amadey | d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

General

Target

d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
Size

424KB
MD5

13e5872e9b7c47090e035dc228c5589f
SHA1

c55a9708091f19b5fc5baf7c37beb99d8d3bf760
SHA256

d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc
SHA512

260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e
SSDEEP

6144:9O1rkNbOFsBuztTfSoRgxX+j14TGYoij7aR1XPQg9TU5YGmvST3h68BoKupOdCHP:3xBuBTExX+AoLzTUKdvST/BoKupOjUz

Score

10^/10

amadey redline xmrig b90491 discovery evasion execution infostealer miner persistence spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

b90491

C2

http://o7labs.top

Attributes

install_dir
5641a448ac
install_file
Hkbsse.exe
strings_key
6ca55fed034d4e76c257fcff1c461762
url_paths
/visual/skins/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000003001\build.exe	family_redline
behavioral1/memory/3012-49-0x0000000001070000-0x00000000010DE000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1616-69-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-67-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-65-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-63-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-62-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-68-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-66-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1616-70-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 5 IoCs

Processes:

Hkbsse.exeblob.exebuild.exevxfagazdltye.exe

pid process

2392 Hkbsse.exe
2540 blob.exe
3012 build.exe
476
1848 vxfagazdltye.exe
Loads dropped DLL 5 IoCs

Processes:

d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exeHkbsse.exe

pid process

2252 d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
2392 Hkbsse.exe
2392 Hkbsse.exe
2392 Hkbsse.exe
476
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2392	Hkbsse.exe
2540	blob.exe
3012	build.exe
476
1848	vxfagazdltye.exe

pid	process
2252	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
2392	Hkbsse.exe
2392	Hkbsse.exe
2392	Hkbsse.exe
476

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1616-57-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-59-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-69-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-67-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-65-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-63-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-62-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-68-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-66-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-60-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-58-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-61-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1616-70-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Hkbsse.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\blob.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000001001\\blob.exe"	Hkbsse.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

2244 powercfg.exe
1432 powercfg.exe
2520 powercfg.exe
2776 powercfg.exe
1664 powercfg.exe
612 powercfg.exe
2952 powercfg.exe
2468 powercfg.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

vxfagazdltye.exe

description pid process target process

PID 1848 set thread context of 1616 1848 vxfagazdltye.exe conhost.exe
Drops file in Windows directory 1 IoCs

Processes:

d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

description ioc process

File created C:\Windows\Tasks\Hkbsse.job d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2824 sc.exe
1964 sc.exe
468 sc.exe
1264 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2244	powercfg.exe
1432	powercfg.exe
2520	powercfg.exe
2776	powercfg.exe
1664	powercfg.exe
612	powercfg.exe
2952	powercfg.exe
2468	powercfg.exe

description	pid	process	target process
PID 1848 set thread context of 1616	1848	vxfagazdltye.exe	conhost.exe

description	ioc	process
File created	C:\Windows\Tasks\Hkbsse.job	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

pid	process
2824	sc.exe
1964	sc.exe
468	sc.exe
1264	sc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

blob.exevxfagazdltye.exebuild.exe

pid	process
2540	blob.exe
2540	blob.exe
2540	blob.exe
2540	blob.exe
2540	blob.exe
2540	blob.exe
2540	blob.exe
2540	blob.exe
1848	vxfagazdltye.exe
1848	vxfagazdltye.exe
1848	vxfagazdltye.exe
1848	vxfagazdltye.exe
1848	vxfagazdltye.exe
3012	build.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

build.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.execonhost.exe

description	pid	process
Token: SeDebugPrivilege	3012	build.exe
Token: SeBackupPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeShutdownPrivilege	2520	powercfg.exe
Token: SeShutdownPrivilege	1664	powercfg.exe
Token: SeShutdownPrivilege	2776	powercfg.exe
Token: SeShutdownPrivilege	1432	powercfg.exe
Token: SeShutdownPrivilege	2244	powercfg.exe
Token: SeShutdownPrivilege	2952	powercfg.exe
Token: SeShutdownPrivilege	612	powercfg.exe
Token: SeShutdownPrivilege	2468	powercfg.exe
Token: SeLockMemoryPrivilege	1616	conhost.exe
Token: SeBackupPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeBackupPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe
Token: SeSecurityPrivilege	3012	build.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

pid process

2252 d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

pid	process
2252	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exeHkbsse.exevxfagazdltye.exe

description	pid	process	target process
PID 2252 wrote to memory of 2392	2252	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe	Hkbsse.exe
PID 2252 wrote to memory of 2392	2252	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe	Hkbsse.exe
PID 2252 wrote to memory of 2392	2252	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe	Hkbsse.exe
PID 2252 wrote to memory of 2392	2252	d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe	Hkbsse.exe
PID 2392 wrote to memory of 2540	2392	Hkbsse.exe	blob.exe
PID 2392 wrote to memory of 2540	2392	Hkbsse.exe	blob.exe
PID 2392 wrote to memory of 2540	2392	Hkbsse.exe	blob.exe
PID 2392 wrote to memory of 2540	2392	Hkbsse.exe	blob.exe
PID 2392 wrote to memory of 3012	2392	Hkbsse.exe	build.exe
PID 2392 wrote to memory of 3012	2392	Hkbsse.exe	build.exe
PID 2392 wrote to memory of 3012	2392	Hkbsse.exe	build.exe
PID 2392 wrote to memory of 3012	2392	Hkbsse.exe	build.exe
PID 1848 wrote to memory of 1616	1848	vxfagazdltye.exe	conhost.exe
PID 1848 wrote to memory of 1616	1848	vxfagazdltye.exe	conhost.exe
PID 1848 wrote to memory of 1616	1848	vxfagazdltye.exe	conhost.exe
PID 1848 wrote to memory of 1616	1848	vxfagazdltye.exe	conhost.exe
PID 1848 wrote to memory of 1616	1848	vxfagazdltye.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
"C:\Users\Admin\AppData\Local\Temp\d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
  "C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe
    "C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1432
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1664
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:2520
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:2776
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "YCSDKNAW"
      4⤵
      Launches sc.exe
      PID:2824
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "YCSDKNAW" binpath= "C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:1964
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1264
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "YCSDKNAW"
      4⤵
      Launches sc.exe
      PID:468
- - C:\Users\Admin\AppData\Local\Temp\1000003001\build.exe
    "C:\Users\Admin\AppData\Local\Temp\1000003001\build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3012

C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

Power Settings

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe

Filesize
2.5MB

MD5
fbfbe4ee13baecac3e7d16bec24cf079

SHA1
360caf2bb458bee7e65c316099a868b929839d25

SHA256
3d65e5f78fa228a79d279fd903b45e584effe6b680d3a3adcb582985de62d01e

SHA512
8f5d849e739430cdc560f9dbda5f2f72a07ed0493054298b0d195cf50c972e9a24effdb71cadeea6ced14663fc1268f4a0f45234f37aac334638ffcd8057b28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\build.exe

Filesize
420KB

MD5
e59cb9f032187838b2be9823757bb85a

SHA1
e42f9772116fe6bffccc64897654a87774bdd372

SHA256
77d7ec4c54e6db91a4562c59472d659c3768dda653cf396443187087a3a61b1b

SHA512
584ab75c10f71b77f3a69cb8bc412c8c5edc03cb195c70d2f3f9d32950c5a18d692e250dbc53af00125e860815815caba9776838b49a78b4fcd6a7f4447b666f

Download Submit
C:\Users\Admin\AppData\Local\Temp\691908287377

Filesize
54KB

MD5
cf524787a7cfc20f782f1cb6d02410ea

SHA1
b67c4e34207d6386c33b31437fb48ec93830a486

SHA256
a3adc81da20d19b9bbe57f5f7c38739e6cd1542bda29ab6a197f347b89bd13a6

SHA512
51802be27d4911613993355b53205f255938be8769f5187d85669e1d9a0e0b08ac95f709ca50e921b99200a91ed0d0bff1756e4deb6f4352612b804b14ddcb8c

Download Submit
\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe

Filesize
424KB

MD5
13e5872e9b7c47090e035dc228c5589f

SHA1
c55a9708091f19b5fc5baf7c37beb99d8d3bf760

SHA256
d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

SHA512
260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

Download Submit
memory/1616-68-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-63-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-70-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-57-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-59-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-64-0x0000000000040000-0x0000000000060000-memory.dmp

Filesize
128KB

Download
memory/1616-69-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-67-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-65-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-61-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-62-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-58-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-66-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1616-60-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2252-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/3012-49-0x0000000001070000-0x00000000010DE000-memory.dmp

Filesize
440KB

Download
memory/3012-50-0x00000000003C0000-0x00000000003E0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads