amadey | 9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88

Resubmissions

11/04/2026, 02:08

260411-ckw8xahx9v10

11/04/2026, 01:00

260411-bcpy7ag13s10

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/04/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe
Size 1.3MB
Sample260411-bcpy7ag13s
SHA256 9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88
MD5 5f58c2a0d5a57ecf419a35c57f1b24aa
SHA1 03b911e243bed5699d73fef81543c883b763049a
SHA512 54ca7b466b0ab6b86d44febce4cb7d7c27fbfa7cf2a5f5ff4ad1b8d6c443dfb7ad0aae3b0bd72f26eb4be91b7cdaf86072c161b9282eaa5c57b48f32e8096ac2
SSDEEP 12288:KaNhEtQ2PBs2L0B3vxWeTzonjHAqi0mCvknQL1Jer5+npA1YPmer5+nIwaJNmoYX:KaNhE7hWUAgFA+JmDX
TLSH
T12655F213E6414AEAD7994436DF638111972AF02DA7FB2231741C02C9EE57387BF66A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

2f2805 bruno discovery dropper execution amadey healer redline infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

bruno

83.97.73.134:19071

Attributes

auth_value
b23e240c277e85ce9d49d6165c0a2b48

Extracted

Family

amadey

Version

3.84

Botnet

2f2805

http://77.91.68.63

Attributes

install_dir
200f691d32
install_file
rugen.exe
strings_key
e6ad3da56139a7f602e521090c482398
url_paths
/doma/net/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b33d-37.dat	family_amadey_v2

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/1660-20-0x0000000000650000-0x000000000065A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3856-29-0x0000000001F60000-0x0000000001F90000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 8 IoCs

pid	Process
3960	y1371827.exe
1660	k3662903.exe
3856	l4207579.exe
3700	n3186083.exe
444	rugen.exe
3988	rugen.exe
1032	rugen.exe
1628	rugen.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1371827.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2484	1660	WerFault.exe	82
2160	3856	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1371827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l4207579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n3186083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3662903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rugen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3156	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3960	4700	x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe	81
PID 3960 wrote to memory of 1660	3960	y1371827.exe	82
PID 3960 wrote to memory of 3856	3960	y1371827.exe	89
PID 4700 wrote to memory of 3700	4700	x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe	93
PID 3700 wrote to memory of 444	3700	n3186083.exe	94
PID 444 wrote to memory of 3156	444	rugen.exe	95
PID 444 wrote to memory of 4508	444	rugen.exe	97
PID 4508 wrote to memory of 1720	4508	cmd.exe	99
PID 4508 wrote to memory of 1692	4508	cmd.exe	100
PID 4508 wrote to memory of 4476	4508	cmd.exe	101
PID 4508 wrote to memory of 1980	4508	cmd.exe	103
PID 4508 wrote to memory of 220	4508	cmd.exe	104
PID 4508 wrote to memory of 4448	4508	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe
"C:\Users\Admin\AppData\Local\Temp\x9480cb89428ef50a71025b9d5949760b1e5e7ec462066b678c915964ae3b0d88.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1371827.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1371827.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3662903.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3662903.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 692
      4⤵
      Program crash
      PID:2484
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4207579.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4207579.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 676
      4⤵
      Program crash
      PID:2160
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3186083.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3186083.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
    "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "rugen.exe" /P "Admin:N"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "rugen.exe" /P "Admin:R" /E
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\200f691d32" /P "Admin:N"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:220
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\200f691d32" /P "Admin:R" /E
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1660 -ip 1660
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3856 -ip 3856
1⤵
PID:4468

C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
1⤵
- Executes dropped EXE
PID:3988

