Analysis

  • max time kernel
    159s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    13-05-2022 07:48

General

  • Target

    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe

  • Size

    312KB

  • MD5

    d5a042d15c800a5f811e993b95d64596

  • SHA1

    3ca2653f3ec0da78c094beaf3529fffc5784ef37

  • SHA256

    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

  • SHA512

    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Malware Config

Extracted

Family

amadey

Version

3.08

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

redline

Botnet

install

C2

193.233.48.13:80

Attributes
  • auth_value

    607ed2c8bc0b557489789c04d9e91426

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe
    "C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
          4⤵
            PID:2464
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe" /F
          3⤵
          • Creates scheduled task(s)
          PID:4320
        • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
          "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3436
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3624
        • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
          "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2500
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 1508
            4⤵
            • Program crash
            PID:740
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • outlook_win_path
          PID:2172
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 1108
        2⤵
        • Program crash
        PID:1864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2288 -ip 2288
      1⤵
        PID:4592
      • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        1⤵
        • Executes dropped EXE
        PID:4832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 252
          2⤵
          • Program crash
          PID:2024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4832 -ip 4832
        1⤵
          PID:3456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2500 -ip 2500
          1⤵
            PID:3596
          • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
            C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
            1⤵
            • Executes dropped EXE
            PID:4744
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 252
              2⤵
              • Program crash
              PID:4832
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4744 -ip 4744
            1⤵
              PID:1508

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Credential Access

            Credentials in Files

            3
            T1081

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            Collection

            Data from Local System

            3
            T1005

            Email Collection

            1
            T1114

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
              Filesize

              312KB

              MD5

              d5a042d15c800a5f811e993b95d64596

              SHA1

              3ca2653f3ec0da78c094beaf3529fffc5784ef37

              SHA256

              99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

              SHA512

              8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

            • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
              Filesize

              312KB

              MD5

              d5a042d15c800a5f811e993b95d64596

              SHA1

              3ca2653f3ec0da78c094beaf3529fffc5784ef37

              SHA256

              99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

              SHA512

              8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

            • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
              Filesize

              312KB

              MD5

              d5a042d15c800a5f811e993b95d64596

              SHA1

              3ca2653f3ec0da78c094beaf3529fffc5784ef37

              SHA256

              99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

              SHA512

              8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

            • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
              Filesize

              312KB

              MD5

              d5a042d15c800a5f811e993b95d64596

              SHA1

              3ca2653f3ec0da78c094beaf3529fffc5784ef37

              SHA256

              99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

              SHA512

              8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

            • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
              Filesize

              312KB

              MD5

              d5a042d15c800a5f811e993b95d64596

              SHA1

              3ca2653f3ec0da78c094beaf3529fffc5784ef37

              SHA256

              99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

              SHA512

              8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

            • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
              Filesize

              312KB

              MD5

              d5a042d15c800a5f811e993b95d64596

              SHA1

              3ca2653f3ec0da78c094beaf3529fffc5784ef37

              SHA256

              99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

              SHA512

              8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

            • C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
              Filesize

              126KB

              MD5

              d4ca12f7203548519be8455bd836274f

              SHA1

              7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

              SHA256

              7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

              SHA512

              e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

            • C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
              Filesize

              126KB

              MD5

              d4ca12f7203548519be8455bd836274f

              SHA1

              7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

              SHA256

              7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

              SHA512

              e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

            • memory/2172-181-0x0000000000000000-mapping.dmp
            • memory/2288-130-0x000000000066D000-0x000000000068B000-memory.dmp
              Filesize

              120KB

            • memory/2288-132-0x0000000000400000-0x0000000000491000-memory.dmp
              Filesize

              580KB

            • memory/2288-131-0x00000000020F0000-0x0000000002128000-memory.dmp
              Filesize

              224KB

            • memory/2464-142-0x0000000000000000-mapping.dmp
            • memory/2500-170-0x0000000008950000-0x0000000008B12000-memory.dmp
              Filesize

              1.8MB

            • memory/2500-163-0x0000000005E80000-0x0000000005E92000-memory.dmp
              Filesize

              72KB

            • memory/2500-172-0x0000000009D40000-0x0000000009D90000-memory.dmp
              Filesize

              320KB

            • memory/2500-171-0x0000000008B60000-0x000000000908C000-memory.dmp
              Filesize

              5.2MB

            • memory/2500-169-0x00000000086B0000-0x00000000086CE000-memory.dmp
              Filesize

              120KB

            • memory/2500-149-0x0000000000000000-mapping.dmp
            • memory/2500-150-0x0000000000400000-0x00000000004F8000-memory.dmp
              Filesize

              992KB

            • memory/2500-168-0x00000000084D0000-0x0000000008562000-memory.dmp
              Filesize

              584KB

            • memory/2500-152-0x0000000000400000-0x00000000004F8000-memory.dmp
              Filesize

              992KB

            • memory/2500-153-0x0000000000400000-0x00000000004F8000-memory.dmp
              Filesize

              992KB

            • memory/2500-154-0x0000000000400000-0x00000000004F8000-memory.dmp
              Filesize

              992KB

            • memory/2500-155-0x0000000000761000-0x000000000078D000-memory.dmp
              Filesize

              176KB

            • memory/2500-156-0x0000000000890000-0x00000000008CA000-memory.dmp
              Filesize

              232KB

            • memory/2500-157-0x0000000000400000-0x00000000004F8000-memory.dmp
              Filesize

              992KB

            • memory/2500-167-0x0000000008450000-0x00000000084C6000-memory.dmp
              Filesize

              472KB

            • memory/2500-166-0x0000000005F30000-0x0000000005F96000-memory.dmp
              Filesize

              408KB

            • memory/2500-165-0x00000000078B0000-0x00000000078EC000-memory.dmp
              Filesize

              240KB

            • memory/2500-161-0x0000000004B40000-0x00000000050E4000-memory.dmp
              Filesize

              5.6MB

            • memory/2500-162-0x00000000057F0000-0x0000000005E08000-memory.dmp
              Filesize

              6.1MB

            • memory/2500-164-0x00000000075B0000-0x00000000076BA000-memory.dmp
              Filesize

              1.0MB

            • memory/3436-146-0x0000000000400000-0x0000000000449000-memory.dmp
              Filesize

              292KB

            • memory/3436-144-0x0000000000400000-0x0000000000449000-memory.dmp
              Filesize

              292KB

            • memory/3436-173-0x0000000000400000-0x0000000000449000-memory.dmp
              Filesize

              292KB

            • memory/3436-143-0x0000000000000000-mapping.dmp
            • memory/3436-148-0x0000000000400000-0x0000000000449000-memory.dmp
              Filesize

              292KB

            • memory/3436-147-0x0000000000400000-0x0000000000449000-memory.dmp
              Filesize

              292KB

            • memory/3436-180-0x0000000000400000-0x0000000000449000-memory.dmp
              Filesize

              292KB

            • memory/3624-174-0x0000000000000000-mapping.dmp
            • memory/3624-175-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/4308-137-0x0000000000000000-mapping.dmp
            • memory/4320-140-0x0000000000000000-mapping.dmp
            • memory/4600-138-0x00000000004A0000-0x00000000005A0000-memory.dmp
              Filesize

              1024KB

            • memory/4600-139-0x0000000002090000-0x00000000020C8000-memory.dmp
              Filesize

              224KB

            • memory/4600-133-0x0000000000000000-mapping.dmp
            • memory/4600-141-0x0000000000400000-0x0000000000491000-memory.dmp
              Filesize

              580KB

            • memory/4744-186-0x0000000000400000-0x0000000000491000-memory.dmp
              Filesize

              580KB

            • memory/4744-185-0x0000000000681000-0x000000000069F000-memory.dmp
              Filesize

              120KB

            • memory/4832-160-0x0000000000400000-0x0000000000491000-memory.dmp
              Filesize

              580KB

            • memory/4832-159-0x00000000005B1000-0x00000000005CF000-memory.dmp
              Filesize

              120KB