Analysis

  • max time kernel
    151s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2023 21:18

General

  • Target

    NEAS.d9fd63a3ea8644d4f4f915efde890840_JC.exe

  • Size

    1.0MB

  • MD5

    d9fd63a3ea8644d4f4f915efde890840

  • SHA1

    be8942840a682935b3fcfec427cda537cec98e3b

  • SHA256

    24147aa841a552b57a14494a9cc06d41884d8ef15b1686c06027ea84aa7de7c8

  • SHA512

    25572f5bb3efe5841f1c3af7db36c022b6e0d3b13f819890bdece58f6f094b6953b78b9c9eae142cc3e6be72d356877ba4b857f265ab98cfe7ae45526bd8a628

  • SSDEEP

    12288:YMrYy90IelPDo5Orbdmde5ywzeFg2mWSHwh2sbFFHuUtwzowUBlW39ZD1vEP7CWQ:QykPnNmbwegUqw1X7JkHvEP9gDTFQ6

Malware Config

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Mystic stealer payload 4 IoCs
  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d9fd63a3ea8644d4f4f915efde890840_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d9fd63a3ea8644d4f4f915efde890840_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6355189.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6355189.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8877095.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8877095.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q0173140.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q0173140.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1676
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 140
            5⤵
            • Program crash
            PID:5292
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1904388.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1904388.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            5⤵
              PID:5128
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 540
                6⤵
                • Program crash
                PID:5276
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 152
              5⤵
              • Program crash
              PID:868
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1770325.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1770325.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:6008
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
              PID:6092
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              4⤵
                PID:2096
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 152
                4⤵
                • Program crash
                PID:4616
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0193458.exe
            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0193458.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:32
            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
              "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:6072
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
                4⤵
                • Creates scheduled task(s)
                PID:4380
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1352
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4724
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "explonde.exe" /P "Admin:N"
                    5⤵
                      PID:3056
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "explonde.exe" /P "Admin:R" /E
                      5⤵
                        PID:2924
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        5⤵
                          PID:5440
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\fefffe8cea" /P "Admin:N"
                          5⤵
                            PID:4716
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\fefffe8cea" /P "Admin:R" /E
                            5⤵
                              PID:2152
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2544 -ip 2544
                      1⤵
                        PID:3788
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1716 -ip 1716
                        1⤵
                          PID:4528
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5128 -ip 5128
                          1⤵
                            PID:2068
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6008 -ip 6008
                            1⤵
                              PID:4680
                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
                              C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1068
                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
                              C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
                              1⤵
                              • Executes dropped EXE
                              PID:5324

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0193458.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0193458.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6355189.exe

                              Filesize

                              882KB

                              MD5

                              144da28e900a79758f8cfec479b1a29d

                              SHA1

                              3f1f06ab1f68e897635a8c47b1a9187138232c00

                              SHA256

                              bf458e039bc5341868f8cff330eeb8856194571ac91c243262da8d34778cac14

                              SHA512

                              e5a410bd6905a3a7520237b3b9dcab87511949d4560546248f6be10082afd19d5a8020f597cc4f2ad6b92413d201920464c8148bc5ac55e709884699e623080e

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6355189.exe

                              Filesize

                              882KB

                              MD5

                              144da28e900a79758f8cfec479b1a29d

                              SHA1

                              3f1f06ab1f68e897635a8c47b1a9187138232c00

                              SHA256

                              bf458e039bc5341868f8cff330eeb8856194571ac91c243262da8d34778cac14

                              SHA512

                              e5a410bd6905a3a7520237b3b9dcab87511949d4560546248f6be10082afd19d5a8020f597cc4f2ad6b92413d201920464c8148bc5ac55e709884699e623080e

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1770325.exe

                              Filesize

                              1.0MB

                              MD5

                              d013bc55864b09b95805e0e2ee8bc6e8

                              SHA1

                              4dc6bc43b63a8120aec5ab3bc3c1bbbb06f89563

                              SHA256

                              a545199b764d3dfad792d850735cac5c457598fc572a660d9b44f9705f333e85

                              SHA512

                              e00d728323479818bb4bbb6a2b510c64d86706d287ceadf2353542d1c1ef63aa7a05f8d7b1d2139a02d9703db4280bcc62d8210594d1360e05b88f158656e06e

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1770325.exe

                              Filesize

                              1.0MB

                              MD5

                              d013bc55864b09b95805e0e2ee8bc6e8

                              SHA1

                              4dc6bc43b63a8120aec5ab3bc3c1bbbb06f89563

                              SHA256

                              a545199b764d3dfad792d850735cac5c457598fc572a660d9b44f9705f333e85

                              SHA512

                              e00d728323479818bb4bbb6a2b510c64d86706d287ceadf2353542d1c1ef63aa7a05f8d7b1d2139a02d9703db4280bcc62d8210594d1360e05b88f158656e06e

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8877095.exe

                              Filesize

                              491KB

                              MD5

                              0988d09052792483b186d236c6da7d51

                              SHA1

                              a645ec25e438686f00e7c15c1ad3bb26d51f673f

                              SHA256

                              be4b07618b42cc773d44d3f924a19bbc41cbbbb2f196720db16060b9b8eb5583

                              SHA512

                              93653765d4fcca066baf0f6270e26d1ab2217f3d87af3484207b129f987626a0eced1b71dbc011a0ca60d9243267dffbb3245d19cc68c7cb0edb8717ffea5868

