Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2023 17:18

General

  • Target

    d4d792bc2fbe0bb6a579f9df189d9c4239d5d0cf6cdfdd901619b7078c8d35adexe_JC.exe

  • Size

    517KB

  • MD5

    f0e42f1c12f17f3500eebe97c5a801eb

  • SHA1

    07030b8d147234e14e63b149c8fce42d59207670

  • SHA256

    d4d792bc2fbe0bb6a579f9df189d9c4239d5d0cf6cdfdd901619b7078c8d35ad

  • SHA512

    a2663e6d896d0c919c25ab275bc64b46c570ba038beaeaa83414627803ec85b41e46f8ce07dd5b5f671f969a8b0549374608b8f72beb84e88230568a2d21ca07

  • SSDEEP

    12288:qMr6y906oKC9L28vmgBzE9JM9y1Rtm9Tea2O:YyyZ9LJN+Y+mlepO

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Extracted

Family

redline

Botnet

papik

C2

77.91.124.156:19071

Attributes
  • auth_value

    325a615d8be5db8e2f7a4c2448fdac3a

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4d792bc2fbe0bb6a579f9df189d9c4239d5d0cf6cdfdd901619b7078c8d35adexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\d4d792bc2fbe0bb6a579f9df189d9c4239d5d0cf6cdfdd901619b7078c8d35adexe_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4252202.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4252202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8185957.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8185957.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6463256.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6463256.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1188
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8938132.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8938132.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
            "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2516
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:792
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4324
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:1136
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "pdates.exe" /P "Admin:N"
                  7⤵
                    PID:2692
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "pdates.exe" /P "Admin:R" /E
                    7⤵
                      PID:1848
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:1816
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\925e7e99c5" /P "Admin:N"
                        7⤵
                          PID:2000
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\925e7e99c5" /P "Admin:R" /E
                          7⤵
                            PID:4008
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:4504
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4312292.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4312292.exe
                    3⤵
                    • Executes dropped EXE
                    PID:5092
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:1220
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4772

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4252202.exe

                Filesize

                390KB

                MD5

                8f1e88040ce490c92b9baa2eed776d9a

                SHA1

                b314440673423292cafebdabce0789914b8b2681

                SHA256

                02474d9119ecff2d7c9328a84bca8a33068b4b6e89927984d60f682ec1095a91

                SHA512

                7c370f3f80e2140d7102f88f22334707f6deaa4000aec0fe1685868c52bcc04afb1c54e21cf2eb630d21c6d108c1d7974fe285aa8c353bb8e62df794354bb74f

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4252202.exe

                Filesize

                390KB

                MD5

                8f1e88040ce490c92b9baa2eed776d9a

                SHA1

                b314440673423292cafebdabce0789914b8b2681

                SHA256

                02474d9119ecff2d7c9328a84bca8a33068b4b6e89927984d60f682ec1095a91

                SHA512

                7c370f3f80e2140d7102f88f22334707f6deaa4000aec0fe1685868c52bcc04afb1c54e21cf2eb630d21c6d108c1d7974fe285aa8c353bb8e62df794354bb74f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4312292.exe

                Filesize

                173KB

                MD5

                f04dc5c3c36a0de4fa8fedc6e7d584c9

                SHA1

                3ef366830d9a186a543f91ffd1fea7e0d3dd9831

                SHA256

                07c33356d64bd342d85c05360cf1608bd936569ae3a86eda4f71b6fe99e5e701

                SHA512

                83681e9f05df753a06520d6a137283b67697d5e72f22021b466128ca9d7ab3dd761bc209a8887749dee58698bee3986f31158fded6b5732d9af999895a087cb6

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4312292.exe

                Filesize

                173KB

                MD5

                f04dc5c3c36a0de4fa8fedc6e7d584c9

                SHA1

                3ef366830d9a186a543f91ffd1fea7e0d3dd9831

                SHA256

                07c33356d64bd342d85c05360cf1608bd936569ae3a86eda4f71b6fe99e5e701

                SHA512

                83681e9f05df753a06520d6a137283b67697d5e72f22021b466128ca9d7ab3dd761bc209a8887749dee58698bee3986f31158fded6b5732d9af999895a087cb6

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8185957.exe

                Filesize

                234KB

                MD5

                04bf4ed915d363391be3903a00469776

                SHA1

                935875538ba2d85b6301496b7ccd9075752fb6f8

                SHA256

                950ecffd0127a9f5cf056621674e6522e5b788849a6ddbc09dc91cb7e752e620

                SHA512

                2a86a4ca43ddca2f31e7971ee7cfabce542e5cbc45995d4931efd836b6ed1629a78edd7ef961721ae8700e932dd96ca4db4227e4b7670ab09dd860e8e6e859ef

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8185957.exe

                Filesize

                234KB

                MD5

                04bf4ed915d363391be3903a00469776

                SHA1

                935875538ba2d85b6301496b7ccd9075752fb6f8

                SHA256

                950ecffd0127a9f5cf056621674e6522e5b788849a6ddbc09dc91cb7e752e620

                SHA512

                2a86a4ca43ddca2f31e7971ee7cfabce542e5cbc45995d4931efd836b6ed1629a78edd7ef961721ae8700e932dd96ca4db4227e4b7670ab09dd860e8e6e859ef

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6463256.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6463256.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8938132.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8938132.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                2392b231cf4a80739b5cb09bf808127d

                SHA1

                41b5cf81c50884954911d96444fe83cfd0da465b

                SHA256

                2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                SHA512

                19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                2392b231cf4a80739b5cb09bf808127d

                SHA1

                41b5cf81c50884954911d96444fe83cfd0da465b

                SHA256

                2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                SHA512

                19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                2392b231cf4a80739b5cb09bf808127d

                SHA1

                41b5cf81c50884954911d96444fe83cfd0da465b

                SHA256

                2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                SHA512

                19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                9851b884bf4aadfade57d911a3f03332

                SHA1

                aaadd1c1856c22844bb9fbb030cf4f586ed8866a

                SHA256

                03afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f

                SHA512

                a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327

              • memory/1188-155-0x00007FFA05990000-0x00007FFA06451000-memory.dmp

                Filesize

                10.8MB

              • memory/1188-157-0x00007FFA05990000-0x00007FFA06451000-memory.dmp

                Filesize

                10.8MB

              • memory/1188-154-0x00000000004A0000-0x00000000004AA000-memory.dmp

                Filesize

                40KB

              • memory/5092-179-0x0000000005940000-0x0000000005950000-memory.dmp

                Filesize

                64KB

              • memory/5092-178-0x00000000058C0000-0x00000000058D2000-memory.dmp

                Filesize

                72KB

              • memory/5092-180-0x0000000005A50000-0x0000000005A8C000-memory.dmp

                Filesize

                240KB

              • memory/5092-181-0x0000000073010000-0x00000000737C0000-memory.dmp

                Filesize

                7.7MB

              • memory/5092-182-0x0000000005940000-0x0000000005950000-memory.dmp

                Filesize

                64KB

              • memory/5092-177-0x0000000005B60000-0x0000000005C6A000-memory.dmp

                Filesize

                1.0MB

              • memory/5092-176-0x0000000006070000-0x0000000006688000-memory.dmp

                Filesize

                6.1MB

              • memory/5092-175-0x0000000000F00000-0x0000000000F30000-memory.dmp

                Filesize

                192KB

              • memory/5092-174-0x0000000073010000-0x00000000737C0000-memory.dmp

                Filesize

                7.7MB