Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 11:56

General

  • Target

    2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe

  • Size

    514KB

  • MD5

    9d827bb83640e0913032c63de8cb78f1

  • SHA1

    449eee66a32c41f5c5aee7d77ded58b575c1b984

  • SHA256

    2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7

  • SHA512

    ec3e904df1ce5374b9b94d41edad0e79e012992fe988f1f994766022e1fef388500126c14dbe96487650cc8475611d32314c4f20df4ca271f85ce9d53e3ac695

  • SSDEEP

    12288:WMrdy90DnHgun+muOlzU2R3jp2W8zmUHlz8nlQH:Ly6nHguntu6f2xmal8lQH

Malware Config

Extracted

Family

amadey

Version

3.85

C2

http://77.91.68.3

Attributes
  • install_dir

    3ec1f323b5

  • install_file

    danke.exe

  • strings_key

    827021be90f1e85ab27949ea7e9347e8

  • url_paths

    /home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes
  • auth_value

    6da71218d8a9738ea3a9a78b5677589b

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe
    "C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:436
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:796
          • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
            "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3836
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:1508
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4384
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:380
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "danke.exe" /P "Admin:N"
                  7⤵
                    PID:2960
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "danke.exe" /P "Admin:R" /E
                    7⤵
                      PID:1052
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:3728
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\3ec1f323b5" /P "Admin:N"
                        7⤵
                          PID:4360
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\3ec1f323b5" /P "Admin:R" /E
                          7⤵
                            PID:2924
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:3548
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4616
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:1776
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:540

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe

                Filesize

                172KB

                MD5

                725c8322fe9260d7b3f57fa0f56ce592

                SHA1

                2aed692c51508d505fa5c329171d4d6a7610a9df

                SHA256

                087e6a20031a0e98fd0fd3cd088158189422fd89925aff5974f8b0a075e8d2f1

                SHA512

                2f7cc3c3025bb5994df3c285fffb316cb883aec22be5f63865122ce0d0ea0b4ac7814ca50422918c382ddddfe79f60cbe359066ae8f438394a1b41a124244ca9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe

                Filesize

                359KB

                MD5

                9b204b2174a61c3e2815e3569c80bb85

                SHA1

                966c4bddfe02f4c8cc982884dcf3bd67ac3163b6

                SHA256

                bc129c8b7d126c4cb90fbd9f6833d826970e1bb867a54ecb2679e877a00d74aa

                SHA512

                c6d93ae2ba32808382103db707769f98c6d8e7b7b7672c8c9533b0b4492c1c16c993136dc0c3343a0cd48207c532aaad3ace719de3477af4c864e6f18bd94c10

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe

                Filesize

                32KB

                MD5

                b41a7e3a97626db737fd17b391b48ca3

                SHA1

                6dacf3209a223ce1c0a241886fe89d65dcf7e471

                SHA256

                fc94039a0791b8a000dcc26e26e873d66cb879352e52b1ac4cdce6c708f7dab3

                SHA512

                3a75b8490b5eb1765a54751352d598cc5d2c4eada1dd2d70018bc45c97c21d6e9b237409094cd56c12bbb11e5789a57acb403daf4c864229ccfaacb6532afad0

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe

                Filesize

                235KB

                MD5

                82d30b790fbf41a0838164d7ffd6afdc

                SHA1

                6c5785fc27a3d2caa6ced1e70a661ee11cafec7b

                SHA256

                903f6fb97cf39c429be2a66afa9a5e2915d9ecde0bc5da8ecd0a3872da801a96

                SHA512

                1b353ab7c21ea6d9289043beba7ff5ddab454b5b31987fe77e304f8c912b43acb984d793638b0d2b76d3420c9f88d81a09a688bd0dc7aabfdbefd079fbb13e90

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe

                Filesize

                14KB

                MD5

                62866370b0dc6f5041d08f2d38047782

                SHA1

                a50c4d603103ec5861f7d5ef39f18cb9a03d7801

                SHA256

                be1539a435f623d28287b7f6b21eb1a3fc044164f4d0b4f3685e6e6c79e20bcf

                SHA512

                e6153a4c8bc463da3fded770678a092318721d953de295d3a541aaf6a01e949d54f94b93f64d86db4053ece3f4878fdfd56770e11db67269071afbf47dd86350

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe

                Filesize

                227KB

                MD5

                9a84e9c91a6baaade040329fb470db95

                SHA1

                8ac38c6258357a0ae4e2eacdaa9987bad9851bfd

                SHA256

                0fd1eecbbdff423485bceb15920b4d531d34a1046afca08cdf5850e63254505b

                SHA512

                1cff7df39f350b7d5a8e8613d900019bd0f3236bf96f90153b760a4d770e0325f4a19fe2dc1a3ce6b17f6cc0313562525039cad3d44bbb77a99adcc4529b120d

              • memory/436-21-0x00007FFA0EB83000-0x00007FFA0EB85000-memory.dmp

                Filesize

                8KB

              • memory/436-22-0x0000000000980000-0x000000000098A000-memory.dmp

                Filesize

                40KB

              • memory/3548-40-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/4616-46-0x000000000AE60000-0x000000000B478000-memory.dmp

                Filesize

                6.1MB

              • memory/4616-48-0x000000000A8F0000-0x000000000A902000-memory.dmp

                Filesize

                72KB

              • memory/4616-49-0x000000000A950000-0x000000000A98C000-memory.dmp

                Filesize

                240KB

              • memory/4616-50-0x0000000004EA0000-0x0000000004EEC000-memory.dmp

                Filesize

                304KB

              • memory/4616-44-0x0000000000A00000-0x0000000000A30000-memory.dmp

                Filesize

                192KB

              • memory/4616-47-0x000000000A9B0000-0x000000000AABA000-memory.dmp

                Filesize

                1.0MB

              • memory/4616-45-0x0000000002CE0000-0x0000000002CE6000-memory.dmp

                Filesize

                24KB