Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 14:29

General

  • Target

    babd836631e288a3898e6b871ded792269de5c0014085887296a642d03a14d1d.exe

  • Size

    514KB

  • MD5

    0ac62c0d23be9b2b0411eaacea43446d

  • SHA1

    bcdb0f062db7feee2ade7f8b39e456b1e8484ef1

  • SHA256

    babd836631e288a3898e6b871ded792269de5c0014085887296a642d03a14d1d

  • SHA512

    4d4fe35e5af3fb310430534c51e23c045f5179c4bc0a265923847ddae2f668c1b2f7b5a78b8f0cb420d07519b47356fd9eb79d6f9f2251fe7ef79045237be0db

  • SSDEEP

    12288:hMrry90Ur1Cc6vD8ZF1dRzBzgsGC9CaRcEixn55HgC:WyRscyPsWn/

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

C2

77.91.124.84:19071

Attributes
  • auth_value

    9fa41701c47df37786234f3373f21208

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\babd836631e288a3898e6b871ded792269de5c0014085887296a642d03a14d1d.exe
    "C:\Users\Admin\AppData\Local\Temp\babd836631e288a3898e6b871ded792269de5c0014085887296a642d03a14d1d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4675697.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4675697.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7326392.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7326392.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4628
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8059560.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8059560.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4648
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2825939.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2825939.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3612
          • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
            "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3040
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4856
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3484
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:2620
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "pdates.exe" /P "Admin:N"
                  7⤵
                    PID:4520
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "pdates.exe" /P "Admin:R" /E
                    7⤵
                      PID:2800
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:5004
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\925e7e99c5" /P "Admin:N"
                        7⤵
                          PID:1852
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\925e7e99c5" /P "Admin:R" /E
                          7⤵
                            PID:1864
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1779118.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1779118.exe
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:5112
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6340897.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6340897.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2684
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:3208
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:3892
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:5092

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Execution

              Scheduled Task/Job

              1
              T1053

              Persistence

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              Modify Registry

              3
              T1112

              Impair Defenses

              2
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              3
              T1082

              Peripheral Device Discovery

              1
              T1120

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6340897.exe
                Filesize

                174KB

                MD5

                b2abbe4f59e4fe593b58a729449f8258

                SHA1

                f33bbc3c39b34f0d092332d9b1dfa3411405b048

                SHA256

                04bf72986315202b300985bbaf94dbad03bc231a186c8ccf185d566910114a70

                SHA512

                643b1ea32fa7eab6647a985283f05b6c91fa991ed9bd8b551892d556f620898ed55ad88abd21f947ac0a8fab958188030ba93227bdd20abb2f43ccd86ea1b52a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4675697.exe
                Filesize

                359KB

                MD5

                6487e63a9d712c9fa4d43f4a1e2f4982

                SHA1

                d011ea1e23ad4260301bb9be131fa210022abc61

                SHA256

                708bf3f153528e994c22e31d4fee21bf042db76d29a0ff0e316d160acbfa151a

                SHA512

                8ee62e03d6b4f0329089961fdf0fc44a4e2cfc7b1eb40b3d13aa9996acdd74c34e933ffbe543ae704e4ffa6bdb9cbc4cf717c83ea20c62e727bd78adcb5034f0

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1779118.exe
                Filesize

                36KB

                MD5

                e3a5f3ad2ee89b7cb1a0e2e5c5274667

                SHA1

                7efb31b3e242bcce37e17c56ba4e3765958c767f

                SHA256

                7736da43f91d1f15c359b3aeeae237747a2368c6b3b9b01752ba31bc2be9bd06

                SHA512

                fe63f532d6d37ac7a0309d44f45aa4236fef03c8e7def37b222ee7e645f21b312963c5754f41044194feafa9ae0715bc4e6581a8c29d85222c3e93f54ba45993

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7326392.exe
                Filesize

                234KB

                MD5

                c054ad5e93bdcfadd05df7b9d5c9d1fd

                SHA1

                626454188298c47baa73b1c85203b63a7ed8b019

                SHA256

                2fa3a71f8055f97d0c268f4fbc4e3a2a600baadd81b8c3ace9e873aa201736a0

                SHA512

                6be92d13d4e76c2fbbc4706606021d37cf2e78f0702939cec50c88b735d0e56dcd4083db38d10efbd8e1938b5a1c3736bfcc8ce439b3df426973ff2b062c8b9a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8059560.exe
                Filesize

                13KB

                MD5

                0913129b2b0beaa40070423febcfba62

                SHA1

                cbc9a68bf89a7faafcac16593ac039543d80febb

                SHA256

                bcaf2cd3a1a5f66e51213ffe6aa72d337e1d242e3e9f1cdf1b82112eac0452b7

                SHA512

                24b936caf6f32bb93cedfd0be129cacc854c6cda05f5ffb4c24a0af4a71d2d31e397fdaf4e4e6b2d79119d1d685301649dabbda0e7b71332b5e431882fe32116

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2825939.exe
                Filesize

                225KB

                MD5

                022f119365c3e54ec3c0058b088c26fb

                SHA1

                a705014c3750ec7b439f11ac18d3291c3fb642e8

                SHA256

                4d74d06559a558324a63784710905e0095e450cf86dac862160dc3e348eed6a6

                SHA512

                65b4c54cb6c047928a0749e546bfbe80f694e3cc1722a80147dd7a4f20c7cda66db56cddbf51c21f9171c6b379cc1dadb980e53667f3dff0e8d381d5d0682724

              • memory/2684-49-0x000000000AEB0000-0x000000000AFBA000-memory.dmp
                Filesize

                1.0MB

              • memory/2684-46-0x0000000000ED0000-0x0000000000F00000-memory.dmp
                Filesize

                192KB

              • memory/2684-47-0x0000000003160000-0x0000000003166000-memory.dmp
                Filesize

                24KB

              • memory/2684-48-0x000000000B3C0000-0x000000000B9D8000-memory.dmp
                Filesize

                6.1MB

              • memory/2684-50-0x000000000ADC0000-0x000000000ADD2000-memory.dmp
                Filesize

                72KB

              • memory/2684-51-0x000000000AE20000-0x000000000AE5C000-memory.dmp
                Filesize

                240KB

              • memory/2684-52-0x0000000003060000-0x00000000030AC000-memory.dmp
                Filesize

                304KB

              • memory/4648-21-0x00000000000B0000-0x00000000000BA000-memory.dmp
                Filesize

                40KB

              • memory/4648-22-0x00007FF9F0423000-0x00007FF9F0425000-memory.dmp
                Filesize

                8KB

              • memory/5112-40-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/5112-42-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB