Local\Temp\b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8824938.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8824938.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0465841.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0465841.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6546568.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6546568.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7878387.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7878387.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6430512.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6430512.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4375828.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4375828.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        8⤵
        Creates scheduled task(s)
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        9⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        9⤵
        
        PID:116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        9⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        9⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7839432.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7839432.exe
        5⤵
        Executes dropped EXE
        
        PID:4952

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3076

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8824938.exe

Filesize
723KB

MD5
d3d7eabecf7e8ef5fe41af2566519fba

SHA1
eabc5a4664e1f84a978fcaf8b553f270f77809d6

SHA256
e34476744f070775a7da38f2640c9435ab9add7c60045c90fbbc0f0426b9d039

SHA512
835479de4c41a14ada618b7313996de8f1639d00b39b348c985a35fa61f9f554fb43b5856c370b01d5050bd81ec8a15a434c193de36e1a9a55451b50acc5dd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0465841.exe

Filesize
598KB

MD5
c5fe064ae749f76325a2369425abfefa

SHA1
93a26c9464b6670e0ef1f81bba444a8a2a31f5c1

SHA256
8c6826da9ee88451c0165ed1105d417b4ea97cf9fba9323715e913bdd0bf1894

SHA512
dab34a9f036e26822b948e77a94576183f6a9655618cefdc327f5060bac5e52e671d73a63bdeb6ad8c35ce40ad1ea2fc5fb018a7c1095675c56b8ef98ca134c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6546568.exe

Filesize
432KB

MD5
e46751f9f0700d70a0613d619f2d020a

SHA1
50be502fd0347894f98b3c969395bf2bddcd4a7c

SHA256
f8f19274d0e195edff4e248fe4d5ab8f447ee1b27a12603e9efaf7ca268795a1

SHA512
39f4e16f37f6294395155258122874426b76b35602ab75049e3fc5ac337677c3aa9fbb799b3080dd41d446e2534e9b81899178df426550c3d92dba5a607d2ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7839432.exe

Filesize
174KB

MD5
6cdd184f4f7f9c10a93e69a8bfca07dd

SHA1
fbbe341cb7da7a670f31257040d1aef867855dbc

SHA256
24ed8190ab8f90491984ba8bf5575c73edb295a33cce21a0f0bcbf5ab4506903

SHA512
eb7504655b3b2d9ea4d71fbfa487023d2ea9d7093e96a8dac9cdf804494c8ebbae90254a9ddb0e40757b10cfbc2a488ad89e751b8bd5300482d0a01aef655f09

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7878387.exe

Filesize
277KB

MD5
b4cacec12b632fe9e12bdfd34294abb3

SHA1
283ee8d54f51e5bad9be8585d9563036de32c358

SHA256
be5cc0a2f14284c04a3250e4b81e1f2d2d4a44fdc50a407d61a7692bf4ab0c57

SHA512
ae87f9dd3dda7cb07001bb2e69038f4bb40ca37a63a7819b31b43bf4b33bcbb06e34ec234b1b5084841d2a211ffeaebdf7aad6ad3db439d235b3892f9171a933

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6430512.exe

Filesize
11KB

MD5
5d9d3d5a8c57cd33d3fe903e5b9bbe8d

SHA1
b2a41645a7372b04609d5948f0876da80b39cafd

SHA256
26ed711a03ced5b0e3cc1023074eaad8f7c4badee38c5d1f9d768ff3ba327248

SHA512
f123e6bfc105145f0d04b49fecc3f2ca30c89ddbf12cd36b714f5738da2e43438f4e0ac940080f62d098b6e0b8fb1593483a477978c4c6edcdf89072f99a0361

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4375828.exe

Filesize
338KB

MD5
c0bb67607efd49330358d3447d005936

SHA1
d95bfa2cf050f9c083cb58e295a570601907c236

SHA256
d42f879c387ef6ef055c08ac5354802dd6bf5a2882527f7f6cad8e86f9b22f57

SHA512
26f4b9ac6bc296022a775eab715b5f168df30367b1887d58f71f21d7fa98de0be13d9db6b2644a34813e73058279f7dd25da1e479711e289f68bf1147839e954

Download Submit
memory/3828-35-0x0000000000860000-0x000000000086A000-memory.dmp

Filesize
40KB

Download
memory/4952-52-0x0000000000640000-0x0000000000670000-memory.dmp

Filesize
192KB

Download
memory/4952-53-0x0000000004E20000-0x0000000004E26000-memory.dmp

Filesize
24KB

Download
memory/4952-54-0x0000000005580000-0x0000000005B98000-memory.dmp

Filesize
6.1MB

Download
memory/4952-55-0x0000000005090000-0x000000000519A000-memory.dmp

Filesize
1.0MB

Download
memory/4952-56-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/4952-57-0x0000000005020000-0x000000000505C000-memory.dmp

Filesize
240KB

Download
memory/4952-58-0x00000000051A0000-0x00000000051EC000-memory.dmp

Filesize
304KB

Download