Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2023 23:46
Static task
static1
Behavioral task
behavioral1
Sample
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe
Resource
win7-20230712-en
General
-
Target
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe
-
Size
6.5MB
-
MD5
89e9bc7a5d97370a0f4a35041a54a696
-
SHA1
c0e8572f48b2e5f83c39374f4175e35a5e7c2029
-
SHA256
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
-
SHA512
12100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2
-
SSDEEP
196608:3PbBDSjGzSuyKff2j6pdVY3d2dZo2tOuAX+W6+B6VJN1lev:3JKGzXuTwdZdLM+JS
Malware Config
Extracted
amadey
3.80
45.15.156.208/jd9dd3Vw/index.php
second.amadgood.com/jd9dd3Vw/index.php
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2756 oneetx.exe 1848 oneetx.exe 2608 oneetx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1164 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1372 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe 1372 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe 2756 oneetx.exe 2756 oneetx.exe 1848 oneetx.exe 1848 oneetx.exe 2608 oneetx.exe 2608 oneetx.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1372 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1372 wrote to memory of 2756 1372 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe 86 PID 1372 wrote to memory of 2756 1372 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe 86 PID 1372 wrote to memory of 2756 1372 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe 86 PID 2756 wrote to memory of 1164 2756 oneetx.exe 90 PID 2756 wrote to memory of 1164 2756 oneetx.exe 90 PID 2756 wrote to memory of 1164 2756 oneetx.exe 90 PID 2756 wrote to memory of 3468 2756 oneetx.exe 92 PID 2756 wrote to memory of 3468 2756 oneetx.exe 92 PID 2756 wrote to memory of 3468 2756 oneetx.exe 92 PID 3468 wrote to memory of 884 3468 cmd.exe 95 PID 3468 wrote to memory of 884 3468 cmd.exe 95 PID 3468 wrote to memory of 884 3468 cmd.exe 95 PID 3468 wrote to memory of 4836 3468 cmd.exe 96 PID 3468 wrote to memory of 4836 3468 cmd.exe 96 PID 3468 wrote to memory of 4836 3468 cmd.exe 96 PID 3468 wrote to memory of 4644 3468 cmd.exe 97 PID 3468 wrote to memory of 4644 3468 cmd.exe 97 PID 3468 wrote to memory of 4644 3468 cmd.exe 97 PID 3468 wrote to memory of 560 3468 cmd.exe 100 PID 3468 wrote to memory of 560 3468 cmd.exe 100 PID 3468 wrote to memory of 560 3468 cmd.exe 100 PID 3468 wrote to memory of 1380 3468 cmd.exe 98 PID 3468 wrote to memory of 1380 3468 cmd.exe 98 PID 3468 wrote to memory of 1380 3468 cmd.exe 98 PID 3468 wrote to memory of 8 3468 cmd.exe 99 PID 3468 wrote to memory of 8 3468 cmd.exe 99 PID 3468 wrote to memory of 8 3468 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe"C:\Users\Admin\AppData\Local\Temp\9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F3⤵
- Creates scheduled task(s)
PID:1164
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\eb0f58bce7" /P "Admin:N"&&CACLS "..\eb0f58bce7" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:884
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵PID:4836
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵PID:4644
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\eb0f58bce7" /P "Admin:N"4⤵PID:1380
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\eb0f58bce7" /P "Admin:R" /E4⤵PID:8
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exeC:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1848
-
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exeC:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD52841eaa48ad70635c173051bc9169e9e
SHA113d1c16636def5fdcb586d0e2de10bc20c8b44fc
SHA256e81f0dc876fec6f0a99575dfa8f9d411fbe3b2ee6431a7bed218658b1daef179
SHA51273f1d7914d1d9823ded79b99a32fe4af1f2dc4603314303ebc2397a723b52757b646175d031bd7c25317954e1a42b1b20518906bbec4ce10a9dbf6f486583840
-
Filesize
6.5MB
MD589e9bc7a5d97370a0f4a35041a54a696
SHA1c0e8572f48b2e5f83c39374f4175e35a5e7c2029
SHA2569b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
SHA51212100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2
-
Filesize
6.5MB
MD589e9bc7a5d97370a0f4a35041a54a696
SHA1c0e8572f48b2e5f83c39374f4175e35a5e7c2029
SHA2569b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
SHA51212100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2
-
Filesize
6.5MB
MD589e9bc7a5d97370a0f4a35041a54a696
SHA1c0e8572f48b2e5f83c39374f4175e35a5e7c2029
SHA2569b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
SHA51212100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2
-
Filesize
6.5MB
MD589e9bc7a5d97370a0f4a35041a54a696
SHA1c0e8572f48b2e5f83c39374f4175e35a5e7c2029
SHA2569b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
SHA51212100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2
-
Filesize
6.5MB
MD589e9bc7a5d97370a0f4a35041a54a696
SHA1c0e8572f48b2e5f83c39374f4175e35a5e7c2029
SHA2569b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
SHA51212100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2