Analysis
-
max time kernel
117s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 23:44
Static task
static1
General
-
Target
670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe
-
Size
951KB
-
MD5
6b279c6a140e14f02c0a76c0df534081
-
SHA1
78d17fca553124d28ea54f4aa40b9c2b8dee8e80
-
SHA256
670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b
-
SHA512
c74367fce6f4178ec15bd7546ba9d4bf7172ddd70160146aa3e7f92e6b0ad460d8393f5509fc8a1f03518b105b51a8c88156c32d2774cb2c61d986b4c2b7fe90
-
SSDEEP
24576:jyjFQdcLz3yYMUfluMv8DDo+pq+I/S9G0OcWleNZq:2jad7YMUt/so+I/cOcWliZ
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v0364RC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v0364RC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v0364RC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v0364RC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v0364RC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v0364RC.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation xxxZY54.exe -
Executes dropped EXE 9 IoCs
pid Process 1932 za892073.exe 4668 za256592.exe 1576 v0364RC.exe 2500 w58tx98.exe 3044 xxxZY54.exe 1392 oneetx.exe 3376 ys693038.exe 2052 oneetx.exe 2300 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2148 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v0364RC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v0364RC.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za892073.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za892073.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za256592.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za256592.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 724 1576 WerFault.exe 84 1536 2500 WerFault.exe 87 5068 3376 WerFault.exe 92 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3940 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1576 v0364RC.exe 1576 v0364RC.exe 2500 w58tx98.exe 2500 w58tx98.exe 3376 ys693038.exe 3376 ys693038.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1576 v0364RC.exe Token: SeDebugPrivilege 2500 w58tx98.exe Token: SeDebugPrivilege 3376 ys693038.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 xxxZY54.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1932 2924 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe 82 PID 2924 wrote to memory of 1932 2924 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe 82 PID 2924 wrote to memory of 1932 2924 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe 82 PID 1932 wrote to memory of 4668 1932 za892073.exe 83 PID 1932 wrote to memory of 4668 1932 za892073.exe 83 PID 1932 wrote to memory of 4668 1932 za892073.exe 83 PID 4668 wrote to memory of 1576 4668 za256592.exe 84 PID 4668 wrote to memory of 1576 4668 za256592.exe 84 PID 4668 wrote to memory of 1576 4668 za256592.exe 84 PID 4668 wrote to memory of 2500 4668 za256592.exe 87 PID 4668 wrote to memory of 2500 4668 za256592.exe 87 PID 4668 wrote to memory of 2500 4668 za256592.exe 87 PID 1932 wrote to memory of 3044 1932 za892073.exe 90 PID 1932 wrote to memory of 3044 1932 za892073.exe 90 PID 1932 wrote to memory of 3044 1932 za892073.exe 90 PID 3044 wrote to memory of 1392 3044 xxxZY54.exe 91 PID 3044 wrote to memory of 1392 3044 xxxZY54.exe 91 PID 3044 wrote to memory of 1392 3044 xxxZY54.exe 91 PID 2924 wrote to memory of 3376 2924 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe 92 PID 2924 wrote to memory of 3376 2924 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe 92 PID 2924 wrote to memory of 3376 2924 670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe 92 PID 1392 wrote to memory of 3940 1392 oneetx.exe 93 PID 1392 wrote to memory of 3940 1392 oneetx.exe 93 PID 1392 wrote to memory of 3940 1392 oneetx.exe 93 PID 1392 wrote to memory of 2148 1392 oneetx.exe 99 PID 1392 wrote to memory of 2148 1392 oneetx.exe 99 PID 1392 wrote to memory of 2148 1392 oneetx.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe"C:\Users\Admin\AppData\Local\Temp\670782f8b0a34b9358600f518fddf4575361d4d3dcae2717edd0c390d6934d2b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za892073.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za892073.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za256592.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za256592.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0364RC.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0364RC.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 10885⤵
