Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	808971
MD5:	33f01dc275ffa0c5989f8630eb4279b5
SHA1:	65e07e1c5d25a9d9817664a11d603dd7a5e21a6f
SHA256:	e8d4d6a87f54b65a7a04e7ccd0da266638f71e4c2b4d309eff8a5d79b48c058f
Tags:	exe
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Amadeys stealer DLL

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Snort IDS alert for network traffic

Disable Windows Defender real time protection (registry)

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Tries to load missing DLLs

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 4228 cmdline: C:\Users\user\Desktop\file.exe MD5: 33F01DC275FFA0C5989F8630EB4279B5)

gck46uD.exe (PID: 6024 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\gck46uD.exe MD5: 4C0E7D70D851B36C6338565474276043)

gDR79xP.exe (PID: 6020 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\gDR79xP.exe MD5: 57EB0A896C2D871FDCCB5F4A5765F84D)

gOk22TE.exe (PID: 6108 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\gOk22TE.exe MD5: 169FAA6C3CA7D213D20BDC00810116B8)

aWM14.exe (PID: 6100 cmdline: C:\Users\user\AppData\Local\Temp\IXP003.TMP\aWM14.exe MD5: 7E93BACBBC33E6652E147E7FE07572A0)

bRz07Kk.exe (PID: 4812 cmdline: C:\Users\user\AppData\Local\Temp\IXP003.TMP\bRz07Kk.exe MD5: DD0C9E110C68CE1FA5308979EF718F7B)

rundll32.exe (PID: 5148 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 2136 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 3112 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 732 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP003.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about 500$ on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://asec.ahnlab.com/en/41450/ https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become https://blog.talosintelligence.com/2021/08/raccoon-and-amadey-install-servhelper.html https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "193.233.20.2/Bn89hku/index.php", "Version": "3.66"}

Threatname: RedLine

{"C2 url": "193.233.20.13:4136", "Bot Id": "dubka", "Authorization Header": "e5a9421183a033f283b2f23139b471f0"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\IXP003.TMP\bRz07Kk.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\IXP003.TMP\bRz07Kk.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a438:$pat14: , CommandLine: 0x134ab:$v2_1: ListOfProcesses 0x1328a:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1281d:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
C:\Users\user\AppData\Local\Temp\IXP001.TMP\dEX81lT.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.252780522.0000000004C09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000003.250210360.00000000048F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.357708027.00000000025FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000000.277000636.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: bRz07Kk.exe PID: 4812	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: bRz07Kk.exe PID: 4812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.gOk22TE.exe.4c0bc20.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.3.gOk22TE.exe.4c0bc20.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a438:$pat14: , CommandLine: 0x134ab:$v2_1: ListOfProcesses 0x1328a:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1281d:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.gck46uD.exe.497cc20.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.gck46uD.exe.497cc20.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.3.gOk22TE.exe.4c0bc20.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.3.gOk22TE.exe.4c0bc20.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18838:$pat14: , CommandLine: 0x118ab:$v2_1: ListOfProcesses 0x1168a:$v4_3: base64str 0x12203:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c1d:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
6.0.bRz07Kk.exe.1e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.bRz07Kk.exe.1e0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a438:$pat14: , CommandLine: 0x134ab:$v2_1: ListOfProcesses 0x1328a:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1281d:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
Click to see the 3 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 193.233.20.13 - Destination IP: 192.168.2.3

Timestamp:	193.233.20.13192.168.2.34136497022043234 02/15/23-21:48:41.150000
SID:	2043234
Source Port:	4136
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 193.233.20.13

Timestamp:	192.168.2.3193.233.20.134970241362043233 02/15/23-21:48:39.233243
SID:	2043233
Source Port:	49702
Destination Port:	4136
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 193.233.20.13

Timestamp:	192.168.2.3193.233.20.134970241362043231 02/15/23-21:48:58.203132
SID:	2043231
Source Port:	49702
Destination Port:	4136
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 56%

Perma Link

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\gDR79xP.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\bRz07Kk.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\gck46uD.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\gOk22TE.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\dEX81lT.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\gDR79xP.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ckg5133.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\fcC6215.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\aWM14.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\bRz07Kk.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\gck46uD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\gOk22TE.exe	Joe Sandbox ML: detected

Source: 00000003.00000003.252780522.0000000004C09000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "193.233.20.13:4136", "Bot Id": "dubka", "Authorization Header": "e5a9421183a033f283b2f23139b471f0"}
Source: 1.3.gck46uD.exe.497cc20.0.raw.unpack	Malware Configuration Extractor: Amadey {"C2 url": "193.233.20.2/Bn89hku/index.php", "Version": "3.66"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00052F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	0_2_00052F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\gck46uD.exe	Code function: 1_2_00022F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	1_2_00022F1D
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\gDR79xP.exe	Code function: 2_2_00102F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	2_2_00102F1D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\gOk22TE.exe	Code function: 3_2_010E2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	3_2_010E2F1D

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: file.exe, gDR79xP.exe.1.dr, gck46uD.exe.0.dr, gOk22TE.exe.2.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: gck46uD.exe, 00000001.00000003.250210360.00000000048F6000.00000004.00000020.00020000.00000000.sdmp, dEX81lT.exe.1.dr
Source:	Binary string: wextract.pdbGCTL source: file.exe, gDR79xP.exe.1.dr, gck46uD.exe.0.dr, gOk22TE.exe.2.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: gOk22TE.exe, 00000003.00000003.252780522.0000000004C09000.00000004.00000020.00020000.00000000.sdmp, aWM14.exe, 00000004.00000000.253025851.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, aWM14.exe.3.dr

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Windows Analysis Report
file.exe