Analysis

  • max time kernel
    159s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    13-05-2022 07:48

General

  • Target

    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe

  • Size

    312KB

  • MD5

    d5a042d15c800a5f811e993b95d64596

  • SHA1

    3ca2653f3ec0da78c094beaf3529fffc5784ef37

  • SHA256

    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

  • SHA512

    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Malware Config

Extracted

Family

amadey

Version

3.08

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

redline

Botnet

install

C2

193.233.48.13:80

Attributes
auth_value
607ed2c8bc0b557489789c04d9e91426

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload ⋅ 3 IoCs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • Blocklisted process makes network request ⋅ 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 5 IoCs
  • Checks computer location settings ⋅ 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL ⋅ 1 IoCs
  • Reads local data of messenger clients ⋅ 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles ⋅ 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 4 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 41 IoCs
  • outlook_win_path ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe
    "C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe"
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
        Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
          PID:2464
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe" /F
        Creates scheduled task(s)
        PID:4320
      • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:3624
      • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:2500
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 1508
          Program crash
          PID:740
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll, Main
        Blocklisted process makes network request
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        outlook_win_path
        PID:2172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 1108
      Program crash
      PID:1864
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2288 -ip 2288
    PID:4592
  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
    C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
    Executes dropped EXE
    PID:4832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 252
      Program crash
      PID:2024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4832 -ip 4832
    PID:3456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2500 -ip 2500
    PID:3596
  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
    C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
    Executes dropped EXE
    PID:4744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 252
      Program crash
      PID:4832
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4744 -ip 4744
    PID:1508

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • memory/2172-181-0x0000000000000000-mapping.dmp
                  • memory/2288-130-0x000000000066D000-0x000000000068B000-memory.dmp
                  • memory/2288-132-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/2288-131-0x00000000020F0000-0x0000000002128000-memory.dmp
                  • memory/2464-142-0x0000000000000000-mapping.dmp
                  • memory/2500-170-0x0000000008950000-0x0000000008B12000-memory.dmp
                  • memory/2500-163-0x0000000005E80000-0x0000000005E92000-memory.dmp
                  • memory/2500-172-0x0000000009D40000-0x0000000009D90000-memory.dmp
                  • memory/2500-171-0x0000000008B60000-0x000000000908C000-memory.dmp
                  • memory/2500-169-0x00000000086B0000-0x00000000086CE000-memory.dmp
                  • memory/2500-149-0x0000000000000000-mapping.dmp
                  • memory/2500-150-0x0000000000400000-0x00000000004F8000-memory.dmp
                  • memory/2500-168-0x00000000084D0000-0x0000000008562000-memory.dmp
                  • memory/2500-152-0x0000000000400000-0x00000000004F8000-memory.dmp
                  • memory/2500-153-0x0000000000400000-0x00000000004F8000-memory.dmp
                  • memory/2500-154-0x0000000000400000-0x00000000004F8000-memory.dmp
                  • memory/2500-155-0x0000000000761000-0x000000000078D000-memory.dmp
                  • memory/2500-156-0x0000000000890000-0x00000000008CA000-memory.dmp
                  • memory/2500-157-0x0000000000400000-0x00000000004F8000-memory.dmp
                  • memory/2500-167-0x0000000008450000-0x00000000084C6000-memory.dmp
                  • memory/2500-166-0x0000000005F30000-0x0000000005F96000-memory.dmp
                  • memory/2500-165-0x00000000078B0000-0x00000000078EC000-memory.dmp
                  • memory/2500-161-0x0000000004B40000-0x00000000050E4000-memory.dmp
                  • memory/2500-162-0x00000000057F0000-0x0000000005E08000-memory.dmp
                  • memory/2500-164-0x00000000075B0000-0x00000000076BA000-memory.dmp
                  • memory/3436-146-0x0000000000400000-0x0000000000449000-memory.dmp
                  • memory/3436-144-0x0000000000400000-0x0000000000449000-memory.dmp
                  • memory/3436-173-0x0000000000400000-0x0000000000449000-memory.dmp
                  • memory/3436-143-0x0000000000000000-mapping.dmp
                  • memory/3436-148-0x0000000000400000-0x0000000000449000-memory.dmp
                  • memory/3436-147-0x0000000000400000-0x0000000000449000-memory.dmp
                  • memory/3436-180-0x0000000000400000-0x0000000000449000-memory.dmp
                  • memory/3624-174-0x0000000000000000-mapping.dmp
                  • memory/3624-175-0x0000000000400000-0x0000000000420000-memory.dmp
                  • memory/4308-137-0x0000000000000000-mapping.dmp
                  • memory/4320-140-0x0000000000000000-mapping.dmp
                  • memory/4600-138-0x00000000004A0000-0x00000000005A0000-memory.dmp
                  • memory/4600-139-0x0000000002090000-0x00000000020C8000-memory.dmp
                  • memory/4600-133-0x0000000000000000-mapping.dmp
                  • memory/4600-141-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/4744-186-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/4744-185-0x0000000000681000-0x000000000069F000-memory.dmp
                  • memory/4832-160-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/4832-159-0x00000000005B1000-0x00000000005CF000-memory.dmp