C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
1⤵
- Executes dropped EXE
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

n3186083.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3186083.exe
Size 205KB
SHA256 00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
MD5 835f1373b125353f2b0615a2f105d3dd
SHA1 1aae6edfedcfe6d6828b98b114c581d9f15db807
SHA512 8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
SSDEEP 3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj
TLSH
T14F24F7217D12C032D96161B619F5BFF2C59C6828ABB049DB7B800F77DA122F73961E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y1371827.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1371827.exe
Size 264KB
SHA256 80da2b192537b7676288de5805ae3b85b98b525d24d6bc3ae61f9544812f0294
MD5 9129572c5b8c4d07eb0eb08862312691
SHA1 b986e282897f0c78c1c768b6fd66deb507d844bf
SHA512 a5cdf9b1b4eda7e52e18c50fba00079cd54e8ca98466eb36e4b1b045f60cdebc053f2c0a89d118d293c0e2f2084021b8d63a8096f7f560e575ea66b1136d6144
SSDEEP 6144:KHy+bnr+Ip0yN90QEZ6RGHXCKncK1QciMxAMuLQZaxag:pMrYy90WKHPhxAEZax1
TLSH
T15544E003B7E95073D8B527B059F703930B36BCA1A978836B3785995E0CB2695B83137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k3662903.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3662903.exe
Size 114KB
SHA256 aaad1cc9160ca55ba47661185ae4f7d83cb60ceedc36f38c5ae66e9b008bcf1e
MD5 116238cafc734566de7904611a7ed4b6
SHA1 ae0324598b7d04d886ca6ec2336c347b6f388ada
SHA512 fed688d42adf8b4dbbbb307fce9368052493b82d7fd3907824df5dfc9d4772e1afb853d3eb177bd634a37c3a81b6f5df490404d100fce6a0e2954ecd75b2ef35
SSDEEP 1536:I5C96ecsTa3123xF2ckMkG1HMyyU/3JX4rfeWRgPxUlWRvPxx:YC9PcWlhD5syyUdyfeWRQx2WR3xx
TLSH
T103B37D1235908432CC3789F268FF8B61FF7DB5611A6093B7330846AD4F693D16BBA259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l4207579.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4207579.exe
Size 275KB
SHA256 27ed2ab01e71fe85891648d2842ae05bdd5ed3fa12756cc5846d322f8782ab54
MD5 9a774a06c7d18286544bf26afc629ed6
SHA1 ed837fdf25260c42c2d63055929714a343a765bc
SHA512 ea313ab1559064166a48c5ecc6f63d38febd3b10698260f246e4a64a35b35516344bb1b664316c52226cf979921ed9de421538bec79046838500dae388f42f97
SSDEEP 6144:EKmHpSoUOzV6H+KHaDyXbbmIRf0VysQdQb:EKoEoUqV6H+0aWLhBgzQdQb
TLSH
T1DB54063D39234572D9EB54727CFBD9DD6BAF6601A8E113F3160820FE0EC3A8415AB189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 18B
SHA256 99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094
MD5 53af239ee5d3e261545dededcb6ffd57
SHA1 04ca7e137e1e9feead96a7df45bb67d5ab3de190
SHA512 c734e4a5ff5d335a91518dbf47861bdaf8012af49371dcd2e3350e269c9a5a1cc094114d17c4f5b053f3757b4b07487ebd0d309c91ef97acf4665cc5d5c9a2d3
MD5 SHA1 SHA512

Submit Download

memory/444-54-0x0000000001090000-0x00000000010B5000-memory.dmp

Download

memory/1032-59-0x0000000000EA0000-0x0000000000EC5000-memory.dmp

Download

memory/1628-67-0x0000000000E10000-0x0000000000E35000-memory.dmp

Download

memory/1660-20-0x0000000000650000-0x000000000065A000-memory.dmp

Download

memory/1660-25-0x0000000000610000-0x0000000000635000-memory.dmp

Download

memory/3700-49-0x0000000000B30000-0x0000000000B55000-memory.dmp

Download

memory/3856-34-0x0000000000730000-0x0000000000755000-memory.dmp

Download

memory/3856-29-0x0000000001F60000-0x0000000001F90000-memory.dmp

Download

memory/3960-35-0x0000000000FB0000-0x0000000000FD5000-memory.dmp

Download

memory/3988-53-0x00000000016A0000-0x00000000016C5000-memory.dmp

Download

memory/4700-51-0x0000000000670000-0x0000000000695000-memory.dmp

Download

memory/4700-50-0x00000000023E0000-0x0000000002452000-memory.dmp

Download

memory/4700-1-0x00000000023E0000-0x0000000002452000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads