Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2023 07:14

General

  • Target

    07997599.exe

  • Size

    601KB

  • MD5

    3a71a379301253c3e11a642ee4c9bb64

  • SHA1

    8ebb3dff2a51036b915574ab1cfb6af6ea6be995

  • SHA256

    ae40c90310290f4703918907fbb5c6ed84dd9f88e8231940d3bc695456741fdd

  • SHA512

    ede90eca3d3f8d894b2d5de8afbafab719d5d5ffec639b83b2ac6af97c4282b144ceee0f81ee7d86d2f0befb76fb7e714224dfb509f3c62329722b8d2088e440

  • SSDEEP

    12288:PMrgy90OWIDBvks2pIQO8I0aRc+hnh5MxgZFUT2ahUfoxUT:nyLV2+Q1I0k8xgZFihiQu

Malware Config

Extracted

Family

redline

Botnet

duha

C2

83.97.73.129:19068

Attributes
  • auth_value

    aafe99874c3b8854069470882e00246c

Extracted

Family

amadey

Version

3.83

C2

77.91.68.30/music/rock/index.php

Extracted

Family

redline

Botnet

crazy

C2

83.97.73.129:19068

Attributes
  • auth_value

    66bc4d9682ea090eef64a299ece12fdd

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07997599.exe
    "C:\Users\Admin\AppData\Local\Temp\07997599.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5849581.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5849581.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4190311.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4190311.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4393046.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4393046.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3656
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9570739.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9570739.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1928
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9536262.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9536262.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3788
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2960
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2156
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3568
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3992
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "lamod.exe" /P "Admin:N"
                6⤵
                  PID:1280
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "lamod.exe" /P "Admin:R" /E
                  6⤵
                    PID:4652
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:4756
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:3476
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:5024
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4308
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4067536.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4067536.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2464
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3776
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 152
                    3⤵
                    • Program crash
                    PID:2668
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2464 -ip 2464
                1⤵
                  PID:4696
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4264
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4336

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4067536.exe

                  Filesize

                  308KB

                  MD5

                  2cd1b21e300b5ed838f852a1025dbe95

                  SHA1

                  3cec12a2eb3da16b6c73cc6cf02dd7b4cc790ca7

                  SHA256

                  921573f741f30f2bf466f7d0c7e95ec2f5e854ab166914802b0be813e1fc000d

                  SHA512

                  b9fe2939717b381ed354b7c84823d3902f44763119b6896c99601aa043b6a44a8f8f57f33f5db4d55e17d7500a35c68298be80ded7ee3bec80e0f1d2bc5dbf27

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i4067536.exe

                  Filesize

                  308KB

                  MD5

                  2cd1b21e300b5ed838f852a1025dbe95

                  SHA1

                  3cec12a2eb3da16b6c73cc6cf02dd7b4cc790ca7

                  SHA256

                  921573f741f30f2bf466f7d0c7e95ec2f5e854ab166914802b0be813e1fc000d

                  SHA512

                  b9fe2939717b381ed354b7c84823d3902f44763119b6896c99601aa043b6a44a8f8f57f33f5db4d55e17d7500a35c68298be80ded7ee3bec80e0f1d2bc5dbf27

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5849581.exe

                  Filesize

                  377KB

                  MD5

                  a7e286222599bd91887be64d15f52786

                  SHA1

                  f3fb95c9359704661b12ff0f213d9719673c2692

                  SHA256

                  9cbc050a562886666a2d0dd13a039469f504eee8bc4a9d8b41be113a4c20765c

                  SHA512

                  8e6f87ca2a547e1c9644c6d112c918e7192a46592fe00e9a0cf7107fdd27b8285413f4883db1829e97dabb1768c2b62e0740eae11445e581ff588bf44b6b45e8

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5849581.exe

                  Filesize

                  377KB

                  MD5

                  a7e286222599bd91887be64d15f52786

                  SHA1

                  f3fb95c9359704661b12ff0f213d9719673c2692

                  SHA256

                  9cbc050a562886666a2d0dd13a039469f504eee8bc4a9d8b41be113a4c20765c

                  SHA512

                  8e6f87ca2a547e1c9644c6d112c918e7192a46592fe00e9a0cf7107fdd27b8285413f4883db1829e97dabb1768c2b62e0740eae11445e581ff588bf44b6b45e8

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9536262.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9536262.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4190311.exe

                  Filesize

                  206KB

                  MD5

                  428ec959b35875dd19b6e593c316ee34

                  SHA1

                  2070065719765c243410d111787e8868e737915e

                  SHA256

                  d573f8c9358457404c923fbd3d1b15a56bd73486ad2fbfa3051ab7aa78f3b69c

                  SHA512

                  a969f4de36834cd427bcb85db63b53c34fa754aca6ffbda25581f2e9f1384e6d17a77112446f18ec568bd49e14cad53c359373f274343b3fa0941a86fa65db2e

