Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/08/2023, 17:09

General

  • Target

    19075b51eae10ea351949b8705d55a2753c3b922c4ea4274b872f0eedd7892fd.exe

  • Size

    555KB

  • MD5

    b35ba510e6450a2baf91afe3ecc66cbe

  • SHA1

    67b7c94ef0483d0e01afa1f90c66ded0f2a8eeca

  • SHA256

    19075b51eae10ea351949b8705d55a2753c3b922c4ea4274b872f0eedd7892fd

  • SHA512

    72857272a943bcac0d1b8ac55125abb0b1686c9cd2365e4a05949199e512c333ce437957d4060f93df59e9984373a8ec483719ca2412042ff1e44f68f2a30187

  • SSDEEP

    12288:jMrky909zP89t7yxY6ukV92c0meSyquxtqg2fOjiHoDViFPQrG:ny2zg2hn2cKyDfEYQrG

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Extracted

Family

redline

Botnet

micky

C2

77.91.124.172:19071

Attributes
  • auth_value

    748f3c67c004f4a994500f05127b4428

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19075b51eae10ea351949b8705d55a2753c3b922c4ea4274b872f0eedd7892fd.exe
    "C:\Users\Admin\AppData\Local\Temp\19075b51eae10ea351949b8705d55a2753c3b922c4ea4274b872f0eedd7892fd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9039675.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9039675.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9557655.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9557655.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3460
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4389227.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4389227.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2728
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1338126.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1338126.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
            "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4468
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4396
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2708
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:844
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "pdates.exe" /P "Admin:N"
                  7⤵
                    PID:1004
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "pdates.exe" /P "Admin:R" /E
                    7⤵
                      PID:2992
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:3260
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\925e7e99c5" /P "Admin:N"
                        7⤵
                          PID:5040
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\925e7e99c5" /P "Admin:R" /E
                          7⤵
                            PID:4892
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:2176
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2812522.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2812522.exe
                    3⤵
                    • Executes dropped EXE
                    PID:228
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:1000
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4056

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9039675.exe

                      Filesize

                      390KB

                      MD5

                      eb2cbb0dcc81321e379de5ee2cee4531

                      SHA1

                      f4a3c5e885a1786b0f22d8c1dcaa78fa39667cb0

                      SHA256

                      afdc8ffe3dc7aa7eef688834fac1bc96ae87f7da3b8c5d7e2a6c8e9773cd4790

                      SHA512

                      2519ea9adbe272fecc4bc7a60546f1ab8ab5ee3bd79db944b4adfbca86f627fbd68de75be5b3283e4612e93a9d51fcba2f87b937a334e07c07519570b555b251

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9039675.exe

                      Filesize

                      390KB

                      MD5

                      eb2cbb0dcc81321e379de5ee2cee4531

                      SHA1

                      f4a3c5e885a1786b0f22d8c1dcaa78fa39667cb0

                      SHA256

                      afdc8ffe3dc7aa7eef688834fac1bc96ae87f7da3b8c5d7e2a6c8e9773cd4790

                      SHA512

                      2519ea9adbe272fecc4bc7a60546f1ab8ab5ee3bd79db944b4adfbca86f627fbd68de75be5b3283e4612e93a9d51fcba2f87b937a334e07c07519570b555b251

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2812522.exe

                      Filesize

                      174KB

                      MD5

                      2fd2f8a12d2697720452577597c8eff2

                      SHA1

                      eb0faa3ed237606412ab72d4a1c0d9d258d61983

                      SHA256

                      56a8560d82115ffd86e5b47321bde832c930736d2acf9e8e7bd190fe1830b888

                      SHA512

                      1fc8fc239c7fd6b4d81b73fb354de74dd8731acb87c6ea983f40c0764c64c51f4d10a707f5f9d9ac7cdd8abcb49388b8f0afd45d0c32c3803cd790f90fc67f5f

