Analysis
-
max time kernel
104s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 23:46
Static task
static1
General
-
Target
690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe
-
Size
898KB
-
MD5
5aadc98d71baa32b9a42daeb1570e48f
-
SHA1
fcdbc81e8e7206fb98da9fa7339e7281e14849ba
-
SHA256
690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8
-
SHA512
b03fe90250d857042a50dd659773a87196485e99eec0c83f1719d5fbeb4abeb97cef85ca28e5ab9f9046dc45c8f1aa43b1dabeb81845469dbfb70e466bdfc309
-
SSDEEP
24576:tyRAeKyKs/lvfX1LI27pzP41JOZI3awOD4z+yjdF:ISeNtVLxPDZI3JnP
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v6798dl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v6798dl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v6798dl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v6798dl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v6798dl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v6798dl.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation xFdSQ47.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2008 za071667.exe 2516 za511010.exe 4448 v6798dl.exe 4648 w59iU75.exe 2116 xFdSQ47.exe 1948 oneetx.exe 4056 ys511974.exe 1220 oneetx.exe 3892 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3784 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v6798dl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v6798dl.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za071667.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za071667.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za511010.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za511010.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 2976 4448 WerFault.exe 84 4836 4648 WerFault.exe 87 3192 4056 WerFault.exe 92 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1660 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4448 v6798dl.exe 4448 v6798dl.exe 4648 w59iU75.exe 4648 w59iU75.exe 4056 ys511974.exe 4056 ys511974.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4448 v6798dl.exe Token: SeDebugPrivilege 4648 w59iU75.exe Token: SeDebugPrivilege 4056 ys511974.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 xFdSQ47.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2008 2648 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe 82 PID 2648 wrote to memory of 2008 2648 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe 82 PID 2648 wrote to memory of 2008 2648 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe 82 PID 2008 wrote to memory of 2516 2008 za071667.exe 83 PID 2008 wrote to memory of 2516 2008 za071667.exe 83 PID 2008 wrote to memory of 2516 2008 za071667.exe 83 PID 2516 wrote to memory of 4448 2516 za511010.exe 84 PID 2516 wrote to memory of 4448 2516 za511010.exe 84 PID 2516 wrote to memory of 4448 2516 za511010.exe 84 PID 2516 wrote to memory of 4648 2516 za511010.exe 87 PID 2516 wrote to memory of 4648 2516 za511010.exe 87 PID 2516 wrote to memory of 4648 2516 za511010.exe 87 PID 2008 wrote to memory of 2116 2008 za071667.exe 90 PID 2008 wrote to memory of 2116 2008 za071667.exe 90 PID 2008 wrote to memory of 2116 2008 za071667.exe 90 PID 2116 wrote to memory of 1948 2116 xFdSQ47.exe 91 PID 2116 wrote to memory of 1948 2116 xFdSQ47.exe 91 PID 2116 wrote to memory of 1948 2116 xFdSQ47.exe 91 PID 2648 wrote to memory of 4056 2648 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe 92 PID 2648 wrote to memory of 4056 2648 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe 92 PID 2648 wrote to memory of 4056 2648 690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe 92 PID 1948 wrote to memory of 1660 1948 oneetx.exe 93 PID 1948 wrote to memory of 1660 1948 oneetx.exe 93 PID 1948 wrote to memory of 1660 1948 oneetx.exe 93 PID 1948 wrote to memory of 3784 1948 oneetx.exe 99 PID 1948 wrote to memory of 3784 1948 oneetx.exe 99 PID 1948 wrote to memory of 3784 1948 oneetx.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe"C:\Users\Admin\AppData\Local\Temp\690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za071667.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za071667.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za511010.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za511010.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6798dl.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6798dl.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 10805⤵
