Analysis

  • max time kernel
    104s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2023 13:36

General

  • Target

    7e8f635b8488863801bda838f35c9bb392cb43f5d5dd9e33d90e6999ba8d4b55.exe

  • Size

    678KB

  • MD5

    6d80b27cb2e4da081f0f7f37e638d00d

  • SHA1

    dd0302d5924f4fea018faedbb0a44782dfa73c47

  • SHA256

    7e8f635b8488863801bda838f35c9bb392cb43f5d5dd9e33d90e6999ba8d4b55

  • SHA512

    50301dce4d7229e6c954aebcdbb04cbd70d0f317e6b45796b1161998777f75f3cc9b64b085d8638d9ab9fdb6d1d80165a9b2b135c1e7a3ee40154be9ca55d35c

  • SSDEEP

    12288:lztKekjWeeIOZ2alWJSn/ZmuFJjIH1PjOMvH7lM7XbOUqXBQ1W:lkueetn/0VX/7lM7rOUOBQ1W

Malware Config

Extracted

Family

redline

Botnet

furga

C2

83.97.73.128:19071

Attributes
  • auth_value

    1b7af6db7a79a3475798fcf494818be7

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e8f635b8488863801bda838f35c9bb392cb43f5d5dd9e33d90e6999ba8d4b55.exe
    "C:\Users\Admin\AppData\Local\Temp\7e8f635b8488863801bda838f35c9bb392cb43f5d5dd9e33d90e6999ba8d4b55.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8500048.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8500048.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3801291.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3801291.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3793718.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3793718.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2172
        • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
          "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3856
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:224
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4828
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4496
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "rugen.exe" /P "Admin:N"
                6⤵
                  PID:3384
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "rugen.exe" /P "Admin:R" /E
                  6⤵
                    PID:4488
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3712
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\200f691d32" /P "Admin:N"
                      6⤵
                        PID:4400
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\200f691d32" /P "Admin:R" /E
                        6⤵
                          PID:812
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4032
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5603402.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5603402.exe
                  2⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Executes dropped EXE
                  • Windows security modification
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4284
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:1560
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:2460

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5603402.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5603402.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8500048.exe

                Filesize

                361KB

                MD5

                db1619009d4c2c5d0d27dffeb1f95a60

                SHA1

                6276cf2afdb0c6e0c8986a3f13038de4100820bb

                SHA256

                b855e6f14f2e48d947d1426c31613aa97b68802a00e08d4f925eb220ff2a0706

                SHA512

                eb96319af7bfc5efca0e655865869403a197f84ab16dfedb33306ed51cfe5963f25dc382ed852adf422c051d3cc72208492df9afc404d280916d1c1c29177a22

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8500048.exe

                Filesize

                361KB

                MD5

                db1619009d4c2c5d0d27dffeb1f95a60

                SHA1

                6276cf2afdb0c6e0c8986a3f13038de4100820bb

                SHA256

                b855e6f14f2e48d947d1426c31613aa97b68802a00e08d4f925eb220ff2a0706

                SHA512

                eb96319af7bfc5efca0e655865869403a197f84ab16dfedb33306ed51cfe5963f25dc382ed852adf422c051d3cc72208492df9afc404d280916d1c1c29177a22

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3801291.exe

                Filesize

                388KB

                MD5

                e375c7e8b74d0bb9560c3a3abf544090

                SHA1

                0dac45c4326eb228afb4029e9d19bf03098cb3ef

                SHA256

                75600de2af3801eed9fa78598312d830672bf03a1d757466385e4f09af6840db

                SHA512

                e46e5d4c6be26674e3039593bbfa418e2b6defdaa672d3f8e7142879bd6785fc7cd0b8b590bf8698ddf02de526f9b505088d628a112f4b303102f2aedda18c64

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3801291.exe

                Filesize

                388KB

                MD5

                e375c7e8b74d0bb9560c3a3abf544090

                SHA1

                0dac45c4326eb228afb4029e9d19bf03098cb3ef

                SHA256

                75600de2af3801eed9fa78598312d830672bf03a1d757466385e4f09af6840db

                SHA512

                e46e5d4c6be26674e3039593bbfa418e2b6defdaa672d3f8e7142879bd6785fc7cd0b8b590bf8698ddf02de526f9b505088d628a112f4b303102f2aedda18c64

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3793718.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3793718.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/544-190-0x0000000000580000-0x00000000005F9000-memory.dmp

                Filesize

                484KB

              • memory/544-133-0x0000000000580000-0x00000000005F9000-memory.dmp

                Filesize

                484KB

              • memory/4284-188-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB

              • memory/4532-159-0x0000000004B10000-0x0000000004B22000-memory.dmp

                Filesize

                72KB

              • memory/4532-169-0x0000000006F40000-0x0000000006F90000-memory.dmp

                Filesize

                320KB

              • memory/4532-168-0x0000000006670000-0x0000000006B9C000-memory.dmp

                Filesize

                5.2MB

              • memory/4532-167-0x00000000064A0000-0x0000000006662000-memory.dmp

                Filesize

                1.8MB

              • memory/4532-166-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                Filesize

                64KB

              • memory/4532-165-0x00000000056B0000-0x0000000005716000-memory.dmp

                Filesize

                408KB

              • memory/4532-164-0x0000000005CF0000-0x0000000006294000-memory.dmp

                Filesize

                5.6MB

              • memory/4532-163-0x00000000055D0000-0x0000000005662000-memory.dmp

                Filesize

                584KB

              • memory/4532-162-0x0000000005550000-0x00000000055C6000-memory.dmp

                Filesize

                472KB

              • memory/4532-161-0x0000000004B30000-0x0000000004B6C000-memory.dmp

                Filesize

                240KB

              • memory/4532-160-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                Filesize

                64KB

              • memory/4532-158-0x00000000052E0000-0x00000000053EA000-memory.dmp

                Filesize

                1.0MB

              • memory/4532-157-0x0000000004CC0000-0x00000000052D8000-memory.dmp

                Filesize

                6.1MB

              • memory/4532-153-0x0000000000470000-0x00000000004A0000-memory.dmp

                Filesize

                192KB