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2812522.exe

                      Filesize

                      174KB

                      MD5

                      2fd2f8a12d2697720452577597c8eff2

                      SHA1

                      eb0faa3ed237606412ab72d4a1c0d9d258d61983

                      SHA256

                      56a8560d82115ffd86e5b47321bde832c930736d2acf9e8e7bd190fe1830b888

                      SHA512

                      1fc8fc239c7fd6b4d81b73fb354de74dd8731acb87c6ea983f40c0764c64c51f4d10a707f5f9d9ac7cdd8abcb49388b8f0afd45d0c32c3803cd790f90fc67f5f

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9557655.exe

                      Filesize

                      234KB

                      MD5

                      6f621e513142d2daa1bbb4e7c0727ce6

                      SHA1

                      01c90949d76eac8a3ecba11b5f33686cb8bd96c2

                      SHA256

                      35f9781e3535b0fc76335ef85bbc13887550444ee7f7f0cf7f13130b6bc87e54

                      SHA512

                      935e37f68e6b22ce750748d1064679565411579732b633a2fe8ea4c4d3b09809be2a5a13678f5ab41b40048247559fa74776b7e54efb9ef9757a84806b9ad4e3

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9557655.exe

                      Filesize

                      234KB

                      MD5

                      6f621e513142d2daa1bbb4e7c0727ce6

                      SHA1

                      01c90949d76eac8a3ecba11b5f33686cb8bd96c2

                      SHA256

                      35f9781e3535b0fc76335ef85bbc13887550444ee7f7f0cf7f13130b6bc87e54

                      SHA512

                      935e37f68e6b22ce750748d1064679565411579732b633a2fe8ea4c4d3b09809be2a5a13678f5ab41b40048247559fa74776b7e54efb9ef9757a84806b9ad4e3

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4389227.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4389227.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1338126.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1338126.exe

                      Filesize

                      223KB

                      MD5

                      aea234064483f651010cf9d981f59fea

                      SHA1

                      002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                      SHA256

                      58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                      SHA512

                      eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                      Filesize

                      89KB

                      MD5

                      2392b231cf4a80739b5cb09bf808127d

                      SHA1

                      41b5cf81c50884954911d96444fe83cfd0da465b

                      SHA256

                      2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                      SHA512

                      19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

                    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                      Filesize

                      89KB

                      MD5

                      2392b231cf4a80739b5cb09bf808127d

                      SHA1

                      41b5cf81c50884954911d96444fe83cfd0da465b

                      SHA256

                      2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                      SHA512

                      19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

                    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                      Filesize

                      273B

                      MD5

                      9851b884bf4aadfade57d911a3f03332

                      SHA1

                      aaadd1c1856c22844bb9fbb030cf4f586ed8866a

                      SHA256

                      03afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f

                      SHA512

                      a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327

                    • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                      Filesize

                      89KB

                      MD5

                      2392b231cf4a80739b5cb09bf808127d

                      SHA1

                      41b5cf81c50884954911d96444fe83cfd0da465b

                      SHA256

                      2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                      SHA512

                      19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

                    • memory/228-160-0x00000000030C0000-0x00000000030D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/228-159-0x0000000005880000-0x000000000598A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/228-158-0x0000000005D80000-0x0000000006386000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/228-161-0x0000000005670000-0x00000000056AE000-memory.dmp

                      Filesize

                      248KB

                    • memory/228-162-0x00000000056C0000-0x000000000570B000-memory.dmp

                      Filesize

                      300KB

                    • memory/228-157-0x0000000001590000-0x0000000001596000-memory.dmp

                      Filesize

                      24KB

                    • memory/228-164-0x0000000072A10000-0x00000000730FE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/228-156-0x0000000072A10000-0x00000000730FE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/228-155-0x0000000000D00000-0x0000000000D30000-memory.dmp

                      Filesize

                      192KB

                    • memory/2728-141-0x00007FFA36E50000-0x00007FFA3783C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2728-139-0x00007FFA36E50000-0x00007FFA3783C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2728-138-0x0000000000ED0000-0x0000000000EDA000-memory.dmp

                      Filesize

                      40KB