Analysis
- max time kernel
93s - max time network
129s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
02/12/2022, 17:13
General
- Target c529a9e422cf754acb1800b5fd7a4ad3.exe
- Size 243KB
- Sample221202-vrfhvaca2s
- SHA256 32b669ab944868420ff7616b4ceae3cbb64dd60095d82f65dce686c03e1eebec
Malware Config
Extracted
-
amadey
-
3.50
-
62.204.41.252/nB8cWack3/index.php
Extracted
-
redline
-
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
-
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Extracted
-
redline
-
Lege
-
31.41.244.14:4694
-
auth_value
096090aaf3ba0872338140cec5689868
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Amadey credential stealer module 5 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 8 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 10 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c529a9e422cf754acb1800b5fd7a4ad3.exe"C:\Users\Admin\AppData\Local\Temp\c529a9e422cf754acb1800b5fd7a4ad3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe"C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe"C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" -Y .\XSYD.iNT4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E6212BFA-E8C6-4D6E-B1BD-323715D2D15E} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
40K.exe
40K.exe
Lege.exe
Lege.exe
linda5.exe
linda5.exe
gntuud.exe
gntuud.exe
gntuud.exe
gntuud.exe
XSYD.iNT
cred64.dll
40K.exe
Lege.exe
linda5.exe
gntuud.exe
gntuud.exe
XSYD.iNt
cred64.dll
cred64.dll
cred64.dll
cred64.dll
memory/324-71-0x0000000000340000-0x0000000000368000-memory.dmp
memory/676-114-0x0000000000400000-0x0000000000472000-memory.dmp
memory/676-113-0x00000000005EB000-0x000000000060A000-memory.dmp
memory/960-80-0x0000000000400000-0x0000000000472000-memory.dmp
memory/960-79-0x00000000005FB000-0x000000000061A000-memory.dmp
memory/960-65-0x00000000005FB000-0x000000000061A000-memory.dmp
memory/960-66-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1244-97-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1244-96-0x000000000030B000-0x000000000032A000-memory.dmp
memory/1556-92-0x00000000028F0000-0x00000000029F3000-memory.dmp
memory/1556-109-0x00000000028F0000-0x00000000029F3000-memory.dmp
memory/1556-106-0x0000000000A90000-0x0000000000B43000-memory.dmp
memory/1556-105-0x00000000002F0000-0x00000000003B7000-memory.dmp
memory/1556-91-0x00000000026E0000-0x00000000027E2000-memory.dmp
memory/1556-90-0x00000000023E0000-0x00000000025C8000-memory.dmp
memory/1736-61-0x0000000000400000-0x0000000000472000-memory.dmp
memory/1736-60-0x00000000002C0000-0x00000000002FE000-memory.dmp
memory/1736-59-0x000000000052B000-0x000000000054A000-memory.dmp
memory/1736-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp
memory/1900-77-0x0000000000360000-0x0000000000388000-memory.dmp