Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 13:31
Static task
static1
Behavioral task
behavioral1
Sample
0072754ea310d3ab63dc743ae1fc2819.exe
Resource
win7-20230220-en
General
-
Target
0072754ea310d3ab63dc743ae1fc2819.exe
-
Size
387KB
-
MD5
0072754ea310d3ab63dc743ae1fc2819
-
SHA1
9e29fc0843621a454389e3bba2402a5325de85d1
-
SHA256
53df093c0651939cdb511f6016b37962f3672633420b7b6e6a7e8e09f93f9296
-
SHA512
c7f33875e605cc20fcdc4abcc2c9ef3e4a0c32cf36db272b2fcfeaf8a1b3d74f161bfe3c2e03a979716cc586b95be88a5744348d6dc2363827cd9dcbb2cb4b7d
-
SSDEEP
12288:UMrty90fgj/siVzW/xVQwO678eQZEFQw2MhF5:Zya+/XVYKAXQZEFhzv5
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
Processes:
o8074124.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o8074124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection o8074124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o8074124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o8074124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o8074124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o8074124.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s2290739.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation s2290739.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
Processes:
z8710400.exeo8074124.exer1504477.exes2290739.exeoneetx.exeoneetx.exeoneetx.exepid process 5044 z8710400.exe 4792 o8074124.exe 4116 r1504477.exe 3428 s2290739.exe 1152 oneetx.exe 2256 oneetx.exe 1996 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4512 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o8074124.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" o8074124.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
z8710400.exe0072754ea310d3ab63dc743ae1fc2819.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8710400.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0072754ea310d3ab63dc743ae1fc2819.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0072754ea310d3ab63dc743ae1fc2819.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z8710400.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o8074124.exer1504477.exepid process 4792 o8074124.exe 4792 o8074124.exe 4116 r1504477.exe 4116 r1504477.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
o8074124.exer1504477.exedescription pid process Token: SeDebugPrivilege 4792 o8074124.exe Token: SeDebugPrivilege 4116 r1504477.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s2290739.exepid process 3428 s2290739.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
0072754ea310d3ab63dc743ae1fc2819.exez8710400.exes2290739.exeoneetx.exedescription pid process target process PID 1664 wrote to memory of 5044 1664 0072754ea310d3ab63dc743ae1fc2819.exe z8710400.exe PID 1664 wrote to memory of 5044 1664 0072754ea310d3ab63dc743ae1fc2819.exe z8710400.exe PID 1664 wrote to memory of 5044 1664 0072754ea310d3ab63dc743ae1fc2819.exe z8710400.exe PID 5044 wrote to memory of 4792 5044 z8710400.exe o8074124.exe PID 5044 wrote to memory of 4792 5044 z8710400.exe o8074124.exe PID 5044 wrote to memory of 4116 5044 z8710400.exe r1504477.exe PID 5044 wrote to memory of 4116 5044 z8710400.exe r1504477.exe PID 5044 wrote to memory of 4116 5044 z8710400.exe r1504477.exe PID 1664 wrote to memory of 3428 1664 0072754ea310d3ab63dc743ae1fc2819.exe s2290739.exe PID 1664 wrote to memory of 3428 1664 0072754ea310d3ab63dc743ae1fc2819.exe s2290739.exe PID 1664 wrote to memory of 3428 1664 0072754ea310d3ab63dc743ae1fc2819.exe s2290739.exe PID 3428 wrote to memory of 1152 3428 s2290739.exe oneetx.exe PID 3428 wrote to memory of 1152 3428 s2290739.exe oneetx.exe PID 3428 wrote to memory of 1152 3428 s2290739.exe oneetx.exe PID 1152 wrote to memory of 880 1152 oneetx.exe schtasks.exe PID 1152 wrote to memory of 880 1152 oneetx.exe schtasks.exe PID 1152 wrote to memory of 880 1152 oneetx.exe schtasks.exe PID 1152 wrote to memory of 4512 1152 oneetx.exe rundll32.exe PID 1152 wrote to memory of 4512 1152 oneetx.exe rundll32.exe PID 1152 wrote to memory of 4512 1152 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0072754ea310d3ab63dc743ae1fc2819.exe"C:\Users\Admin\AppData\Local\Temp\0072754ea310d3ab63dc743ae1fc2819.