Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2023 03:30

General

  • Target

    c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe

  • Size

    1.4MB

  • MD5

    56a2d6b2c73760f28c3abd8d659232b9

  • SHA1

    07729e401f6dd138d53f9fbbc1e3cc451a3300d1

  • SHA256

    c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7

  • SHA512

    9703a3c15524ea234bd93e424512dfd40edb875ab2ba0e8180ef84ba00b55564b95c2c53c133970cab662eb9b01e461a05c53d61a29f8258190c3f7b2506cb6a

  • SSDEEP

    24576:NymseWxPTLkvpYHm4K4mdZcmNsy5eY20YL06amSGtg4uUE2G5x9csG:omMxPG4m4K4mdrsOqL0TktYUEJP9cs

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes
  • auth_value

    db6d96c4eade05afc28c31d9ad73a73c

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe
    "C:\Users\Admin\AppData\Local\Temp\c7ed6b51413f33726ae67244d3b5e375e5a8314fceffb1aebe2dfd240f7574a7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067651.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067651.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8684360.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8684360.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:336
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1145706.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1145706.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l5377434.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l5377434.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5048
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2092
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:4992
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:4156
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:2200
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:5068
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:1364
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:3800
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:4464
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:1444
                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m9543672.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m9543672.exe
                        5⤵
                        • Executes dropped EXE
                        PID:456
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5373383.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5373383.exe
                      4⤵
                      • Executes dropped EXE
                      PID:4036
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:2156
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4316
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:1988

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067651.exe

                Filesize

                1.3MB

                MD5

                fabb0c7df1afe823f61c7e300b2ee713

                SHA1

                a1187aab3faa13a1b99b5b23cd4664ffab96839f

                SHA256

                4c0960dca35532bb3eeb46503ab25c7e5ce8c8f99128a5f524a0780b7630eb51

                SHA512

                1df36a017a87a2c6eaffb4a3f50132d85db7e0e36132088b2770b3163af641d31ea447c835e087e2761f9019e5ef40ce54c0e057887cc5cd108194d15a0876a4

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5067651.exe

                Filesize

                1.3MB

                MD5

                fabb0c7df1afe823f61c7e300b2ee713

                SHA1

                a1187aab3faa13a1b99b5b23cd4664ffab96839f

                SHA256

                4c0960dca35532bb3eeb46503ab25c7e5ce8c8f99128a5f524a0780b7630eb51

                SHA512

                1df36a017a87a2c6eaffb4a3f50132d85db7e0e36132088b2770b3163af641d31ea447c835e087e2761f9019e5ef40ce54c0e057887cc5cd108194d15a0876a4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8684360.exe

                Filesize

                475KB

                MD5

                6c0d9e8d5d3f35dd05d410c4b3fa2540

                SHA1

                85046b56ce047878f02351ee8b5fdd8475c80da6

                SHA256

                430d6559c9b0f695ff60aeec7c61a1ff5198fa9ea08b0a86f3e925f2cf4d3c10

                SHA512

                da1a4b2b6453491d51c46d1fd9029640d5520397904ab446fe4b5b4c50b7640be34c00f8f2c3258839c0b2c24b2a348aba0c8302f8aa0716d9bbf9db644f6d4c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8684360.exe

                Filesize

                475KB

                MD5

                6c0d9e8d5d3f35dd05d410c4b3fa2540

                SHA1

                85046b56ce047878f02351ee8b5fdd8475c80da6

                SHA256

                430d6559c9b0f695ff60aeec7c61a1ff5198fa9ea08b0a86f3e925f2cf4d3c10

                SHA512

                da1a4b2b6453491d51c46d1fd9029640d5520397904ab446fe4b5b4c50b7640be34c00f8f2c3258839c0b2c24b2a348aba0c8302f8aa0716d9bbf9db644f6d4c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5373383.exe

                Filesize

                175KB

                MD5

                39decbeadc8a13b3a5cdddc68205c905

                SHA1

                6619db4d6f25b8a0d7b43afdf6bc8081158cb6bc

                SHA256

                1ce9d1e367d3fcaa04220c9faf04e2840b0861e63897405973def46130a4d44e

                SHA512

                98065855d4471c1a552096f9b32f14af201999b521ebcdfe141c5829d526372aa02d809ef493e7772b56a02f70f94e433d733f83d90ccf581caf8f4e0a862406

