Analysis

  • max time kernel
    114s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-03-2023 12:47

General

  • Target

    014302d7d081b449b499c26f94fb69e046fd7c89b9a1d777d796dd9f73b4acac.exe

  • Size

    458KB

  • MD5

    7319cb5b297f551049ae3d839b146b28

  • SHA1

    9902ccd729028838bcfbadfca727af6f25af45e3

  • SHA256

    014302d7d081b449b499c26f94fb69e046fd7c89b9a1d777d796dd9f73b4acac

  • SHA512

    747b6ff33ebbbe6839cf5a6ff416e50f0224e5d4437b9a7814a1e45f4181c5dbc6370ec8f0a674d90e791a079095df88c3c18a789e5999482ef5822132c929b4

  • SSDEEP

    12288:QpRYQp8r2yS44YOfXqfTsAQvNKooICHciGxa7pA:Qv58r8YOfXAsHQooIQciGOA

Malware Config

Extracted

Family

redline

Botnet

well

C2

193.233.20.28:4125

Attributes
  • auth_value

    265e7373dd436339d88347c08a10b402

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\014302d7d081b449b499c26f94fb69e046fd7c89b9a1d777d796dd9f73b4acac.exe
    "C:\Users\Admin\AppData\Local\Temp\014302d7d081b449b499c26f94fb69e046fd7c89b9a1d777d796dd9f73b4acac.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4180
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4636
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5040
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:1692
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4656
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1896
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3420
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:5092
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4356
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 532
                  2⤵
                  • Program crash
                  PID:2908
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1436 -ip 1436
                1⤵
                  PID:1744
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1200
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2020

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe

                  Filesize

                  192KB

                  MD5

                  fa4870d435e242159168b9a9b26715de

                  SHA1

                  2284166d902bde49c43ed6056434fd663b1c7aad

                  SHA256

                  6fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42

                  SHA512

                  f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe

                  Filesize

                  192KB

                  MD5

                  fa4870d435e242159168b9a9b26715de

                  SHA1

                  2284166d902bde49c43ed6056434fd663b1c7aad

                  SHA256

                  6fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42

                  SHA512

                  f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe

                  Filesize

                  175KB

                  MD5

                  b3cbfcd14491f891be0baef768f2a4da

                  SHA1

                  47be5bb6f31976fad7f904f52a19a177f84e04de

                  SHA256

                  0c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f

                  SHA512

                  330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe

                  Filesize

                  175KB

                  MD5

                  b3cbfcd14491f891be0baef768f2a4da

                  SHA1

                  47be5bb6f31976fad7f904f52a19a177f84e04de

                  SHA256

                  0c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f

                  SHA512

                  330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf

                • memory/1436-183-0x0000000000400000-0x00000000004F1000-memory.dmp

                  Filesize

                  964KB

                • memory/1436-150-0x0000000000400000-0x00000000004F1000-memory.dmp

                  Filesize

                  964KB

                • memory/1436-149-0x0000000002280000-0x00000000022DF000-memory.dmp

                  Filesize

                  380KB

                • memory/4180-148-0x00000000000E0000-0x00000000000EA000-memory.dmp

                  Filesize

                  40KB

                • memory/4636-160-0x0000000004F90000-0x0000000004FA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4636-164-0x0000000006550000-0x0000000006712000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4636-166-0x0000000006C50000-0x000000000717C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4636-167-0x0000000006720000-0x0000000006796000-memory.dmp

                  Filesize

                  472KB

                • memory/4636-168-0x00000000064D0000-0x0000000006520000-memory.dmp

                  Filesize

                  320KB

                • memory/4636-169-0x0000000004F90000-0x0000000004FA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4636-163-0x00000000050E0000-0x0000000005146000-memory.dmp

                  Filesize

                  408KB

                • memory/4636-162-0x0000000005DD0000-0x0000000006374000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4636-161-0x0000000005040000-0x00000000050D2000-memory.dmp

                  Filesize

                  584KB

                • memory/4636-159-0x0000000004CD0000-0x0000000004D0C000-memory.dmp

                  Filesize

                  240KB

                • memory/4636-158-0x0000000004C70000-0x0000000004C82000-memory.dmp

                  Filesize

                  72KB

                • memory/4636-157-0x0000000004D40000-0x0000000004E4A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4636-156-0x0000000005200000-0x0000000005818000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4636-155-0x0000000000290000-0x00000000002C2000-memory.dmp

                  Filesize

                  200KB