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8710400.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8710400.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8074124.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8074124.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1504477.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1504477.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2290739.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2290739.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2290739.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s2290739.exeFilesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8710400.exeFilesize
204KB
MD5ab399d617706b0743ece7ad50644d13b
SHA1d3aeb883925ff2070102024e8b5819fd7bbe597d
SHA256fa5a9b98bdfa79df807d5b4b278a4d8896bee0add00733191a8a3c62fc4b05e2
SHA51256c9dc182dac238036227c5cafeb6a44529cc3baa684b5425088bfbb87f7a795ef3b2fd3c5a5c4825307ebef1c35f38f8e46e83fa8d3db0dac6e356e33df9d45
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8710400.exeFilesize
204KB
MD5ab399d617706b0743ece7ad50644d13b
SHA1d3aeb883925ff2070102024e8b5819fd7bbe597d
SHA256fa5a9b98bdfa79df807d5b4b278a4d8896bee0add00733191a8a3c62fc4b05e2
SHA51256c9dc182dac238036227c5cafeb6a44529cc3baa684b5425088bfbb87f7a795ef3b2fd3c5a5c4825307ebef1c35f38f8e46e83fa8d3db0dac6e356e33df9d45
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8074124.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8074124.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1504477.exeFilesize
136KB
MD501e7f3aa2b3597ed40f94ac0cf84b626
SHA14626feabe775d18b0b570fb4f465080b65a23a70
SHA2566a85b6ba77d0d693ce006581a02f20eb39004a087a42f02adc4f79d069f44f26
SHA51212162cc920a43b973e1f1a788b5a48df89c531848b19ec6ac1dd08851a277885a4e5d839097e3640bc258e312cda81bc4555d3da9ad8279aff518fad536ead76
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1504477.exeFilesize
136KB
MD501e7f3aa2b3597ed40f94ac0cf84b626
SHA14626feabe775d18b0b570fb4f465080b65a23a70
SHA2566a85b6ba77d0d693ce006581a02f20eb39004a087a42f02adc4f79d069f44f26
SHA51212162cc920a43b973e1f1a788b5a48df89c531848b19ec6ac1dd08851a277885a4e5d839097e3640bc258e312cda81bc4555d3da9ad8279aff518fad536ead76
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/4116-153-0x0000000007310000-0x0000000007928000-memory.dmpFilesize
6.1MB
-
memory/4116-163-0x00000000088E0000-0x0000000008AA2000-memory.dmpFilesize
1.8MB
-
memory/4116-164-0x0000000008FE0000-0x000000000950C000-memory.dmpFilesize
5.2MB
-
memory/4116-165-0x00000000080D0000-0x00000000080EE000-memory.dmpFilesize
120KB
-
memory/4116-162-0x0000000007EA0000-0x0000000007F16000-memory.dmpFilesize
472KB
-
memory/4116-161-0x0000000007DD0000-0x0000000007E20000-memory.dmpFilesize
320KB
-
memory/4116-160-0x0000000008330000-0x00000000088D4000-memory.dmpFilesize
5.6MB
-
memory/4116-159-0x0000000007CE0000-0x0000000007D72000-memory.dmpFilesize
584KB
-
memory/4116-158-0x0000000007140000-0x00000000071A6000-memory.dmpFilesize
408KB
-
memory/4116-157-0x0000000006E20000-0x0000000006E30000-memory.dmpFilesize
64KB
-
memory/4116-156-0x0000000006E30000-0x0000000006E6C000-memory.dmpFilesize
240KB
-
memory/4116-155-0x0000000006ED0000-0x0000000006FDA000-memory.dmpFilesize
1.0MB
-
memory/4116-154-0x0000000006DA0000-0x0000000006DB2000-memory.dmpFilesize
72KB
-
memory/4116-152-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/4792-147-0x0000000000EB0000-0x0000000000EBA000-memory.dmpFilesize
40KB