Analysis

  • max time kernel
    135s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/08/2023, 19:25

General

  • Target

    eef8c20f1e7b59d35e829b1255b0e1a1c4c64baa863287af8ff293aca88b997c.exe

  • Size

    1.4MB

  • MD5

    b123c79d36be9ea9056081549aceca80

  • SHA1

    0b3917f0d9219ee35df516accd37509d6887578c

  • SHA256

    eef8c20f1e7b59d35e829b1255b0e1a1c4c64baa863287af8ff293aca88b997c

  • SHA512

    7de8c1fa16761f80ad99c31368164121db6efca6a5ba4f57ebe61084b02c119a35393dcb7a6ebfc145673d94344ecb5fdd1e6829dbc3950772ffc652e953c34d

  • SSDEEP

    24576:Sy3+W8KyhjyUjV62OKM3GGJ26f/uMIkDGlMYOw1xjTUnz9hAqmX9LLtgtDxFgBTL:53+gyAUZYKM3GGXfWxMYOw1FgzzA7Lt3

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes
  • auth_value

    db6d96c4eade05afc28c31d9ad73a73c

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eef8c20f1e7b59d35e829b1255b0e1a1c4c64baa863287af8ff293aca88b997c.exe
    "C:\Users\Admin\AppData\Local\Temp\eef8c20f1e7b59d35e829b1255b0e1a1c4c64baa863287af8ff293aca88b997c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4327228.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4327228.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5074580.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5074580.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3732
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1157476.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1157476.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4861210.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4861210.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2088
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2080
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:2028
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3380
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:4976
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:1060
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:2596
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:3368
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:2616
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:3736
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:2164
                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m6686537.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m6686537.exe
                        5⤵
                        • Executes dropped EXE
                        PID:1148
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1177302.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1177302.exe
                      4⤵
                      • Executes dropped EXE
                      PID:4632
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4440
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:2744

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4327228.exe

                Filesize

                1.3MB

                MD5

                ef806472925a9fe4cfb1386e9c1e4687

                SHA1

                d323b75fd49aeb20ae8ea080bbd2699ddaddeffb

                SHA256

                0d6cc6d4eda12e91b1cc08a8c685a8dc673a7de6b428ee757090473e91aa2abc

                SHA512

                2f9270da23208e03da38cbce8cffc81d111c59942085509809d76020fa3d222911a8005d0876b69c3edd162ecfcddfaa3d65da1350ed85983988e64be7216279

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4327228.exe

                Filesize

                1.3MB

                MD5

                ef806472925a9fe4cfb1386e9c1e4687

                SHA1

                d323b75fd49aeb20ae8ea080bbd2699ddaddeffb

                SHA256

                0d6cc6d4eda12e91b1cc08a8c685a8dc673a7de6b428ee757090473e91aa2abc

                SHA512

                2f9270da23208e03da38cbce8cffc81d111c59942085509809d76020fa3d222911a8005d0876b69c3edd162ecfcddfaa3d65da1350ed85983988e64be7216279

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5074580.exe

                Filesize

                475KB

                MD5

                a97e6d28d980fb7ee7d09369e2aeadcc

                SHA1

                8391fac3f30db479d5f5ab8be8b5da37f08b367b

                SHA256

                e4453c36c85e49b05d56488728274c0b104535aac50c68dffd67ea2f6158aa83

                SHA512

                8d846f4974bafc8080768b076d117073a64607e06a31af7ffa0db0ccbf1eb05b51220096efb9bf35eb025c88516e8e15f7c5c79d4a9870b44f0b3e11f2baefd3

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5074580.exe

                Filesize

                475KB

                MD5

                a97e6d28d980fb7ee7d09369e2aeadcc

                SHA1

                8391fac3f30db479d5f5ab8be8b5da37f08b367b

                SHA256

                e4453c36c85e49b05d56488728274c0b104535aac50c68dffd67ea2f6158aa83

                SHA512

                8d846f4974bafc8080768b076d117073a64607e06a31af7ffa0db0ccbf1eb05b51220096efb9bf35eb025c88516e8e15f7c5c79d4a9870b44f0b3e11f2baefd3

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1177302.exe

                Filesize

                175KB

                MD5

                b0058304f5e7d13d5c9c01c573aa454f

                SHA1

                55dc07bc545e59e1e6b791186be7d5d0de5f7701

                SHA256

                fa666bd8f9d7ac54772707cc179b6f5af9008f642677195f98fd6f7fa021354e

                SHA512

                775934ebe5531ef8e04e2b50154ff6bf37128ac9f1481e3d547840eae21fb02a1ef2f39a9852cd779525e5eac6958649585a98589053865cd715b9f9654c8902

