Play interactive tourEdit tour
Windows Analysis Report We7WnoqeXe
Overview
General Information
Detection
Amadey RedLine
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Yara detected RedLine Stealer
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Amadey bot
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Uses netsh to modify the Windows network and firewall settings
Tries to detect sandboxes and other dynamic analysis tools (window names)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Creates files in the system32 config directory
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
PE file contains section with special chars
Hides threads from debuggers
Sigma detected: Suspicius Add Task From User AppData Temp
Sigma detected: Powershell Defender Exclusion
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
Modifies the windows firewall
Drops PE files to the application program directory (C:\ProgramData)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Too many similar processes found
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Modifies existing windows services
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a start menu entry (Start Menu\Programs\Startup)
Uses reg.exe to modify the Windows registry
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Deletes files inside the Windows folder
Creates files inside the system directory
PE file contains sections with non-standard names
Contains functionality to query CPU information (cpuid)
Sigma detected: Direct Autorun Keys Modification
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Entry point lies outside standard sections
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Contains functionality to launch a program with higher privileges
Contains capabilities to detect virtual machines
Contains functionality to detect virtual machines (SLDT)
Enables security privileges
Uses taskkill to terminate processes
PE / OLE file has an invalid certificate
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Classification
Process Tree |
---|
|
Malware Configuration |
---|
No configs have been found |
---|
Yara Overview |
---|
PCAP (Network Traffic) |
---|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Amadey | Yara detected Amadey bot | Joe Security |
Dropped Files |
---|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
|
Memory Dumps |
---|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Amadey | Yara detected Amadey bot | Joe Security | ||
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
MAL_Sednit_DelphiDownloader_Apr18_2 | Detects malware from Sednit Delphi Downloader report | Florian Roth |
| |
Click to see the 12 entries |
Sigma Overview |
---|
System Summary: |
---|
Sigma detected: Suspicius Add Task From User AppData Temp | Show sources |
Source: | Author: frack113: |
Sigma detected: Powershell Defender Exclusion | Show sources |
Source: | Author: Florian Roth: |