Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 23:50
Static task
static1
General
-
Target
924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe
-
Size
891KB
-
MD5
af030c171c81ef7cac612bfe24c9267b
-
SHA1
7b685524b47db72fc9cb5278dae34aed9c05eedb
-
SHA256
924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d
-
SHA512
158810dcb623187f75728c6c6885468c7b88c8bd75679e1fc93139d8040badc62910410ce3c72b0f36f44896c269d927acb0dc76fccc736973489c23d9e39a34
-
SSDEEP
24576:byqnJoAVpID255CVTR7ZIIhLT5FxtE4C:Oq2A5SdIIhzE
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v1044IA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v1044IA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v1044IA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v1044IA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v1044IA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v1044IA.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation xlCFV16.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2136 za318801.exe 3344 za583548.exe 1800 v1044IA.exe 4644 w46jN13.exe 3120 xlCFV16.exe 8 oneetx.exe 2228 ys016587.exe 3508 oneetx.exe 1888 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4028 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v1044IA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v1044IA.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za318801.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za583548.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za583548.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za318801.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 4672 1800 WerFault.exe 87 4964 4644 WerFault.exe 93 4340 2228 WerFault.exe 98 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4424 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1800 v1044IA.exe 1800 v1044IA.exe 4644 w46jN13.exe 4644 w46jN13.exe 2228 ys016587.exe 2228 ys016587.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1800 v1044IA.exe Token: SeDebugPrivilege 4644 w46jN13.exe Token: SeDebugPrivilege 2228 ys016587.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3120 xlCFV16.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2136 2000 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe 85 PID 2000 wrote to memory of 2136 2000 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe 85 PID 2000 wrote to memory of 2136 2000 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe 85 PID 2136 wrote to memory of 3344 2136 za318801.exe 86 PID 2136 wrote to memory of 3344 2136 za318801.exe 86 PID 2136 wrote to memory of 3344 2136 za318801.exe 86 PID 3344 wrote to memory of 1800 3344 za583548.exe 87 PID 3344 wrote to memory of 1800 3344 za583548.exe 87 PID 3344 wrote to memory of 1800 3344 za583548.exe 87 PID 3344 wrote to memory of 4644 3344 za583548.exe 93 PID 3344 wrote to memory of 4644 3344 za583548.exe 93 PID 3344 wrote to memory of 4644 3344 za583548.exe 93 PID 2136 wrote to memory of 3120 2136 za318801.exe 96 PID 2136 wrote to memory of 3120 2136 za318801.exe 96 PID 2136 wrote to memory of 3120 2136 za318801.exe 96 PID 3120 wrote to memory of 8 3120 xlCFV16.exe 97 PID 3120 wrote to memory of 8 3120 xlCFV16.exe 97 PID 3120 wrote to memory of 8 3120 xlCFV16.exe 97 PID 2000 wrote to memory of 2228 2000 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe 98 PID 2000 wrote to memory of 2228 2000 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe 98 PID 2000 wrote to memory of 2228 2000 924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe 98 PID 8 wrote to memory of 4424 8 oneetx.exe 99 PID 8 wrote to memory of 4424 8 oneetx.exe 99 PID 8 wrote to memory of 4424 8 oneetx.exe 99 PID 8 wrote to memory of 4028 8 oneetx.exe 109 PID 8 wrote to memory of 4028 8 oneetx.exe 109 PID 8 wrote to memory of 4028 8 oneetx.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe"C:\Users\Admin\AppData\Local\Temp\924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za318801.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za318801.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za583548.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za583548.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1044IA.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1044IA.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 10965⤵
