Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report


General Information

Sample Name:qu0t4ukLoN.exe
Original Sample Name:1df346c349b9b71b11825690be73e635.exe
Analysis ID:876163


Amadey, RedLine
Range:0 - 100


Yara detected RedLine Stealer
Yara detected Amadeys stealer DLL
Antivirus detection for dropped file
Snort IDS alert for network traffic
Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
Disable Windows Defender real time protection (registry)
Connects to many ports of the same IP (likely port scanning)
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Disable Windows Defender notifications (registry)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
.NET source code references suspicious native API functions
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Found evasive API chain checking for process token information
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider


  • System is w10x64
  • qu0t4ukLoN.exe (PID: 4908 cmdline: C:\Users\user\Desktop\qu0t4ukLoN.exe MD5: 1DF346C349B9B71B11825690BE73E635)
    • v7020033.exe (PID: 5988 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v7020033.exe MD5: A9A0FDF699EB764206C59FF3CA3FAC53)
      • v6434086.exe (PID: 2336 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v6434086.exe MD5: 4D67FD4D3D62A45215D1FBDF9CA87397)
        • a4758283.exe (PID: 6988 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\a4758283.exe MD5: 1BE37E0816A88025F557178CA7FC03C8)
          • conhost.exe (PID: 6104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • AppLaunch.exe (PID: 6072 cmdline: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)
        • b7687179.exe (PID: 3320 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\b7687179.exe MD5: 927C5B1DEF98D855184A0ED56D8A2787)
  • rundll32.exe (PID: 5760 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)
  • rundll32.exe (PID: 5116 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)
  • rundll32.exe (PID: 5296 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
{"C2 url": "", "Version": "3.83"}
{"C2 url": "", "Bot Id": "misa", "Authorization Header": "9e79529a6bdb4962f44d12b0d6d62d32"}
dump.pcapJoeSecurity_RedLineYara detected RedLine StealerJoe Security
    dump.pcapJoeSecurity_RedLine_1Yara detected RedLine StealerJoe Security
      C:\Users\user\AppData\Local\Temp\IXP002.TMP\b7687179.exeJoeSecurity_RedLineYara detected RedLine StealerJoe Security
        C:\Users\user\AppData\Local\Temp\IXP002.TMP\b7687179.exeMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
        • 0xd00:$pat14: , CommandLine:
        • 0x140e6:$v2_1: ListOfProcesses
        • 0x13e9a:$v4_3: base64str
        • 0x14b69:$v4_4: stringKey
        • 0x1269c:$v4_5: BytesToStringConverted
        • 0x113ef:$v4_6: FromBase64
        • 0x12bd4:$v4_8: procName
        • <