amadey | 9f4cee8892544b3b9090f5a7288e0a353e34bada2f75253f19bfebaefa1f0f53

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe
Size

1.1MB
MD5

491a1a616709c3545421cfe7e9a0a5fe
SHA1

6209307eb09238a51579b3edc7bfbde97c768f0d
SHA256

396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0
SHA512

87a8177818b18120384e0bc87a8c708064220015e222f15803065883749afce38e2a5c5e9af6ddcf5f3f15ff18818a10290f5cd42a19095dcf11af9d779c9491
SSDEEP

24576:sy0xoIFWVsveTG7W2KWEbrHG0+1TryyzBEPx7Ff5F4LTmmgcDAg+j:bPIFWVs2TGS2KWEbrm0QyIqPD4TQ

Score

10^/10

amadey mystic redline 59b440 mrak infostealer persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral8/files/0x0007000000023489-32.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x0007000000023486-35.dat	family_redline
behavioral8/memory/388-36-0x0000000000C20000-0x0000000000C50000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	l3899700.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	saves.exe

Executes dropped EXE 8 IoCs

pid	Process
4684	y2074372.exe
1892	y8785424.exe
1680	l3899700.exe
4676	saves.exe
2740	m4533809.exe
388	n8784361.exe
1680	saves.exe
3256	saves.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y8785424.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2074372.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3056	schtasks.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4684	4592	396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe	83
PID 4592 wrote to memory of 4684	4592	396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe	83
PID 4592 wrote to memory of 4684	4592	396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe	83
PID 4684 wrote to memory of 1892	4684	y2074372.exe	84
PID 4684 wrote to memory of 1892	4684	y2074372.exe	84
PID 4684 wrote to memory of 1892	4684	y2074372.exe	84
PID 1892 wrote to memory of 1680	1892	y8785424.exe	85
PID 1892 wrote to memory of 1680	1892	y8785424.exe	85
PID 1892 wrote to memory of 1680	1892	y8785424.exe	85
PID 1680 wrote to memory of 4676	1680	l3899700.exe	87
PID 1680 wrote to memory of 4676	1680	l3899700.exe	87
PID 1680 wrote to memory of 4676	1680	l3899700.exe	87
PID 1892 wrote to memory of 2740	1892	y8785424.exe	88
PID 1892 wrote to memory of 2740	1892	y8785424.exe	88
PID 1892 wrote to memory of 2740	1892	y8785424.exe	88
PID 4684 wrote to memory of 388	4684	y2074372.exe	89
PID 4684 wrote to memory of 388	4684	y2074372.exe	89
PID 4684 wrote to memory of 388	4684	y2074372.exe	89
PID 4676 wrote to memory of 3056	4676	saves.exe	90
PID 4676 wrote to memory of 3056	4676	saves.exe	90
PID 4676 wrote to memory of 3056	4676	saves.exe	90
PID 4676 wrote to memory of 780	4676	saves.exe	92
PID 4676 wrote to memory of 780	4676	saves.exe	92
PID 4676 wrote to memory of 780	4676	saves.exe	92
PID 780 wrote to memory of 1828	780	cmd.exe	94
PID 780 wrote to memory of 1828	780	cmd.exe	94
PID 780 wrote to memory of 1828	780	cmd.exe	94
PID 780 wrote to memory of 3960	780	cmd.exe	95
PID 780 wrote to memory of 3960	780	cmd.exe	95
PID 780 wrote to memory of 3960	780	cmd.exe	95
PID 780 wrote to memory of 5092	780	cmd.exe	96
PID 780 wrote to memory of 5092	780	cmd.exe	96
PID 780 wrote to memory of 5092	780	cmd.exe	96
PID 780 wrote to memory of 5084	780	cmd.exe	98
PID 780 wrote to memory of 5084	780	cmd.exe	98
PID 780 wrote to memory of 5084	780	cmd.exe	98
PID 780 wrote to memory of 2800	780	cmd.exe	99
PID 780 wrote to memory of 2800	780	cmd.exe	99
PID 780 wrote to memory of 2800	780	cmd.exe	99
PID 780 wrote to memory of 1072	780	cmd.exe	100
PID 780 wrote to memory of 1072	780	cmd.exe	100
PID 780 wrote to memory of 1072	780	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe
"C:\Users\Admin\AppData\Local\Temp\396631ba370acc38e6f62756cecd042fc99d8150beb80483127f81430d279ca0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2074372.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2074372.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8785424.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8785424.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3899700.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3899700.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3056
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:N"
        7⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "saves.exe" /P "Admin:R" /E
        7⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:N"
        7⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\b40d11255d" /P "Admin:R" /E
        7⤵
        
        PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4533809.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4533809.exe
      4⤵
      Executes dropped EXE
      PID:2740
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n8784361.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n8784361.exe
    3⤵
    - Executes dropped EXE
    PID:388

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
1⤵
- Executes dropped EXE
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2074372.exe

Filesize
475KB

MD5
f86647f1907c42d569b9f0ffbed99161

SHA1
251b7c5a5272d6b78b10da2851b47cf174dfc3a6

SHA256
e1e7d7c1d59065d07e4fba642299af5fb55b58b3474006c6e7bc814e3fbec2d8

SHA512
82a0d5365387cbb87059d1295c9235414dbeb9b9442c242595b073a4fae753a4f1d56059801029f6878338b1ab400ca66310ff0f5d03bfe6ef5eafa1a4e96879

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n8784361.exe

Filesize
173KB

MD5
071262ed56f897e2b659d87090755554

SHA1
e9b977339b8fcfb7163cd09dfe0ca3225d81fcd5

SHA256
9e1b48b291ec682abadcb2724de66c9ff9ba6275b33f1c390093145b76402a1b

SHA512
b14c2ff9cad5dee07e6f8662c45742a9708c19811e5fd437bb9189dc6e0b5ccb44594e8f1a03c47eebf81dc9bfa1f898816cf54774a45fc7fe76a6b44bbda9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8785424.exe

Filesize
320KB

MD5
7586ac961fc6fe8ea3fb77df78713e2b

SHA1
caeb831cb4e16c719488a160ff25b0b7bce02489

SHA256
884358d16ddaa1a81d30ee28f422753fdd28aca70c7258bd10bcf8074a2eb113

SHA512
f1b1934493227b3d67daab4016f047712611483fa7016038ff362e3bb1ba05b7b76cf55d082384d90122740b70923a87fb06c98d42cad0914cc4cd27392787f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3899700.exe

Filesize
336KB

MD5
c303d5cd4b1189cd2b31500998b22eb4

SHA1
e1fa90ea9d75e87b2a828b50bb4e4d5cdfd6d8b7

SHA256
da9da65281f19ab42e591901d772f89f3e66046152684d2fb033967d0d6cfca3

SHA512
fb50f13bf81f843fe2c2941a3b4c80677d35ce117ce89a9cee490c538690394f9835e3c08ea45322b4ebf54f31cd4296a79fc12a6df89f4d15d5ec72c4019572

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4533809.exe

Filesize
141KB

MD5
63491b31eedba73a8f01f2a5205cc933

SHA1
cbd8accb0bfe1fb9c68126f9e3de2613f89aa46b

SHA256
86b6efaa8af43464a82c8dbcd6e57f1028c69bb3e1a24f32320a18d6d3140f54

SHA512
855a44c735c32dc10db606e26d18dd2e4e2e2c42db63c1ef70a534abde85748b852accad7828ad12a8af8fc836f7d68492ecca7fb994160b3a804a6bab8841f3

Download Submit
memory/388-37-0x0000000003130000-0x0000000003136000-memory.dmp

Filesize
24KB

Download
memory/388-36-0x0000000000C20000-0x0000000000C50000-memory.dmp

Filesize
192KB

Download
memory/388-40-0x0000000003180000-0x0000000003192000-memory.dmp

Filesize
72KB

Download
memory/388-41-0x0000000005750000-0x000000000578C000-memory.dmp

Filesize
240KB

Download
memory/388-39-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/388-38-0x0000000005DF0000-0x0000000006408000-memory.dmp

Filesize
6.1MB

Download
memory/388-42-0x00000000057D0000-0x000000000581C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads