amadey | 9b80269950e0f1b633a8f97657fa8c4843d63cc1062890797edcbbcf58625520

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe
Size

475KB
MD5

17ca9d808925fd7b581715d035aaf7b5
SHA1

1b871f421945f1c0aad57afd64a66fe6cef10ee9
SHA256

cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef
SHA512

0508071c4973158a87112e9e41f94cf65aaad40e47abac29e951ca8f05542f5c14ce99e94bb9b8a48a452c37ecb61a639e0d8399ffd1081eed2a0d30093c6b54
SSDEEP

12288:BMrIy90iEk/sDEKKA/e7lK/KRHEXYp7Tgl6zyTf:dyDUQKzG7lcKpEAsl6zOf

Score

10^/10

amadey mystic redline 59b440 mrak infostealer persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral15/files/0x000700000002341d-24.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral15/files/0x000700000002341a-27.dat	family_redline
behavioral15/memory/936-29-0x0000000000F70000-0x0000000000FA0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	l0393338.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 8 IoCs

pid	Process
4332	y7399631.exe
4472	l0393338.exe
1556	saves.exe
4912	m5041212.exe
936	n1116073.exe
3344	saves.exe
1624	saves.exe
4860	saves.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7399631.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2180	schtasks.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4332	3264	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe	83
PID 3264 wrote to memory of 4332	3264	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe	83
PID 3264 wrote to memory of 4332	3264	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe	83
PID 4332 wrote to memory of 4472	4332	y7399631.exe	84
PID 4332 wrote to memory of 4472	4332	y7399631.exe	84
PID 4332 wrote to memory of 4472	4332	y7399631.exe	84
PID 4472 wrote to memory of 1556	4472	l0393338.exe	85
PID 4472 wrote to memory of 1556	4472	l0393338.exe	85
PID 4472 wrote to memory of 1556	4472	l0393338.exe	85
PID 4332 wrote to memory of 4912	4332	y7399631.exe	86
PID 4332 wrote to memory of 4912	4332	y7399631.exe	86
PID 4332 wrote to memory of 4912	4332	y7399631.exe	86
PID 3264 wrote to memory of 936	3264	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe	87
PID 3264 wrote to memory of 936	3264	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe	87
PID 3264 wrote to memory of 936	3264	cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe	87
PID 1556 wrote to memory of 2180	1556	saves.exe	88
PID 1556 wrote to memory of 2180	1556	saves.exe	88
PID 1556 wrote to memory of 2180	1556	saves.exe	88
PID 1556 wrote to memory of 3452	1556	saves.exe	89
PID 1556 wrote to memory of 3452	1556	saves.exe	89
PID 1556 wrote to memory of 3452	1556	saves.exe	89
PID 3452 wrote to memory of 3068	3452	cmd.exe	92
PID 3452 wrote to memory of 3068	3452	cmd.exe	92
PID 3452 wrote to memory of 3068	3452	cmd.exe	92
PID 3452 wrote to memory of 4100	3452	cmd.exe	93
PID 3452 wrote to memory of 4100	3452	cmd.exe	93
PID 3452 wrote to memory of 4100	3452	cmd.exe	93
PID 3452 wrote to memory of 3304	3452	cmd.exe	94
PID 3452 wrote to memory of 3304	3452	cmd.exe	94
PID 3452 wrote to memory of 3304	3452	cmd.exe	94
PID 3452 wrote to memory of 3408	3452	cmd.exe	95
PID 3452 wrote to memory of 3408	3452	cmd.exe	95
PID 3452 wrote to memory of 3408	3452	cmd.exe	95
PID 3452 wrote to memory of 4844	3452	cmd.exe	96
PID 3452 wrote to memory of 4844	3452	cmd.exe	96
PID 3452 wrote to memory of 4844	3452	cmd.exe	96
PID 3452 wrote to memory of 2304	3452	cmd.exe	97
PID 3452 wrote to memory of 2304	3452	cmd.exe	97
PID 3452 wrote to memory of 2304	3452	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe
"C:\Users\Admin\AppData\Local\Temp\cb4c64011df6d9448d6e9f657a89d6cc8dfd2b81fc8262bccfab2f05465c39ef.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7399631.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7399631.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0393338.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0393338.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
      "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2180
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3452
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3068
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        6⤵
        
        PID:4100
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        6⤵
        
        PID:3304
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3408
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        6⤵
        
        PID:4844
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        6⤵
        
        PID:2304
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5041212.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5041212.exe
    3⤵
    - Executes dropped EXE
    PID:4912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1116073.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1116073.exe
  2⤵
  - Executes dropped EXE
  PID:936

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3344

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1116073.exe

Filesize
173KB

MD5
fca5795f3b917448ce8e266b91742a85

SHA1
d12cb90ede2655aa7569356f6a59fa0ce2bd03f3

SHA256
8c416b145f55f9babef4b1556185392b4d2bae45c769197db14bd6d938cf942f

SHA512
d97a3b1296efc0fcb79cfab41d5d215f298bee1bcbbc19000a491f885fdf2d46207912dd41773cde53bb57ad97e11b057054d6042e110517793e4998034af6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7399631.exe

Filesize
320KB

MD5
6a44b83ba6e34cf9be20a87b1aa5039f

SHA1
d0403b5f5af69b3881ed2201d642ac624ef1b56e

SHA256
5f557e7d99285a7d583b2af1a0a5be0b789e134c5863488ee2cdea85e6074d5f

SHA512
e38dedf64dfa5c75ec424cc2ded32fc8bdc7cdf2c632e19b99d070062869e03523612236259d58de24dcc73973332d8f6cf3ff404c71b19ddb1adbf228ae5ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0393338.exe

Filesize
336KB

MD5
f518edf1d12b9baaad822794251fa5e2

SHA1
8f7dacfd1d81c4d0a71b2bc0a341376ae3fed945

SHA256
7d3711d825894955188e2fd0ef5bbb82ffcb736a3d25d13cff0f8258abf0c1eb

SHA512
8338adb83d7d595105f85fff7e050e8f813786128ec36940ada766ecaa6dddf17ede27add92fa21e346343ad5a09dd5f1f646221fa3fa125cd20fc00a5f0185a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m5041212.exe

Filesize
141KB

MD5
5000ea2f46c4373c04d16e8a13538fc6

SHA1
93c7ed02846f9f5c0e27f26be3442694e98368dc

SHA256
a1deb2029c78e63c79b637317b52cc53c3f5550c53bd04e678337769f2fefb4d

SHA512
25d7a3990bc2123a44cd76d475d63e32b87ac8b51077eeed3bae033a46ba0af0cfbcf2a70654655d17fc96b9c723d2945e343f95b9664a2ffeab28da30a4b272

Download Submit
memory/936-29-0x0000000000F70000-0x0000000000FA0000-memory.dmp

Filesize
192KB

Download
memory/936-30-0x0000000007BE0000-0x0000000007BE6000-memory.dmp

Filesize
24KB

Download
memory/936-31-0x0000000005E80000-0x0000000006498000-memory.dmp

Filesize
6.1MB

Download
memory/936-32-0x00000000059B0000-0x0000000005ABA000-memory.dmp

Filesize
1.0MB

Download
memory/936-33-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/936-34-0x0000000005940000-0x000000000597C000-memory.dmp

Filesize
240KB

Download
memory/936-35-0x0000000005AC0000-0x0000000005B0C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads