Analysis

  • max time kernel
    112s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-02-2023 20:22

General

  • Target

    file.exe

  • Size

    704KB

  • MD5

    cf9062024ce65bc24107008c66f9b937

  • SHA1

    26557dbd46abab82bef24400ff4a7d984f10dda8

  • SHA256

    dc9d065d44fcfcecd44374624fd7f1823d3355ca0a20f19c094fec43087a7d48

  • SHA512

    2d62c1ff5b15d10ec5ce3696d5096ba7824904f48187dd75a44b97a3dad8dcfda2a73d97d9cebbc951dad95e0b0dc9840ba6d2020d3bd87ae927f9e8f61dd779

  • SSDEEP

    12288:VMrryy90e1QnB5H1ZkuJYUZpBTuct/UHxHNZaPHyEjkSwHQc5LWfsBpn+AjkruL1:Hy9QnBnG+XfGxWvyEeLKORwKVP40n

Malware Config

Extracted

Family

redline

Botnet

furka

C2

193.233.20.17:4139

Attributes
  • auth_value

    46dae41be0c00464bf56eddcc93e1bec

Extracted

Family

amadey

Version

3.67

C2

193.233.20.15/dF30Hn4m/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4748
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2228
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 1796
          4⤵
          • Program crash
          PID:4448
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
        "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2948
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3888
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4620
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "mnolyk.exe" /P "Admin:N"
              5⤵
                PID:724
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "mnolyk.exe" /P "Admin:R" /E
                5⤵
                  PID:4224
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4680
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\4f9dd6f8a7" /P "Admin:N"
                    5⤵
                      PID:3392
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\4f9dd6f8a7" /P "Admin:R" /E
                      5⤵
                        PID:3968
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:1124
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 536 -ip 536
                1⤵
                  PID:1560
                • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4604
                • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4592

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Scheduled Task

                1
                T1053

                Persistence

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Scheduled Task

                1
                T1053

                Privilege Escalation

                Scheduled Task

                1
                T1053

                Defense Evasion

                Modify Registry

                3
                T1112

                Disabling Security Tools

                2
                T1089

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  Filesize

                  239KB

                  MD5

                  0179181b2d4a5bb1346b67a4be5ef57c

                  SHA1

                  556750988b21379fd24e18b31e6cf14f36bf9e99

                  SHA256

                  0a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31

                  SHA512

                  1adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee

                • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  Filesize

                  239KB

                  MD5

                  0179181b2d4a5bb1346b67a4be5ef57c

                  SHA1

                  556750988b21379fd24e18b31e6cf14f36bf9e99

                  SHA256

                  0a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31

                  SHA512

                  1adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee

                • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  Filesize

                  239KB

                  MD5

                  0179181b2d4a5bb1346b67a4be5ef57c

                  SHA1

                  556750988b21379fd24e18b31e6cf14f36bf9e99

                  SHA256

                  0a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31

                  SHA512

                  1adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee

                • C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
                  Filesize

                  239KB

                  MD5

                  0179181b2d4a5bb1346b67a4be5ef57c

                  SHA1

                  556750988b21379fd24e18b31e6cf14f36bf9e99

                  SHA256

                  0a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31

                  SHA512

                  1adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exe
                  Filesize

                  239KB

                  MD5

                  0179181b2d4a5bb1346b67a4be5ef57c

                  SHA1

                  556750988b21379fd24e18b31e6cf14f36bf9e99

                  SHA256

                  0a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31

                  SHA512

                  1adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exe
                  Filesize

                  239KB

                  MD5

                  0179181b2d4a5bb1346b67a4be5ef57c

                  SHA1

                  556750988b21379fd24e18b31e6cf14f36bf9e99

                  SHA256

                  0a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31

                  SHA512

                  1adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exe
                  Filesize