- Program crash
PID:4672
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46jN13.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46jN13.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 13245⤵
- Program crash
PID:4964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlCFV16.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlCFV16.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:4424
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys016587.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys016587.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 13203⤵
- Program crash
PID:4340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1800 -ip 18001⤵PID:1364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4644 -ip 46441⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:3508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2228 -ip 22281⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:1888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
361KB
MD5d4999b84045618caf469527361753b26
SHA1dea7471dcd62344030ff874c1a08acb85f802c8d
SHA2560934150dffa7e56590d4d5d6a6477668f053daac2565b4fb464c42fcdc521f28
SHA51267017cae4563dc5fb8cf75f61457af3dda1df92057ad8569b8f60c47fd1c5ee8ece98f412bac32bb6632f23a0e6da4c23e3c0f36383fc40caaafc6de905fa599
-
Filesize
361KB
MD5d4999b84045618caf469527361753b26
SHA1dea7471dcd62344030ff874c1a08acb85f802c8d
SHA2560934150dffa7e56590d4d5d6a6477668f053daac2565b4fb464c42fcdc521f28
SHA51267017cae4563dc5fb8cf75f61457af3dda1df92057ad8569b8f60c47fd1c5ee8ece98f412bac32bb6632f23a0e6da4c23e3c0f36383fc40caaafc6de905fa599
-
Filesize
732KB
MD5ca66a1928e41037904231cb6c0bcf161
SHA10dac05dc019cd0c854fa4366ec138270a302b340
SHA256ab515b1ef9bfba224e333742ffb300c6f0be764d364e41fbf699ff5bb6225ec8
SHA512c04ac044b207522df21beee37b532add532b4227ef9ac2776eec36a0265922c67fcfc3b9c9df4549c4ed4f4ff5db57bf63e05459a2435ef38d7fe4c2840f9fe9
-
Filesize
732KB
MD5ca66a1928e41037904231cb6c0bcf161
SHA10dac05dc019cd0c854fa4366ec138270a302b340
SHA256ab515b1ef9bfba224e333742ffb300c6f0be764d364e41fbf699ff5bb6225ec8
SHA512c04ac044b207522df21beee37b532add532b4227ef9ac2776eec36a0265922c67fcfc3b9c9df4549c4ed4f4ff5db57bf63e05459a2435ef38d7fe4c2840f9fe9
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
549KB
MD5d8cb212706acb6f00ccf9edceb2337f5
SHA1e58bf15cda3b72daf88bd2301fceda666d04db42
SHA2566bb0443f1c045e9036ec4f18988fbb05bf4b5536abaea58911b6a84e0a868c13
SHA512b4ffd4f5a1200aa37dc34dfa39badaa2dd26b3331a257e57f54c602b8858672980de6c02a85947489c79cc8294845fa78d333a3ecece59b8cd43946137e831a8
-
Filesize
549KB
MD5d8cb212706acb6f00ccf9edceb2337f5
SHA1e58bf15cda3b72daf88bd2301fceda666d04db42
SHA2566bb0443f1c045e9036ec4f18988fbb05bf4b5536abaea58911b6a84e0a868c13
SHA512b4ffd4f5a1200aa37dc34dfa39badaa2dd26b3331a257e57f54c602b8858672980de6c02a85947489c79cc8294845fa78d333a3ecece59b8cd43946137e831a8
-
Filesize
278KB
MD5bda682fff8d5f135e70b23e96eab9ec2
SHA1f2a6da759a4cd57289346e80851c23352d301ed7
SHA2560536bfa9104733baf9bbfeb13d37ba81928eea64db222de3bad2dc29256ea369
SHA5124dc8c92873768c7c21d1ddd63a0eb67e34ea25be438cdb3733860e0a31a248d860c99ea49856225b35cbeea0b52ed42509a8ee1bdbaa1da4ed0fbef438f3deea
-
Filesize
278KB
MD5bda682fff8d5f135e70b23e96eab9ec2
SHA1f2a6da759a4cd57289346e80851c23352d301ed7
SHA2560536bfa9104733baf9bbfeb13d37ba81928eea64db222de3bad2dc29256ea369
SHA5124dc8c92873768c7c21d1ddd63a0eb67e34ea25be438cdb3733860e0a31a248d860c99ea49856225b35cbeea0b52ed42509a8ee1bdbaa1da4ed0fbef438f3deea
-
Filesize
361KB
MD5c3d9c42a86fc1c144a1aa7c4ea36ae4d
SHA1a4038ddfc9f572cc5d4cc4cd2cdb450942ad1ed0
SHA2567965fb841ceed81e6de270446fef0f61822c899082c6b0c41e183f092099b5be
SHA512665e92a556dc9e4eed0e2c2432d60df7ecee7f55b0ae75a2937ffdb50039ec2b60ce61d5c80e220e3bc0d333fc0a63fd303ae95c759e21dc341d99f7487e1477
-
Filesize
361KB
MD5c3d9c42a86fc1c144a1aa7c4ea36ae4d
SHA1a4038ddfc9f572cc5d4cc4cd2cdb450942ad1ed0
SHA2567965fb841ceed81e6de270446fef0f61822c899082c6b0c41e183f092099b5be
SHA512665e92a556dc9e4eed0e2c2432d60df7ecee7f55b0ae75a2937ffdb50039ec2b60ce61d5c80e220e3bc0d333fc0a63fd303ae95c759e21dc341d99f7487e1477
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5