amadey | 9b80269950e0f1b633a8f97657fa8c4843d63cc1062890797edcbbcf58625520

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe
Size

540KB
MD5

e608e4390308014ed2506afc51f37aff
SHA1

76512e644442202163b9f2263e27f47419cf23a9
SHA256

a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db
SHA512

3207e41e9cd605f656c2ab67e3a1ecd6683a122997c1e2ce0c6d1d81cc386c0b35f63ccca8544666edefe5d0f62ed13f15e6e40f174f5c8165fc02ea7c258676
SSDEEP

12288:bMrWy908tzVcJEW7nALhp1z/px4WrIeZux1M0B:9yltezAtnRu3B

Score

10^/10

amadey redline 59b440 mrak evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g7009689.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g7009689.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g7009689.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g7009689.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	g7009689.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g7009689.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral11/files/0x000700000002342f-64.dat	family_redline
behavioral11/memory/4356-66-0x0000000000460000-0x0000000000490000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	h4950174.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 8 IoCs

pid	Process
3560	x9166939.exe
428	g7009689.exe
3988	h4950174.exe
856	saves.exe
4356	i4008213.exe
3200	saves.exe
4912	saves.exe
2744	saves.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	g7009689.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	g7009689.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9166939.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3896	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
428	g7009689.exe
428	g7009689.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	428	g7009689.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 3560	732	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe	82
PID 732 wrote to memory of 3560	732	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe	82
PID 732 wrote to memory of 3560	732	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe	82
PID 3560 wrote to memory of 428	3560	x9166939.exe	83
PID 3560 wrote to memory of 428	3560	x9166939.exe	83
PID 3560 wrote to memory of 428	3560	x9166939.exe	83
PID 3560 wrote to memory of 3988	3560	x9166939.exe	94
PID 3560 wrote to memory of 3988	3560	x9166939.exe	94
PID 3560 wrote to memory of 3988	3560	x9166939.exe	94
PID 3988 wrote to memory of 856	3988	h4950174.exe	95
PID 3988 wrote to memory of 856	3988	h4950174.exe	95
PID 3988 wrote to memory of 856	3988	h4950174.exe	95
PID 732 wrote to memory of 4356	732	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe	96
PID 732 wrote to memory of 4356	732	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe	96
PID 732 wrote to memory of 4356	732	a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe	96
PID 856 wrote to memory of 3896	856	saves.exe	97
PID 856 wrote to memory of 3896	856	saves.exe	97
PID 856 wrote to memory of 3896	856	saves.exe	97
PID 856 wrote to memory of 4764	856	saves.exe	99
PID 856 wrote to memory of 4764	856	saves.exe	99
PID 856 wrote to memory of 4764	856	saves.exe	99
PID 4764 wrote to memory of 3508	4764	cmd.exe	101
PID 4764 wrote to memory of 3508	4764	cmd.exe	101
PID 4764 wrote to memory of 3508	4764	cmd.exe	101
PID 4764 wrote to memory of 3088	4764	cmd.exe	102
PID 4764 wrote to memory of 3088	4764	cmd.exe	102
PID 4764 wrote to memory of 3088	4764	cmd.exe	102
PID 4764 wrote to memory of 4544	4764	cmd.exe	103
PID 4764 wrote to memory of 4544	4764	cmd.exe	103
PID 4764 wrote to memory of 4544	4764	cmd.exe	103
PID 4764 wrote to memory of 2672	4764	cmd.exe	104
PID 4764 wrote to memory of 2672	4764	cmd.exe	104
PID 4764 wrote to memory of 2672	4764	cmd.exe	104
PID 4764 wrote to memory of 5096	4764	cmd.exe	105
PID 4764 wrote to memory of 5096	4764	cmd.exe	105
PID 4764 wrote to memory of 5096	4764	cmd.exe	105
PID 4764 wrote to memory of 2348	4764	cmd.exe	106
PID 4764 wrote to memory of 2348	4764	cmd.exe	106
PID 4764 wrote to memory of 2348	4764	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe
"C:\Users\Admin\AppData\Local\Temp\a8844182255c5383be20ec415b7286551bb27f4713458001503fbb103d2c31db.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9166939.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9166939.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7009689.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7009689.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4950174.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4950174.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
      "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3896
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4764
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3508
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        6⤵
        