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5373383.exe

                Filesize

                175KB

                MD5

                39decbeadc8a13b3a5cdddc68205c905

                SHA1

                6619db4d6f25b8a0d7b43afdf6bc8081158cb6bc

                SHA256

                1ce9d1e367d3fcaa04220c9faf04e2840b0861e63897405973def46130a4d44e

                SHA512

                98065855d4471c1a552096f9b32f14af201999b521ebcdfe141c5829d526372aa02d809ef493e7772b56a02f70f94e433d733f83d90ccf581caf8f4e0a862406

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1145706.exe

                Filesize

                319KB

                MD5

                2b7d35cf6ea7cb5676ff67f1fdbef122

                SHA1

                07a31f160a3627d78409f33314ba550859b1ca2d

                SHA256

                dd048683d9ec86836d79566d7f612f9ff506977b59fd179f481e47c84f3f564b

                SHA512

                db6aa01a44cdb521b4ea84c5b1e7f2709ed3f1d7184ca52809b26f229f9712d55a566154b6ae5d432e0654ec250eabb0a0993f229ded4db18605e3df2c422a3b

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1145706.exe

                Filesize

                319KB

                MD5

                2b7d35cf6ea7cb5676ff67f1fdbef122

                SHA1

                07a31f160a3627d78409f33314ba550859b1ca2d

                SHA256

                dd048683d9ec86836d79566d7f612f9ff506977b59fd179f481e47c84f3f564b

                SHA512

                db6aa01a44cdb521b4ea84c5b1e7f2709ed3f1d7184ca52809b26f229f9712d55a566154b6ae5d432e0654ec250eabb0a0993f229ded4db18605e3df2c422a3b

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l5377434.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l5377434.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m9543672.exe

                Filesize

                141KB

                MD5

                0c64102c2e5ee673ae3d11df7b2c4a3c

                SHA1

                8c01756e76b98c338a55e0d7d828659201d4ae4f

                SHA256

                7e383e5ae3fa33f88f43d50272f1583b347f43344d76715cc5b3430ccc7cc078

                SHA512

                28c3555d134501a0991456241296893a4abfa48d053a3ec3cfafabc53190b4c4df20db26e69d489eae03851344f48844425cd0a19404ec3a794f10417241a21f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m9543672.exe

                Filesize

                141KB

                MD5

                0c64102c2e5ee673ae3d11df7b2c4a3c

                SHA1

                8c01756e76b98c338a55e0d7d828659201d4ae4f

                SHA256

                7e383e5ae3fa33f88f43d50272f1583b347f43344d76715cc5b3430ccc7cc078

                SHA512

                28c3555d134501a0991456241296893a4abfa48d053a3ec3cfafabc53190b4c4df20db26e69d489eae03851344f48844425cd0a19404ec3a794f10417241a21f

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                324KB

                MD5

                a85e81449f4ea7794dd065bf95d2dc05

                SHA1

                22886df09f0f11b142c3a12c8b399643acfb8e3d

                SHA256

                ff1caab62e32a245629051af14da30218ab749484f1dc3f4a0a421debdb02892

                SHA512

                ffe5c6ef75e2ffbf554d71efe48b99ecd2eeb9cf78941ee64f02e6e7ab0b8a5dc130c3ce69211b1114b414b3f06bbaef77a95534a24ff9fa6beb04e59ffe2987

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • memory/4036-44-0x0000000072A30000-0x00000000731E0000-memory.dmp

                Filesize

                7.7MB

              • memory/4036-51-0x00000000052F0000-0x0000000005300000-memory.dmp

                Filesize

                64KB

              • memory/4036-50-0x0000000072A30000-0x00000000731E0000-memory.dmp

                Filesize

                7.7MB

              • memory/4036-49-0x0000000005300000-0x000000000533C000-memory.dmp

                Filesize

                240KB

              • memory/4036-47-0x00000000052F0000-0x0000000005300000-memory.dmp

                Filesize

                64KB

              • memory/4036-48-0x0000000005280000-0x0000000005292000-memory.dmp

                Filesize

                72KB

              • memory/4036-46-0x0000000005410000-0x000000000551A000-memory.dmp

                Filesize

                1.0MB

              • memory/4036-45-0x0000000005920000-0x0000000005F38000-memory.dmp

                Filesize

                6.1MB

              • memory/4036-43-0x0000000000900000-0x0000000000930000-memory.dmp

                Filesize

                192KB