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8877095.exe

                              Filesize

                              491KB

                              MD5

                              0988d09052792483b186d236c6da7d51

                              SHA1

                              a645ec25e438686f00e7c15c1ad3bb26d51f673f

                              SHA256

                              be4b07618b42cc773d44d3f924a19bbc41cbbbb2f196720db16060b9b8eb5583

                              SHA512

                              93653765d4fcca066baf0f6270e26d1ab2217f3d87af3484207b129f987626a0eced1b71dbc011a0ca60d9243267dffbb3245d19cc68c7cb0edb8717ffea5868

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q0173140.exe

                              Filesize

                              860KB

                              MD5

                              a99183e9a721e0d237872b90d001a447

                              SHA1

                              d7a56d586172a86d9abef90930fe10da058dea2f

                              SHA256

                              d07d47d45e9cfc22b8c2e5fced7a2b5468d455a1e7c6a3ff7db5ce81b81e6539

                              SHA512

                              df11bb187bc3dc7e08aa2d980aa55ecfd45df13381d2804db4aecfb6a7e23ecbce085f05b3507ba7d025a1c282ead37cda54c7f26ae208748faac7608e63e252

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q0173140.exe

                              Filesize

                              860KB

                              MD5

                              a99183e9a721e0d237872b90d001a447

                              SHA1

                              d7a56d586172a86d9abef90930fe10da058dea2f

                              SHA256

                              d07d47d45e9cfc22b8c2e5fced7a2b5468d455a1e7c6a3ff7db5ce81b81e6539

                              SHA512

                              df11bb187bc3dc7e08aa2d980aa55ecfd45df13381d2804db4aecfb6a7e23ecbce085f05b3507ba7d025a1c282ead37cda54c7f26ae208748faac7608e63e252

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1904388.exe

                              Filesize

                              1016KB

                              MD5

                              7c13d6e894bf39893b8e8e5492e491fc

                              SHA1

                              3d2f7f22fe4ad53a128b295282e6b1a9ee24c895

                              SHA256

                              82f60381d8e86e1cadb33702ee57b1445414d4701f65218344ee40b6b6e304bd

                              SHA512

                              e311b25d2a101288ff9bf96736f9e1d6692d37f135e960786e88d205e01a944229ea067b92e850081e3a9ecc0862c2fd8db86bd0426e7daa69214ae4316bc219

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1904388.exe

                              Filesize

                              1016KB

                              MD5

                              7c13d6e894bf39893b8e8e5492e491fc

                              SHA1

                              3d2f7f22fe4ad53a128b295282e6b1a9ee24c895

                              SHA256

                              82f60381d8e86e1cadb33702ee57b1445414d4701f65218344ee40b6b6e304bd

                              SHA512

                              e311b25d2a101288ff9bf96736f9e1d6692d37f135e960786e88d205e01a944229ea067b92e850081e3a9ecc0862c2fd8db86bd0426e7daa69214ae4316bc219

                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

                              Filesize

                              219KB

                              MD5

                              c256a814d3f9d02d73029580dfe882b3

                              SHA1

                              e11e9ea937183139753f3b0d5e71c8301d000896

                              SHA256

                              53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

                              SHA512

                              1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

                            • memory/1676-31-0x0000000074230000-0x00000000749E0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1676-22-0x0000000074230000-0x00000000749E0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1676-21-0x0000000000400000-0x000000000040A000-memory.dmp

                              Filesize

                              40KB

                            • memory/1676-40-0x0000000074230000-0x00000000749E0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/2096-36-0x0000000074230000-0x00000000749E0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/2096-52-0x0000000005380000-0x0000000005392000-memory.dmp

                              Filesize

                              72KB

                            • memory/2096-37-0x00000000051A0000-0x00000000051A6000-memory.dmp

                              Filesize

                              24KB

                            • memory/2096-35-0x0000000000400000-0x0000000000430000-memory.dmp

                              Filesize

                              192KB

                            • memory/2096-46-0x0000000005930000-0x0000000005F48000-memory.dmp

                              Filesize

                              6.1MB

                            • memory/2096-49-0x0000000005450000-0x000000000555A000-memory.dmp

                              Filesize

                              1.0MB

                            • memory/2096-53-0x0000000005200000-0x0000000005210000-memory.dmp

                              Filesize

                              64KB

                            • memory/2096-38-0x0000000074230000-0x00000000749E0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/2096-59-0x0000000005200000-0x0000000005210000-memory.dmp

                              Filesize

                              64KB

                            • memory/2096-58-0x0000000005560000-0x00000000055AC000-memory.dmp

                              Filesize

                              304KB

                            • memory/2096-57-0x00000000053E0000-0x000000000541C000-memory.dmp

                              Filesize

                              240KB

                            • memory/5128-28-0x0000000000400000-0x0000000000428000-memory.dmp

                              Filesize

                              160KB

                            • memory/5128-30-0x0000000000400000-0x0000000000428000-memory.dmp

                              Filesize

                              160KB

                            • memory/5128-27-0x0000000000400000-0x0000000000428000-memory.dmp

                              Filesize

                              160KB

                            • memory/5128-26-0x0000000000400000-0x0000000000428000-memory.dmp

                              Filesize

                              160KB