amadey | 05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz8556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz8556.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz8556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz8556.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz8556.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz8556.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Heavan.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Heavan.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Heavan.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	y26Uy91.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 14 IoCs

pid	Process
2364	za714799.exe
4904	za983781.exe
2480	za323761.exe
4712	tz8556.exe
3960	v7641nE.exe
2244	w96dW10.exe
1092	xAXzI97.exe
4524	y26Uy91.exe
2068	oneetx.exe
1276	svhost.exe
3600	Heavan.exe
4640	oneetx.exe
2076	ntlhost.exe
2772	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
5064	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0006000000023151-1866.dat	themida
behavioral1/files/0x0006000000023151-1880.dat	themida
behavioral1/files/0x0006000000023151-1881.dat	themida
behavioral1/memory/3600-1886-0x0000000000CA0000-0x000000000125A000-memory.dmp	themida
behavioral1/memory/3600-1904-0x0000000000CA0000-0x000000000125A000-memory.dmp	themida

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz8556.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	w96dW10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	w96dW10.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za714799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	za714799.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za983781.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	za983781.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	svhost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za323761.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	za323761.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Heavan.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3600	Heavan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3492	3960	WerFault.exe	93
4504	2244	WerFault.exe	98
1752	1092	WerFault.exe	102

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
552	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	63	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4712	tz8556.exe
4712	tz8556.exe
3960	v7641nE.exe
3960	v7641nE.exe
2244	w96dW10.exe
2244	w96dW10.exe
1092	xAXzI97.exe
1092	xAXzI97.exe
3600	Heavan.exe
3600	Heavan.exe
3600	Heavan.exe
3600	Heavan.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	tz8556.exe
Token: SeDebugPrivilege	3960	v7641nE.exe
Token: SeDebugPrivilege	2244	w96dW10.exe
Token: SeDebugPrivilege	1092	xAXzI97.exe
Token: SeDebugPrivilege	3600	Heavan.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4524	y26Uy91.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2364	4516	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe	84
PID 4516 wrote to memory of 2364	4516	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe	84
PID 4516 wrote to memory of 2364	4516	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe	84
PID 2364 wrote to memory of 4904	2364	za714799.exe	85
PID 2364 wrote to memory of 4904	2364	za714799.exe	85
PID 2364 wrote to memory of 4904	2364	za714799.exe	85
PID 4904 wrote to memory of 2480	4904	za983781.exe	86
PID 4904 wrote to memory of 2480	4904	za983781.exe	86
PID 4904 wrote to memory of 2480	4904	za983781.exe	86
PID 2480 wrote to memory of 4712	2480	za323761.exe	87
PID 2480 wrote to memory of 4712	2480	za323761.exe	87
PID 2480 wrote to memory of 3960	2480	za323761.exe	93
PID 2480 wrote to memory of 3960	2480	za323761.exe	93
PID 2480 wrote to memory of 3960	2480	za323761.exe	93
PID 4904 wrote to memory of 2244	4904	za983781.exe	98
PID 4904 wrote to memory of 2244	4904	za983781.exe	98
PID 4904 wrote to memory of 2244	4904	za983781.exe	98
PID 2364 wrote to memory of 1092	2364	za714799.exe	102
PID 2364 wrote to memory of 1092	2364	za714799.exe	102
PID 2364 wrote to memory of 1092	2364	za714799.exe	102
PID 4516 wrote to memory of 4524	4516	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe	105
PID 4516 wrote to memory of 4524	4516	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe	105
PID 4516 wrote to memory of 4524	4516	05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe	105
PID 4524 wrote to memory of 2068	4524	y26Uy91.exe	106
PID 4524 wrote to memory of 2068	4524	y26Uy91.exe	106
PID 4524 wrote to memory of 2068	4524	y26Uy91.exe	106
PID 2068 wrote to memory of 552	2068	oneetx.exe	107
PID 2068 wrote to memory of 552	2068	oneetx.exe	107
PID 2068 wrote to memory of 552	2068	oneetx.exe	107
PID 2068 wrote to memory of 1276	2068	oneetx.exe	109
PID 2068 wrote to memory of 1276	2068	oneetx.exe	109
PID 2068 wrote to memory of 1276	2068	oneetx.exe	109
PID 2068 wrote to memory of 3600	2068	oneetx.exe	110
PID 2068 wrote to memory of 3600	2068	oneetx.exe	110
PID 2068 wrote to memory of 3600	2068	oneetx.exe	110
PID 1276 wrote to memory of 2076	1276	svhost.exe	112
PID 1276 wrote to memory of 2076	1276	svhost.exe	112
PID 1276 wrote to memory of 2076	1276	svhost.exe	112
PID 2068 wrote to memory of 5064	2068	oneetx.exe	113
PID 2068 wrote to memory of 5064	2068	oneetx.exe	113
PID 2068 wrote to memory of 5064	2068	oneetx.exe	113

C:\Users\Admin\AppData\Local\Temp\05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe
"C:\Users\Admin\AppData\Local\Temp\05ef523a2d6430dd50e4064cba14a06bd4345ef1e9fd41634a0edb3efefe7583.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za714799.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za714799.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za983781.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za983781.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za323761.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za323761.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8556.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8556.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7641nE.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7641nE.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1324
        6⤵
        Program crash
        
        PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w96dW10.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w96dW10.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1052
        5⤵
        Program crash
        
        PID:4504
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xAXzI97.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xAXzI97.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1320
      4⤵
      Program crash
      PID:1752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y26Uy91.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y26Uy91.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:552
  - - C:\Users\Admin\AppData\Local\Temp\1000019001\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\1000019001\svhost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        5⤵
        Executes dropped EXE
        
        PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\1000020001\Heavan.exe
      "C:\Users\Admin\AppData\Local\Temp\1000020001\Heavan.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3600
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3960 -ip 3960
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2244 -ip 2244
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1092 -ip 1092
1⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
1⤵
- Executes dropped EXE
PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery