Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 20:57
Static task
static1
General
-
Target
a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe
-
Size
949KB
-
MD5
04d9648e1029e9641d1e306ec6bdfe68
-
SHA1
9978fd57e6ca50688a5ff207564095f91d660117
-
SHA256
a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c
-
SHA512
bc659a8349e9aac674181e49bbdec2013d282d219ca2a2531e610f2cad767c59ad31aaff1c835731d93170451add7b179574352697df440e33257ae26faddfd1
-
SSDEEP
24576:cy+DmI8J8WqQ5PWzKTwepBmKFlztw3vmXWmVzFjd:LddqQ5E6Tp8KF3//hF
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v0256TH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v0256TH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v0256TH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v0256TH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v0256TH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v0256TH.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation xrpAJ50.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 4092 za953706.exe 4180 za068764.exe 5068 v0256TH.exe 4616 w19yg65.exe 1616 xrpAJ50.exe 1712 oneetx.exe 828 ys931168.exe 2124 oneetx.exe 3408 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2892 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v0256TH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v0256TH.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za068764.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za068764.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za953706.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za953706.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 2068 5068 WerFault.exe 86 2856 4616 WerFault.exe 89 4576 828 WerFault.exe 94 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5068 v0256TH.exe 5068 v0256TH.exe 4616 w19yg65.exe 4616 w19yg65.exe 828 ys931168.exe 828 ys931168.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5068 v0256TH.exe Token: SeDebugPrivilege 4616 w19yg65.exe Token: SeDebugPrivilege 828 ys931168.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1616 xrpAJ50.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1804 wrote to memory of 4092 1804 a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe 84 PID 1804 wrote to memory of 4092 1804 a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe 84 PID 1804 wrote to memory of 4092 1804 a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe 84 PID 4092 wrote to memory of 4180 4092 za953706.exe 85 PID 4092 wrote to memory of 4180 4092 za953706.exe 85 PID 4092 wrote to memory of 4180 4092 za953706.exe 85 PID 4180 wrote to memory of 5068 4180 za068764.exe 86 PID 4180 wrote to memory of 5068 4180 za068764.exe 86 PID 4180 wrote to memory of 5068 4180 za068764.exe 86 PID 4180 wrote to memory of 4616 4180 za068764.exe 89 PID 4180 wrote to memory of 4616 4180 za068764.exe 89 PID 4180 wrote to memory of 4616 4180 za068764.exe 89 PID 4092 wrote to memory of 1616 4092 za953706.exe 92 PID 4092 wrote to memory of 1616 4092 za953706.exe 92 PID 4092 wrote to memory of 1616 4092 za953706.exe 92 PID 1616 wrote to memory of 1712 1616 xrpAJ50.exe 93 PID 1616 wrote to memory of 1712 1616 xrpAJ50.exe 93 PID 1616 wrote to memory of 1712 1616 xrpAJ50.exe 93 PID 1804 wrote to memory of 828 1804 a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe 94 PID 1804 wrote to memory of 828 1804 a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe 94 PID 1804 wrote to memory of 828 1804 a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe 94 PID 1712 wrote to memory of 3628 1712 oneetx.exe 95 PID 1712 wrote to memory of 3628 1712 oneetx.exe 95 PID 1712 wrote to memory of 3628 1712 oneetx.exe 95 PID 1712 wrote to memory of 2892 1712 oneetx.exe 100 PID 1712 wrote to memory of 2892 1712 oneetx.exe 100 PID 1712 wrote to memory of 2892 1712 oneetx.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe"C:\Users\Admin\AppData\Local\Temp\a5898fae36f41a53b0753dea38ab3757791ba624f0e0d6825ca36b1b917bed8c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za953706.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za953706.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za068764.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za068764.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0256TH.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0256TH.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 10845⤵