- Program crash
PID:2976
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w59iU75.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w59iU75.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 13205⤵
- Program crash
PID:4836
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xFdSQ47.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xFdSQ47.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:1660
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3784
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys511974.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys511974.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 18083⤵
- Program crash
PID:3192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4448 -ip 44481⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4648 -ip 46481⤵PID:1500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4056 -ip 40561⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:3892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
361KB
MD5d4a54a5f066924ad0851b2b4db1564c7
SHA105cb82e92f27ab439fa0d8d694fef99a98d32724
SHA256f26bd680ea1bae804bd1ed206624bb496cff3dbb677eec12913107f1ff121f09
SHA51284411411c2ff9ef95c0decd5bab83a2a897fdacaceb3cdccf45554c99c7355f44bb758d1f6a34dbafd5517e90b493cb6253d3a3b5c1b0c6825eb16722970e17d
-
Filesize
361KB
MD5d4a54a5f066924ad0851b2b4db1564c7
SHA105cb82e92f27ab439fa0d8d694fef99a98d32724
SHA256f26bd680ea1bae804bd1ed206624bb496cff3dbb677eec12913107f1ff121f09
SHA51284411411c2ff9ef95c0decd5bab83a2a897fdacaceb3cdccf45554c99c7355f44bb758d1f6a34dbafd5517e90b493cb6253d3a3b5c1b0c6825eb16722970e17d
-
Filesize
732KB
MD57ecbb336b74c294a96f47cd80542c639
SHA1952ebcc6e5c4a428ee1fa8331301a0970188d0dc
SHA256d5ccb64c74f5331e9f73a6faaa0eaf04b525fc8e4cdabf6cd3aa14e3798cd268
SHA5124dd55bbcd8921b6a7f39c2ddaa742f6029e014a006bd1677ab1879b7f901eef8ac86f5ce09db137844674ad36b439c7bbbc2756d401689d3e1d54d2f44e4a1e6
-
Filesize
732KB
MD57ecbb336b74c294a96f47cd80542c639
SHA1952ebcc6e5c4a428ee1fa8331301a0970188d0dc
SHA256d5ccb64c74f5331e9f73a6faaa0eaf04b525fc8e4cdabf6cd3aa14e3798cd268
SHA5124dd55bbcd8921b6a7f39c2ddaa742f6029e014a006bd1677ab1879b7f901eef8ac86f5ce09db137844674ad36b439c7bbbc2756d401689d3e1d54d2f44e4a1e6
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
549KB
MD5ed759682c1b9975990253cc29436a4fb
SHA1ad961729b6b31f2325d78d60e830ada8ccc1fcb5
SHA256111ccc1c26a507a42a5953033c73b05c2686734578a6a555441975d455629aa0
SHA512f77b9ea240978bb564ae7a4809f446f097d9354a0e78d1b86140f2b74268bab1fb76c2132c10820492ebfaeacb3f68d93433178373c30455228824331d4a82d8
-
Filesize
549KB
MD5ed759682c1b9975990253cc29436a4fb
SHA1ad961729b6b31f2325d78d60e830ada8ccc1fcb5
SHA256111ccc1c26a507a42a5953033c73b05c2686734578a6a555441975d455629aa0
SHA512f77b9ea240978bb564ae7a4809f446f097d9354a0e78d1b86140f2b74268bab1fb76c2132c10820492ebfaeacb3f68d93433178373c30455228824331d4a82d8
-
Filesize
278KB
MD5339fd6841246ec4cbb0ef859e269d725
SHA1250b79d0072e4498b8887ad6eefea28d59c99b9c
SHA256adaf46a475ee83ccbe26b2488914446bc5bb1304a7e28d2df6f24ad3909b64f0
SHA5128a9f904e657e371d37f7bbb68899df86c81b051ce6e6a9817c0aa14814b17de1ac4d287961b599b619156978aa8ae55fc8d016b61f8ecce52c05824919bf5450
-
Filesize
278KB
MD5339fd6841246ec4cbb0ef859e269d725
SHA1250b79d0072e4498b8887ad6eefea28d59c99b9c
SHA256adaf46a475ee83ccbe26b2488914446bc5bb1304a7e28d2df6f24ad3909b64f0
SHA5128a9f904e657e371d37f7bbb68899df86c81b051ce6e6a9817c0aa14814b17de1ac4d287961b599b619156978aa8ae55fc8d016b61f8ecce52c05824919bf5450
-
Filesize
361KB
MD5ee7a5bed4218fe1ca6f6724e8e5daf05
SHA1c83ecc56a7641ce374b34c6616f67cf685df1413
SHA256327e7e50f7ae3574cf1c0cfb318f5aefebe597f9e4d64afd30347f29226b4cf2
SHA512b32f568047397ba42783963e493a74f7c446839838301fcef660e9d6c04be776689adf5b86005fc680303e3d357f938e93116ae78cee496dbfa058e47f776aa9
-
Filesize
361KB
MD5ee7a5bed4218fe1ca6f6724e8e5daf05
SHA1c83ecc56a7641ce374b34c6616f67cf685df1413
SHA256327e7e50f7ae3574cf1c0cfb318f5aefebe597f9e4d64afd30347f29226b4cf2
SHA512b32f568047397ba42783963e493a74f7c446839838301fcef660e9d6c04be776689adf5b86005fc680303e3d357f938e93116ae78cee496dbfa058e47f776aa9
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5