        PID:3088
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        6⤵
        
        PID:4544
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2672
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        6⤵
        
        PID:5096
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        6⤵
        
        PID:2348
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4008213.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4008213.exe
  2⤵
  - Executes dropped EXE
  PID:4356

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4008213.exe

Filesize
174KB

MD5
6a20737a37ee24b3b28ed46548f871e1

SHA1
615053da4812c8bf1814363bdeb7a09e6f62196c

SHA256
e080d79e5cae4f7253db965101a7709fa1130356069e10ffea740150e2ecb482

SHA512
0c9e04bec87bf7fe74306124c9ec63f56e9c0513f164653ae6725661f98586b64d73355c99c0c987b4beea0fdd7b4d48c9897a1b28045599c478cc43f251f472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9166939.exe

Filesize
384KB

MD5
8dd96d3d419e69bb26fde5ca54470add

SHA1
3dda8297ae0462ac520bd7ad085bbecc21fe2229

SHA256
5f4bf51f1afd24dc95fbe0df3839ada154901c53111431bb5ca5d769487c5e4a

SHA512
199f63676c9c98692869574d0e73dd504f8fef30ce778443ffe3ddd5af7d41877c9b6a3e66fc9c2b915b300a4eba25129b24021a68c4903bfba35784ba1fc434

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7009689.exe

Filesize
202KB

MD5
a797676be3b12d4ec8a29d6a30d63b94

SHA1
a5d18568ca0c6ae8ab6d90f7a0241166625e4f63

SHA256
520d4cbc21e534f0361fe9b7ace50f8b53e32b2eff4ebb43a256f774ddc959d7

SHA512
2aef3216429bcbbfab677c69f185331a225f1e39579cd376e20fa1f892104bd19aa7146abf15f48190fdfc03606b02f1b77a0967a99b148e21b9373a01d9d6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4950174.exe

Filesize
337KB

MD5
bc140b49ea1c3ed0cf9ee0b650d6cc1f

SHA1
b83c173a03dda654e1c9dd6f3025f88dd24e6c46

SHA256
1ca720f59d0518d8c2fd5cbf6d42a1810e09e63119afe72305be29666a4b64ef

SHA512
3044e9696780dfd3b6583c3c2b07c152970b70a161cb1714dcb65aef25741eac8d8fdf4bf6d85e6caf9189d832abd141160e954695ae6855d377b5ffc16023c3

Download Submit
memory/428-25-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-43-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-18-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/428-19-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/428-45-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-47-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-41-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-48-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/428-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-35-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-30-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-27-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-16-0x0000000004C50000-0x00000000051F4000-memory.dmp

Filesize
5.6MB

Download
memory/428-23-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-21-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-17-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/428-39-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-33-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-31-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-20-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/428-50-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/428-15-0x00000000024B0000-0x00000000024CE000-memory.dmp

Filesize
120KB

Download
memory/428-14-0x0000000073BAE000-0x0000000073BAF000-memory.dmp

Filesize
4KB

Download
memory/4356-66-0x0000000000460000-0x0000000000490000-memory.dmp

Filesize
192KB

Download
memory/4356-67-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

Filesize
24KB

Download
memory/4356-68-0x00000000053D0000-0x00000000059E8000-memory.dmp

Filesize
6.1MB

Download
memory/4356-70-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/4356-69-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

Filesize
1.0MB

Download
memory/4356-71-0x0000000004E40000-0x0000000004E7C000-memory.dmp

Filesize
240KB

Download
memory/4356-72-0x0000000004FD0000-0x000000000501C000-memory.dmp

Filesize
304KB

Download