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4190311.exe

                  Filesize

                  206KB

                  MD5

                  428ec959b35875dd19b6e593c316ee34

                  SHA1

                  2070065719765c243410d111787e8868e737915e

                  SHA256

                  d573f8c9358457404c923fbd3d1b15a56bd73486ad2fbfa3051ab7aa78f3b69c

                  SHA512

                  a969f4de36834cd427bcb85db63b53c34fa754aca6ffbda25581f2e9f1384e6d17a77112446f18ec568bd49e14cad53c359373f274343b3fa0941a86fa65db2e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4393046.exe

                  Filesize

                  172KB

                  MD5

                  a59a242d0dbcdf13c197804479568c34

                  SHA1

                  43a5fa54d53307008e1e017e0e6316e2792cca5d

                  SHA256

                  c30ceb94deac28207dc6a20317ae97ecc85f673885adfa5784f2c36b682582e7

                  SHA512

                  f49a5ae6febf11ccbb201638b4a0d696a34c792f666d793033045a1c298cfa0c770682be2058afca58d333600245fa01dcb35e757104be5af578cead968a86a6

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4393046.exe

                  Filesize

                  172KB

                  MD5

                  a59a242d0dbcdf13c197804479568c34

                  SHA1

                  43a5fa54d53307008e1e017e0e6316e2792cca5d

                  SHA256

                  c30ceb94deac28207dc6a20317ae97ecc85f673885adfa5784f2c36b682582e7

                  SHA512

                  f49a5ae6febf11ccbb201638b4a0d696a34c792f666d793033045a1c298cfa0c770682be2058afca58d333600245fa01dcb35e757104be5af578cead968a86a6

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9570739.exe

                  Filesize

                  11KB

                  MD5

                  1512bcfb3b7bdfdcff7580626d727f21

                  SHA1

                  2857ad22f454b9b0de1586b7680c47b23ebb248d

                  SHA256

                  15f4f280c1144c200d8df96fd1be01cbd5b5908d21c1b3e3fcff5bcaba6e676a

                  SHA512

                  ea72094ec5ff856cb54f5829efac896341412cad373a9401b8ac6322bb41517901f115afa817bbabb6a7ccd7610739caefc92af08e4b06758f93dbd29c36b12b

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9570739.exe

                  Filesize

                  11KB

                  MD5

                  1512bcfb3b7bdfdcff7580626d727f21

                  SHA1

                  2857ad22f454b9b0de1586b7680c47b23ebb248d

                  SHA256

                  15f4f280c1144c200d8df96fd1be01cbd5b5908d21c1b3e3fcff5bcaba6e676a

                  SHA512

                  ea72094ec5ff856cb54f5829efac896341412cad373a9401b8ac6322bb41517901f115afa817bbabb6a7ccd7610739caefc92af08e4b06758f93dbd29c36b12b

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  209KB

                  MD5

                  0a99a45a350f6b7e2f6f189e7ac1fae9

                  SHA1

                  2b67408ed0f3bf441814fe533c2532397570ace9

                  SHA256

                  903b6873aa90db9927e799cc735ac702ded5284de209b5d24a685c6e07c4fe05

                  SHA512

                  e204aaba93563786d88411c1734fda0eda0b1b0cc425cb2fae8fbff36911e4b78e584aa119708eabc08fad9644cbe1f6c1516de093cd5018492d4ba3aa5ef837

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/1928-172-0x0000000000C30000-0x0000000000C3A000-memory.dmp

                  Filesize

                  40KB

                • memory/3656-157-0x000000000A1B0000-0x000000000A1C2000-memory.dmp

                  Filesize

                  72KB

                • memory/3656-161-0x000000000ADA0000-0x000000000AE32000-memory.dmp

                  Filesize

                  584KB

                • memory/3656-166-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

                  Filesize

                  64KB

                • memory/3656-165-0x000000000C0A0000-0x000000000C5CC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3656-164-0x000000000B9A0000-0x000000000BB62000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3656-163-0x000000000AE40000-0x000000000AEA6000-memory.dmp

                  Filesize

                  408KB

                • memory/3656-162-0x000000000B3F0000-0x000000000B994000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3656-167-0x000000000B320000-0x000000000B370000-memory.dmp

                  Filesize

                  320KB

                • memory/3656-160-0x000000000A620000-0x000000000A696000-memory.dmp

                  Filesize

                  472KB

                • memory/3656-154-0x00000000002F0000-0x0000000000320000-memory.dmp

                  Filesize

                  192KB

                • memory/3656-155-0x000000000A780000-0x000000000AD98000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3656-159-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

                  Filesize

                  64KB

                • memory/3656-158-0x000000000A210000-0x000000000A24C000-memory.dmp

                  Filesize

                  240KB

                • memory/3656-156-0x000000000A270000-0x000000000A37A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3776-195-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                  Filesize

                  64KB

                • memory/3776-190-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB