Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 14:29

General

  • Target

    f5957f382ef0f17bbf1d83cc0b5d4f133ae56c9c5a3101548b66b2462dbe9b6a.exe

  • Size

    390KB

  • MD5

    0eb1fbc2d5ee4ff34ade8b4c2253e955

  • SHA1

    ab76633544a01eea4234f73c227c439ca8749eee

  • SHA256

    f5957f382ef0f17bbf1d83cc0b5d4f133ae56c9c5a3101548b66b2462dbe9b6a

  • SHA512

    f0548458151c70d6abdda3e15d88c3dc5acc3cc3bbc10d0c2168a9166895217541a125f31d4810ed27e270199b1834330b8e7f0d2d5896300c10dd4b742d23c7

  • SSDEEP

    6144:K6y+bnr+vp0yN90QEXDpy8+SzJ8b9UVB4pAj03UzOPE5iVWhM0ZihJ115sS:WMr7y909fb8b2bBQUcsiiM6uJ1/

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://5.42.92.67

Attributes
  • install_dir

    ebb444342c

  • install_file

    legola.exe

  • strings_key

    5680b049188ecacbfa57b1b29c2f35a7

  • url_paths

    /norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

C2

77.91.124.84:19071

Attributes
  • auth_value

    9fa41701c47df37786234f3373f21208

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5957f382ef0f17bbf1d83cc0b5d4f133ae56c9c5a3101548b66b2462dbe9b6a.exe
    "C:\Users\Admin\AppData\Local\Temp\f5957f382ef0f17bbf1d83cc0b5d4f133ae56c9c5a3101548b66b2462dbe9b6a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9877402.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9877402.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8168654.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8168654.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3450874.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3450874.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
          "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4776
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2688
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4504
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legola.exe" /P "Admin:N"
                6⤵
                  PID:4380
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "legola.exe" /P "Admin:R" /E
                  6⤵
                    PID:888
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:1280
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\ebb444342c" /P "Admin:N"
                      6⤵
                        PID:1580
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\ebb444342c" /P "Admin:R" /E
                        6⤵
                          PID:8
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t8743232.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t8743232.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4908
              • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                1⤵
                • Executes dropped EXE
                PID:1716
              • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                1⤵
                • Executes dropped EXE
                PID:2484

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t8743232.exe

                Filesize

                173KB

                MD5

                9ed0b72f9d16b56aee6fea22c56a5d79

                SHA1

                3326591f1daddf527f3d024e4ec0474aa693de22

                SHA256

                b6ab281c52a6a40a0f833e3670ee18988499cbc592b33516e00b91006701a2a6

                SHA512

                e3b940e6a0d4827d9bba09f2236e828c3b3d44348f89eb26bfc250dcad46aebee4c9b420a634652ae6c1d16673d629f339551d6130adc18fa71606daf0c2c73b

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9877402.exe

                Filesize

                234KB

                MD5

                9ddbabccd941667b18109039f29dac16

                SHA1

                b519c3f38a63686cab156656c1bb3a5e299c29c5

                SHA256

                d4070d43dcc271b3f33575f847919c067d09b1d48e929a278d0f50ddeab193c6

                SHA512

                48afa6624d421db57c83660dd0fbd8640a65479e47fc6f0099977c8203758cbbac6b2c3870ed9a6b7c73fb49ed433985d181e4e33c73a91ff5e09d7d6e72451a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8168654.exe

                Filesize

                12KB

                MD5

                e9b9d26d878a906b7699fe61f74dc6a2

                SHA1

                44fccab27267aa0d45a9c974d815065591ecd2ac

                SHA256

                a41c0d5d2802ffc46ba39f133b0980615307bcaf76e58d650ae5b2065b289cbe

                SHA512

                e1c969bfce0e862c3f18d0347f0e7eb949650323b1140bc543a56425cc78c888942ea75b00be0a4af1cc608ff8f8f0735a22ac3a82d55a1c7a67f6546303cf8d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3450874.exe

                Filesize

                224KB

                MD5

                d0fc3ff3b8a33ddf0833f2ffbab8e74c

                SHA1

                202e6dbbc6b40542fd78a0b469653163c5b1e290

                SHA256

                7c64a174841606d9776e2cb5ea7aa5cdb09f8167471c7c37ac683b78ed7dfbc7

                SHA512

                6dc10bfb310bbce1ed2a31d39d0a6ee2d76e30b5b1a42131b34b60d9ab297fab169835d148cc3a1c298f701cb984db8f5b46120a51bad06d4f6d78481a9a05c2

              • memory/2012-14-0x0000000000530000-0x000000000053A000-memory.dmp

                Filesize

                40KB

              • memory/2012-15-0x00007FFBF6C83000-0x00007FFBF6C85000-memory.dmp

                Filesize

                8KB

              • memory/4908-33-0x0000000000BD0000-0x0000000000C00000-memory.dmp

                Filesize

                192KB

              • memory/4908-34-0x00000000053B0000-0x00000000053B6000-memory.dmp

                Filesize

                24KB

              • memory/4908-35-0x0000000005BC0000-0x00000000061D8000-memory.dmp

                Filesize

                6.1MB

              • memory/4908-36-0x00000000056B0000-0x00000000057BA000-memory.dmp

                Filesize

                1.0MB

              • memory/4908-37-0x0000000005450000-0x0000000005462000-memory.dmp

                Filesize

                72KB

              • memory/4908-38-0x00000000055E0000-0x000000000561C000-memory.dmp

                Filesize

                240KB

              • memory/4908-39-0x0000000005620000-0x000000000566C000-memory.dmp

                Filesize

                304KB