                  516KB

                  MD5

                  21b3b14ce919ed630d24d39fd861e053

                  SHA1

                  5e185a0c2754fef6119f9770616e98db74031961

                  SHA256

                  566b37f26d27039f83b0f379f84ba96f035d56b4e49f6366b5bca1281fefd77a

                  SHA512

                  e7c40462aa5ba555dcd22ea5c772bfb7fd2abe89fe3ce8b6bd50a9c46fb290199ad449e2214b715aa59736b814f58d88c556fe4de612a4a3e531e1950bdbc190

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exe
                  Filesize

                  516KB

                  MD5

                  21b3b14ce919ed630d24d39fd861e053

                  SHA1

                  5e185a0c2754fef6119f9770616e98db74031961

                  SHA256

                  566b37f26d27039f83b0f379f84ba96f035d56b4e49f6366b5bca1281fefd77a

                  SHA512

                  e7c40462aa5ba555dcd22ea5c772bfb7fd2abe89fe3ce8b6bd50a9c46fb290199ad449e2214b715aa59736b814f58d88c556fe4de612a4a3e531e1950bdbc190

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exe
                  Filesize

                  259KB

                  MD5

                  33a52fc0c3eb218fde1b039334e5f850

                  SHA1

                  875b45e528e1c682257ba199db7f235f185a71a1

                  SHA256

                  b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6

                  SHA512

                  1bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exe
                  Filesize

                  259KB

                  MD5

                  33a52fc0c3eb218fde1b039334e5f850

                  SHA1

                  875b45e528e1c682257ba199db7f235f185a71a1

                  SHA256

                  b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6

                  SHA512

                  1bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exe
                  Filesize

                  202KB

                  MD5

                  58633c4a144d0bd5b9ff590628c487ea

                  SHA1

                  dd1a1ddc9e883d1b0201aaa6c1e5bac9fbfc8737

                  SHA256

                  ddb6db71a66e52519af72e9bbbe92b0ecf3ab91130c476c571f35fdc39f13ad3

                  SHA512

                  7f4e6a1eb02542c492c5c2eefc0df49ae5e8438e197898ee0cd8628f297d56e1b14cc2f3c3796e4f5e9e0b2a97536146461d22a55a5c9cd8035768399da7cbc0

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exe
                  Filesize

                  202KB

                  MD5

                  58633c4a144d0bd5b9ff590628c487ea

                  SHA1

                  dd1a1ddc9e883d1b0201aaa6c1e5bac9fbfc8737

                  SHA256

                  ddb6db71a66e52519af72e9bbbe92b0ecf3ab91130c476c571f35fdc39f13ad3

                  SHA512

                  7f4e6a1eb02542c492c5c2eefc0df49ae5e8438e197898ee0cd8628f297d56e1b14cc2f3c3796e4f5e9e0b2a97536146461d22a55a5c9cd8035768399da7cbc0

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exe
                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exe
                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exe
                  Filesize

                  175KB

                  MD5

                  c9c03ec2426c8416841fd7e93bb9dc3d

                  SHA1

                  fd9430cc92842d29f76a7b3169eee466f67273db

                  SHA256

                  35bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be

                  SHA512

                  75d4a52cf4dcf4f43b3537344588393fbb96f9ed0173ff2981a497bd359ffba9b7fed2ba7eb2ff04341d7fa2969cc2068edee009df6e8292938e408be41d7e5a

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exe
                  Filesize

                  175KB

                  MD5

                  c9c03ec2426c8416841fd7e93bb9dc3d

                  SHA1

                  fd9430cc92842d29f76a7b3169eee466f67273db

                  SHA256

                  35bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be

                  SHA512

                  75d4a52cf4dcf4f43b3537344588393fbb96f9ed0173ff2981a497bd359ffba9b7fed2ba7eb2ff04341d7fa2969cc2068edee009df6e8292938e408be41d7e5a

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                  Filesize

                  89KB

                  MD5

                  937b902b8ad05afb922313d2341143f4

                  SHA1

                  b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1

                  SHA256

                  f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849

                  SHA512

                  91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                  Filesize

