Analysis

  • max time kernel
    125s
  • max time network
    107s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-04-2023 11:50

General

  • Target

    b2c777d0be270d4a32e006e82e8a8aab6e66d4ef5597757d41d25a9020f49045.exe

  • Size

    843KB

  • MD5

    e4582d787e98afb504e124383696c1b0

  • SHA1

    39feff4da2567308be4507aaec7624481d9e1aac

  • SHA256

    b2c777d0be270d4a32e006e82e8a8aab6e66d4ef5597757d41d25a9020f49045

  • SHA512

    d7fc88c9d6ba11d3a037a4312e6d75d0a8a8193fb8cb832c112b2399a08e69a9be2980f593401ac0e842cbdf688beb943d589d900eec49b0e2094124a227eefa

  • SSDEEP

    24576:oyTYfOKkLYOrCY9os0rXOGkZDFvGlGjNc5KVh1:vqOrCY50rXRkZDFFcU

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

C2

176.113.115.145:4125

Attributes
  • auth_value

    b9ed10946d21e28d58d0c72c535cde6f

Extracted

Family

amadey

Version

3.70

C2

77.91.124.207/plays/chapter/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2c777d0be270d4a32e006e82e8a8aab6e66d4ef5597757d41d25a9020f49045.exe
    "C:\Users\Admin\AppData\Local\Temp\b2c777d0be270d4a32e006e82e8a8aab6e66d4ef5597757d41d25a9020f49045.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un856253.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un856253.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un833972.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un833972.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr482421.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr482421.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2064
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu433680.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu433680.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643403.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643403.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si787476.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si787476.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3388
  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:5064

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si787476.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si787476.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un856253.exe
    Filesize

    660KB

    MD5

    999526c79636471791b6d60c5d675e94

    SHA1

    96ca7f88350dd6adab1a403b0faa86defff39da8

    SHA256

    795c8dff977191c351baa1aca8ba4a3def684e200a5a3c79d9bdb2950a487484

    SHA512

    2eb9fd340d291548ac21eaa17137717139c1b30279b6f6ddbf92226e5623aa4a9dede84a590d183a36f952003e209ac7a8f5bc5aaea7e55212d2408a8e45eec4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un856253.exe
    Filesize

    660KB

    MD5

    999526c79636471791b6d60c5d675e94

    SHA1

    96ca7f88350dd6adab1a403b0faa86defff39da8

    SHA256

    795c8dff977191c351baa1aca8ba4a3def684e200a5a3c79d9bdb2950a487484

    SHA512

    2eb9fd340d291548ac21eaa17137717139c1b30279b6f6ddbf92226e5623aa4a9dede84a590d183a36f952003e209ac7a8f5bc5aaea7e55212d2408a8e45eec4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643403.exe
    Filesize

    175KB

    MD5

    b2e599dec0856d70ebb2ab2327ae6442

    SHA1

    300323436b47ddafa78cb7e835deb1ab09f13698

    SHA256

    b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

    SHA512

    c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643403.exe
    Filesize

    175KB

    MD5

    b2e599dec0856d70ebb2ab2327ae6442

    SHA1

    300323436b47ddafa78cb7e835deb1ab09f13698

    SHA256

    b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

    SHA512

    c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un833972.exe
    Filesize

    518KB

    MD5

    170994aec2e29f4dd166c421a0c20257

    SHA1

    92993aef3f69665d7444f414872eb3a8112bcce4

    SHA256

    1f840c5415c34db1254589babfc194d6bd7ffe0bfd681d681635b9d6528f3bf5

    SHA512

    a26a2459fbaba8da07cbc9483c9dc0dd4d3f2aec3ce83299ba79b763fe23a0edc5021d446f9203dd747305467993e72768bda048549f0e0f7f6270831d22d4f9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un833972.exe
    Filesize

    518KB

    MD5

    170994aec2e29f4dd166c421a0c20257

    SHA1

    92993aef3f69665d7444f414872eb3a8112bcce4

    SHA256

    1f840c5415c34db1254589babfc194d6bd7ffe0bfd681d681635b9d6528f3bf5

    SHA512

    a26a2459fbaba8da07cbc9483c9dc0dd4d3f2aec3ce83299ba79b763fe23a0edc5021d446f9203dd747305467993e72768bda048549f0e0f7f6270831d22d4f9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr482421.exe
    Filesize

    239KB

    MD5

    f6a28bb929e9e44b410c2c61eabfe09d

    SHA1

    c78f530e39fef483160e5648799c278ca0b27dc9

    SHA256

    296b795043a3323d663c4f221c49715e92b28f80648e8986a024e5f7f2645ff4

    SHA512

    b2e6450abfce7789159eb28f009e96679ac3757950c6a9c20a8a2b26bf0fafdecfdebc22a642182264becdc8921996906332eea8997022183745847247f16b63