- Program crash
PID:2068
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19yg65.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19yg65.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 13245⤵
- Program crash
PID:2856
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xrpAJ50.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xrpAJ50.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:3628
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2892
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys931168.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys931168.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 12843⤵
- Program crash
PID:4576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5068 -ip 50681⤵PID:2324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4616 -ip 46161⤵PID:2568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 828 -ip 8281⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:2124
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:3408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
361KB
MD50f885d2c8bc451840c6d282722cbfad9
SHA15d1c7b7e28828c8c2bb357d0faa45f430480af9b
SHA256dae6ac51450d4fb68f30703409f9c13e502e82d524146dd994eb456b6d13e4ea
SHA512710286b5ce1ab1d7e7bf3b437306acf2196a8a0f7cbf03f8a1732fd592c5c6a9fef09683d3cef39719f18494fe8dd7734c6e96ca861ec3bcfd25c75a02f3a50d
-
Filesize
361KB
MD50f885d2c8bc451840c6d282722cbfad9
SHA15d1c7b7e28828c8c2bb357d0faa45f430480af9b
SHA256dae6ac51450d4fb68f30703409f9c13e502e82d524146dd994eb456b6d13e4ea
SHA512710286b5ce1ab1d7e7bf3b437306acf2196a8a0f7cbf03f8a1732fd592c5c6a9fef09683d3cef39719f18494fe8dd7734c6e96ca861ec3bcfd25c75a02f3a50d
-
Filesize
732KB
MD504c0a9a6c44e3e83a0a74a2c02ab2f56
SHA165cb03a44f50b3472f2a1ed996f9212eac189156
SHA256441ec47f983588b7c81eeea587a4a500315a00984949f079e4a7cfe4bac29497
SHA5125f9b46719a846f8fd35ca2b3660e327aaffd09f1462bc514548335a51ca11122c2e315b6f47134dc3e44263a13c4bf4c5288d14b8cdfe49e437140d0a76d95aa
-
Filesize
732KB
MD504c0a9a6c44e3e83a0a74a2c02ab2f56
SHA165cb03a44f50b3472f2a1ed996f9212eac189156
SHA256441ec47f983588b7c81eeea587a4a500315a00984949f079e4a7cfe4bac29497
SHA5125f9b46719a846f8fd35ca2b3660e327aaffd09f1462bc514548335a51ca11122c2e315b6f47134dc3e44263a13c4bf4c5288d14b8cdfe49e437140d0a76d95aa
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
549KB
MD5efd97dd421520b00037fd91044cc53fd
SHA1efef692f8c3315ac8567e7f8b074cfcbb89b2f59
SHA2560128611396d83fe644e5922f8fb0325e45a46902e1800db4b6b086679be420a8
SHA5122eb17593d990e0c7ef30657122fdabfd8bdfe5035d6f2808a5683c3894b264c369624037d76ac9b2f101b3837a5d4d67d205ada68658f4de934674deab1526f7
-
Filesize
549KB
MD5efd97dd421520b00037fd91044cc53fd
SHA1efef692f8c3315ac8567e7f8b074cfcbb89b2f59
SHA2560128611396d83fe644e5922f8fb0325e45a46902e1800db4b6b086679be420a8
SHA5122eb17593d990e0c7ef30657122fdabfd8bdfe5035d6f2808a5683c3894b264c369624037d76ac9b2f101b3837a5d4d67d205ada68658f4de934674deab1526f7
-
Filesize
277KB
MD513b541bf9ab4da1ff69ac5f7ca91d5be
SHA1712451a04532642f6da68e5b8c6308d4cf4a1a12
SHA256c39a47b1148ea0f5c60e444afadb07f370ab3c1505fafe53deee82a9151a4e95
SHA512f08effcd952106a39ba877dc213e64b3facffa91ff826cb0abb56d4d40301da4ba5b6da208b76c69ae058503db0969b08756b65b80864f3cc9a0c93175021c7d
-
Filesize
277KB
MD513b541bf9ab4da1ff69ac5f7ca91d5be
SHA1712451a04532642f6da68e5b8c6308d4cf4a1a12
SHA256c39a47b1148ea0f5c60e444afadb07f370ab3c1505fafe53deee82a9151a4e95
SHA512f08effcd952106a39ba877dc213e64b3facffa91ff826cb0abb56d4d40301da4ba5b6da208b76c69ae058503db0969b08756b65b80864f3cc9a0c93175021c7d
-
Filesize
361KB
MD5f4a166256b1942eb7de08f20781fbc2d
SHA18f3c362203e8b1b4ad5e2c8e464bec782128399d
SHA2562e65bced896392101a93a63dc17ad237f3e5f261d175e1e6bedab0c1887c7ec8
SHA512d84ac3447bbede28f80959b2c178d64896827ffd1fccfe8c084db482f1ca1dcd5f082c5e9f60fb96ab4d5afc6e9e4788ca73d28b9d84030969813c8c082edcc4
-
Filesize
361KB
MD5f4a166256b1942eb7de08f20781fbc2d
SHA18f3c362203e8b1b4ad5e2c8e464bec782128399d
SHA2562e65bced896392101a93a63dc17ad237f3e5f261d175e1e6bedab0c1887c7ec8
SHA512d84ac3447bbede28f80959b2c178d64896827ffd1fccfe8c084db482f1ca1dcd5f082c5e9f60fb96ab4d5afc6e9e4788ca73d28b9d84030969813c8c082edcc4
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5