                  89KB

                  MD5

                  937b902b8ad05afb922313d2341143f4

                  SHA1

                  b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1

                  SHA256

                  f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849

                  SHA512

                  91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

                • memory/536-159-0x0000000000000000-mapping.dmp
                • memory/536-166-0x0000000000400000-0x0000000000571000-memory.dmp
                  Filesize

                  1.4MB

                • memory/536-165-0x00000000005C3000-0x00000000005F1000-memory.dmp
                  Filesize

                  184KB

                • memory/536-164-0x0000000000400000-0x0000000000571000-memory.dmp
                  Filesize

                  1.4MB

                • memory/536-163-0x0000000002190000-0x00000000021DB000-memory.dmp
                  Filesize

                  300KB

                • memory/536-162-0x00000000005C3000-0x00000000005F1000-memory.dmp
                  Filesize

                  184KB

                • memory/724-176-0x0000000000000000-mapping.dmp
                • memory/1124-182-0x0000000000000000-mapping.dmp
                • memory/1292-135-0x0000000000000000-mapping.dmp
                • memory/2228-157-0x0000000006B90000-0x0000000006C06000-memory.dmp
                  Filesize

                  472KB

                • memory/2228-154-0x0000000006860000-0x00000000068F2000-memory.dmp
                  Filesize

                  584KB

                • memory/2228-147-0x0000000000F30000-0x0000000000F62000-memory.dmp
                  Filesize

                  200KB

                • memory/2228-158-0x0000000006C10000-0x0000000006C60000-memory.dmp
                  Filesize

                  320KB

                • memory/2228-148-0x0000000005E50000-0x0000000006468000-memory.dmp
                  Filesize

                  6.1MB

                • memory/2228-156-0x00000000079E0000-0x0000000007F0C000-memory.dmp
                  Filesize

                  5.2MB

                • memory/2228-155-0x00000000072E0000-0x00000000074A2000-memory.dmp
                  Filesize

                  1.8MB

                • memory/2228-153-0x0000000006D30000-0x00000000072D4000-memory.dmp
                  Filesize

                  5.6MB

                • memory/2228-144-0x0000000000000000-mapping.dmp
                • memory/2228-149-0x00000000059D0000-0x0000000005ADA000-memory.dmp
                  Filesize

                  1.0MB

                • memory/2228-150-0x0000000005900000-0x0000000005912000-memory.dmp
                  Filesize

                  72KB

                • memory/2228-152-0x0000000005C90000-0x0000000005CF6000-memory.dmp
                  Filesize

                  408KB

                • memory/2228-151-0x0000000005960000-0x000000000599C000-memory.dmp
                  Filesize

                  240KB

                • memory/2532-132-0x0000000000000000-mapping.dmp
                • memory/2948-173-0x0000000000000000-mapping.dmp
                • memory/3392-179-0x0000000000000000-mapping.dmp
                • memory/3564-170-0x0000000000000000-mapping.dmp
                • memory/3888-174-0x0000000000000000-mapping.dmp
                • memory/3968-180-0x0000000000000000-mapping.dmp
                • memory/4224-177-0x0000000000000000-mapping.dmp
                • memory/4620-175-0x0000000000000000-mapping.dmp
                • memory/4680-178-0x0000000000000000-mapping.dmp
                • memory/4748-138-0x0000000000000000-mapping.dmp
                • memory/4748-141-0x0000000000560000-0x000000000056A000-memory.dmp
                  Filesize

                  40KB

                • memory/4748-142-0x00007FF870630000-0x00007FF8710F1000-memory.dmp
                  Filesize

                  10.8MB

                • memory/4748-143-0x00007FF870630000-0x00007FF8710F1000-memory.dmp
                  Filesize

                  10.8MB

                • memory/4892-167-0x0000000000000000-mapping.dmp