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr482421.exe
    Filesize

    239KB

    MD5

    f6a28bb929e9e44b410c2c61eabfe09d

    SHA1

    c78f530e39fef483160e5648799c278ca0b27dc9

    SHA256

    296b795043a3323d663c4f221c49715e92b28f80648e8986a024e5f7f2645ff4

    SHA512

    b2e6450abfce7789159eb28f009e96679ac3757950c6a9c20a8a2b26bf0fafdecfdebc22a642182264becdc8921996906332eea8997022183745847247f16b63

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu433680.exe
    Filesize

    299KB

    MD5

    041239a123ceb3f61eed595093862d1d

    SHA1

    94157fc945298953a23e4eaa000f1743db3e2faf

    SHA256

    fad5122fc5a8f3eca26499a343c8017ccda91dca7c3c4bd43b97517918758321

    SHA512

    98dab18c7aeabb6777d5e360aa044409a90f1c1de96ae609743b650edb650e0b1736c92b17ab097e80359aa7fd3a747aece3c578e3dac1b5cef87e20212d5153

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu433680.exe
    Filesize

    299KB

    MD5

    041239a123ceb3f61eed595093862d1d

    SHA1

    94157fc945298953a23e4eaa000f1743db3e2faf

    SHA256

    fad5122fc5a8f3eca26499a343c8017ccda91dca7c3c4bd43b97517918758321

    SHA512

    98dab18c7aeabb6777d5e360aa044409a90f1c1de96ae609743b650edb650e0b1736c92b17ab097e80359aa7fd3a747aece3c578e3dac1b5cef87e20212d5153

  • memory/2064-151-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-165-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-147-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-149-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-142-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-153-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-155-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-157-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-159-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-161-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-163-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-145-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-167-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-169-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-170-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2064-171-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2064-172-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2064-173-0x0000000000400000-0x00000000004AA000-memory.dmp
    Filesize

    680KB

  • memory/2064-175-0x0000000000400000-0x00000000004AA000-memory.dmp
    Filesize

    680KB

  • memory/2064-143-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2064-141-0x0000000002480000-0x0000000002498000-memory.dmp
    Filesize

    96KB

  • memory/2064-140-0x0000000004D20000-0x000000000521E000-memory.dmp
    Filesize

    5.0MB

  • memory/2064-139-0x0000000002100000-0x000000000211A000-memory.dmp
    Filesize

    104KB

  • memory/2064-138-0x0000000001E50000-0x0000000001E7D000-memory.dmp
    Filesize

    180KB

  • memory/4512-187-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-1094-0x00000000057A0000-0x00000000057B2000-memory.dmp
    Filesize

    72KB

  • memory/4512-191-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-193-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-195-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-197-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-201-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-199-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-203-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-205-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-209-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-211-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-207-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-213-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-215-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-227-0x00000000004C0000-0x000000000050B000-memory.dmp
    Filesize

    300KB

  • memory/4512-229-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-230-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-232-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-1092-0x0000000004FD0000-0x00000000055D6000-memory.dmp
    Filesize

    6.0MB

  • memory/4512-1093-0x0000000005660000-0x000000000576A000-memory.dmp
    Filesize

    1.0MB

  • memory/4512-189-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-1095-0x00000000057C0000-0x00000000057FE000-memory.dmp
    Filesize

    248KB

  • memory/4512-1096-0x0000000005910000-0x000000000595B000-memory.dmp
    Filesize

    300KB

  • memory/4512-1097-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-1099-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-1100-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-1101-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-1102-0x0000000002290000-0x00000000022A0000-memory.dmp
    Filesize

    64KB

  • memory/4512-1109-0x0000000002160000-0x00000000021C6000-memory.dmp
    Filesize

    408KB

  • memory/4512-1110-0x0000000006290000-0x0000000006322000-memory.dmp
    Filesize

    584KB

  • memory/4512-1111-0x0000000006570000-0x00000000065E6000-memory.dmp
    Filesize

    472KB

  • memory/4512-1112-0x00000000065F0000-0x0000000006640000-memory.dmp
    Filesize

    320KB

  • memory/4512-1113-0x0000000006660000-0x0000000006822000-memory.dmp
    Filesize

    1.8MB

  • memory/4512-1114-0x0000000006840000-0x0000000006D6C000-memory.dmp
    Filesize

    5.2MB

  • memory/4512-180-0x0000000002250000-0x0000000002296000-memory.dmp
    Filesize

    280KB

  • memory/4512-181-0x0000000002540000-0x0000000002584000-memory.dmp
    Filesize

    272KB

  • memory/4512-185-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-182-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4512-183-0x0000000002540000-0x000000000257F000-memory.dmp
    Filesize

    252KB

  • memory/4796-1121-0x0000000005030000-0x000000000507B000-memory.dmp
    Filesize

    300KB

  • memory/4796-1120-0x00000000005F0000-0x0000000000622000-memory.dmp
    Filesize

    200KB

  • memory/4796-1122-0x0000000004F10000-0x0000000004F20000-memory.dmp
    Filesize

    64KB