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1177302.exe

                Filesize

                175KB

                MD5

                b0058304f5e7d13d5c9c01c573aa454f

                SHA1

                55dc07bc545e59e1e6b791186be7d5d0de5f7701

                SHA256

                fa666bd8f9d7ac54772707cc179b6f5af9008f642677195f98fd6f7fa021354e

                SHA512

                775934ebe5531ef8e04e2b50154ff6bf37128ac9f1481e3d547840eae21fb02a1ef2f39a9852cd779525e5eac6958649585a98589053865cd715b9f9654c8902

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1157476.exe

                Filesize

                319KB

                MD5

                149ae6b17f5ee1821bbf08f45d6c9c5e

                SHA1

                56db2dff67e726a1dc9b2085f1b9a86abecae460

                SHA256

                dc3e09b84fa2157cf039a5020a80e2407ed339fbd2641b4cbc51ca2c348571e5

                SHA512

                0b1873e4b5811d4645167ffacab6582526fffc54068d05a3a7293fe3d47727c396992c9f69d0f91f0bd3cd56d791f59d429c2437851f5bfddbca1da50c7b3ce0

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1157476.exe

                Filesize

                319KB

                MD5

                149ae6b17f5ee1821bbf08f45d6c9c5e

                SHA1

                56db2dff67e726a1dc9b2085f1b9a86abecae460

                SHA256

                dc3e09b84fa2157cf039a5020a80e2407ed339fbd2641b4cbc51ca2c348571e5

                SHA512

                0b1873e4b5811d4645167ffacab6582526fffc54068d05a3a7293fe3d47727c396992c9f69d0f91f0bd3cd56d791f59d429c2437851f5bfddbca1da50c7b3ce0

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4861210.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4861210.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m6686537.exe

                Filesize

                140KB

                MD5

                8fb607ee6eada6964a1e22b5b7423103

                SHA1

                a7c466acaf5b2bea820946bbe5568210b3c68477

                SHA256

                2ecf2f650ef7740a057d9b150b8788b6530af61bc2b545dbe6ee24d79fd3b16d

                SHA512

                aea1bf4b996c6214de67f1c6b2f59222953d5b4a081405a514e1b10445637753d26c2f507767fccff58950d0515518268da84a852165bf5bebf1df3af5ed34b3

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m6686537.exe

                Filesize

                140KB

                MD5

                8fb607ee6eada6964a1e22b5b7423103

                SHA1

                a7c466acaf5b2bea820946bbe5568210b3c68477

                SHA256

                2ecf2f650ef7740a057d9b150b8788b6530af61bc2b545dbe6ee24d79fd3b16d

                SHA512

                aea1bf4b996c6214de67f1c6b2f59222953d5b4a081405a514e1b10445637753d26c2f507767fccff58950d0515518268da84a852165bf5bebf1df3af5ed34b3

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                7e22f50b1590c456f2978abd404c18e6

                SHA1

                d1fabea9c1bfd4b3cd4416e0b1b0806d0c3b7738

                SHA256

                9438dd861393244b04b788bf5cfc1e22afc62a2ab7016cae20203b73070c0127

                SHA512

                142fd5b426e347af860d2bf14806083e5e029c7d9a2913ca851e65f9367a17a421c885863078a6e3c71a4a5a1d7b53c46529fcb310c182bbb1adaf9dc649af61

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • memory/4632-44-0x0000000004F30000-0x000000000503A000-memory.dmp

                Filesize

                1.0MB

              • memory/4632-47-0x0000000005040000-0x000000000508B000-memory.dmp

                Filesize

                300KB

              • memory/4632-46-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

                Filesize

                248KB

              • memory/4632-49-0x0000000072420000-0x0000000072B0E000-memory.dmp

                Filesize

                6.9MB

              • memory/4632-45-0x0000000004E60000-0x0000000004E72000-memory.dmp

                Filesize

                72KB

              • memory/4632-43-0x0000000005430000-0x0000000005A36000-memory.dmp

                Filesize

                6.0MB

              • memory/4632-42-0x0000000004D00000-0x0000000004D06000-memory.dmp

                Filesize

                24KB

              • memory/4632-41-0x0000000072420000-0x0000000072B0E000-memory.dmp

                Filesize

                6.9MB

              • memory/4632-40-0x0000000000540000-0x0000000000570000-memory.dmp

                Filesize

                192KB