- Program crash
PID:724
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58tx98.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w58tx98.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 20205⤵
- Program crash
PID:1536
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xxxZY54.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xxxZY54.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:3940
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2148
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys693038.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys693038.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 13243⤵
- Program crash
PID:5068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1576 -ip 15761⤵PID:640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2500 -ip 25001⤵PID:2308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3376 -ip 33761⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:2300
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
361KB
MD55e125bf894bada0f6d1008775c44f19f
SHA1414cc16fe35cc68d6278718a663372a85fe92608
SHA256a95f248cdaf5f288285e15185aeec8a70ca3c3c3ebe9db596a14f8f39bba9404
SHA512f7570c05bb3d6067e6301fb19ca01fc3311db3dc7664b84a416edd0a15f275d111bdf4c8f3f460735d3723242d377e79886e609526875fe05860c771d6e30e08
-
Filesize
361KB
MD55e125bf894bada0f6d1008775c44f19f
SHA1414cc16fe35cc68d6278718a663372a85fe92608
SHA256a95f248cdaf5f288285e15185aeec8a70ca3c3c3ebe9db596a14f8f39bba9404
SHA512f7570c05bb3d6067e6301fb19ca01fc3311db3dc7664b84a416edd0a15f275d111bdf4c8f3f460735d3723242d377e79886e609526875fe05860c771d6e30e08
-
Filesize
733KB
MD55f08fdd1315bc37823fb3500b10966b2
SHA132a3b87d67ef66db9ce15712329007d0cca57ef1
SHA25666cf57c626f9cd56d1ca60fa0586a03fbd1041432da497d06426f6a8539e3119
SHA5129b30c1de74b90202714693eb5b17e6d3d51f48f2af16b6ea5345f4b0ac1571369c32d5f47e29fccf98cef6e52b4901939a0ceaceb448513f4576c09c56b7b7bb
-
Filesize
733KB
MD55f08fdd1315bc37823fb3500b10966b2
SHA132a3b87d67ef66db9ce15712329007d0cca57ef1
SHA25666cf57c626f9cd56d1ca60fa0586a03fbd1041432da497d06426f6a8539e3119
SHA5129b30c1de74b90202714693eb5b17e6d3d51f48f2af16b6ea5345f4b0ac1571369c32d5f47e29fccf98cef6e52b4901939a0ceaceb448513f4576c09c56b7b7bb
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
550KB
MD58c571e721d04a8c2b6c9f0cf85b16d22
SHA1cf50832a8cc9ed4a96f4c008093e336f9c9f5560
SHA2562560c5df9763698f7bb56071167e9ce02941f42edbffd66b5062f767cef8f26a
SHA512cb76da113daf7786f933e764a837012f639897542c072eed7b5d06fbf0318de6b0f477e2ad7e1183598635e72e1cd9d40fa28e3c9afa7c03f138ad7da64f3515
-
Filesize
550KB
MD58c571e721d04a8c2b6c9f0cf85b16d22
SHA1cf50832a8cc9ed4a96f4c008093e336f9c9f5560
SHA2562560c5df9763698f7bb56071167e9ce02941f42edbffd66b5062f767cef8f26a
SHA512cb76da113daf7786f933e764a837012f639897542c072eed7b5d06fbf0318de6b0f477e2ad7e1183598635e72e1cd9d40fa28e3c9afa7c03f138ad7da64f3515
-
Filesize
278KB
MD592a49523db42ec54161c35b9c15626d1
SHA198fbf9d9c583438aea122f1ea73f48529fae8ffb
SHA25697f4fb8391c8a1e3133a31ab0263f2ead4c0c47dd7b4c2be2fa5600083949382
SHA5127911517f1ff5c024fe174c1429fd6bc13c89be1e22342648605c23edf0cebc91c8a9402a11b571b5511a780d36e3660352a110c17d3e8dc1bcf68864b1563ede
-
Filesize
278KB
MD592a49523db42ec54161c35b9c15626d1
SHA198fbf9d9c583438aea122f1ea73f48529fae8ffb
SHA25697f4fb8391c8a1e3133a31ab0263f2ead4c0c47dd7b4c2be2fa5600083949382
SHA5127911517f1ff5c024fe174c1429fd6bc13c89be1e22342648605c23edf0cebc91c8a9402a11b571b5511a780d36e3660352a110c17d3e8dc1bcf68864b1563ede
-
Filesize
361KB
MD572aa14f68ad017e5d82f8071fb8f64a1
SHA1efbf4b2886b7ec9ee8bb36780303de0833d76f56
SHA256615cc9612be604bfa112fdb55ba036e1a066adc229f94da94d33c2f88c5d78fd
SHA5121d854069c12e5cda156e3e79b150a8ff3cd24782755c821f017cf7bb9220109c60ea14edef3fde487c9ec087ef5893408d378f5c47bb0b801a1f116eb764d1ac
-
Filesize
361KB
MD572aa14f68ad017e5d82f8071fb8f64a1
SHA1efbf4b2886b7ec9ee8bb36780303de0833d76f56
SHA256615cc9612be604bfa112fdb55ba036e1a066adc229f94da94d33c2f88c5d78fd
SHA5121d854069c12e5cda156e3e79b150a8ff3cd24782755c821f017cf7bb9220109c60ea14edef3fde487c9ec087ef5893408d378f5c47bb0b801a1f116eb764d1ac
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5