Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 17:27

General

  • Target

    74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe

  • Size

    1.1MB

  • MD5

    6e23ce77b8eadf69971ce2729e2dc264

  • SHA1

    be53621f2277dac9ee2a33bcc6f31837efc05f30

  • SHA256

    74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d

  • SHA512

    74c77141db73defabadd0c570d2c8e6aa2f2f21ed514ef51189ce26e2894e81c4fb0564c261278b373a283da1353f12dc057bedb3f5b21f479dc6cc8379b9cc5

  • SSDEEP

    24576:oygMfa7QOzNGs+DFO8m8C8+PwW7urzpkujeOO6:vgaa7jzN5+DuM+/k1BXO

Malware Config

Extracted

Family

amadey

Version

3.85

C2

http://77.91.68.3

Attributes
  • install_dir

    3ec1f323b5

  • install_file

    danke.exe

  • strings_key

    827021be90f1e85ab27949ea7e9347e8

  • url_paths

    /home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

naher

C2

77.91.68.48:19071

Attributes
  • auth_value

    62708e72becb72a24cf8843b46acc6a1

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe
    "C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe
          4⤵
          • Executes dropped EXE
          PID:1648
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 136
            5⤵
            • Program crash
            PID:4572
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3640
          • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
            "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:560
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4708
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1580
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:2096
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "danke.exe" /P "Admin:N"
                  7⤵
                    PID:4200
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "danke.exe" /P "Admin:R" /E
                    7⤵
                      PID:3708
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4168
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\3ec1f323b5" /P "Admin:N"
                        7⤵
                          PID:1000
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\3ec1f323b5" /P "Admin:R" /E
                          7⤵
                            PID:1632
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe
                    3⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Executes dropped EXE
                    • Windows security modification
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3988
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648
                1⤵
                  PID:4208
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  1⤵
                  • Executes dropped EXE
                  PID:408
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3156
                • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3200

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe

                  Filesize

                  174KB

                  MD5

                  10d43f9f5c1b584e1e44238222b31622

                  SHA1

                  25fd2b7ad514885d8edcb248d0ceb13c94736e7c

                  SHA256

                  701e9f376908966bc245ee6400a23fa241dedcc92e050a1e97287485ef88dfcb

                  SHA512

                  25d164ff16ee6fb3052eb3e27e1fbf51987bfc04ee274dc1254adc599bfe6dcb155f3aff9a63e1d39a653dd3ec4e6dccc1deb7f31b7bbf77ce6ba488926e8e63

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe

                  Filesize

                  956KB

                  MD5

                  413b60f6a17f654b0b189ee9e2958cc1

                  SHA1

                  7bdc8dff90952c2235e8e30b09c1b19f74522cec

                  SHA256

                  44e183018766f53bad57022988f261e79d339d03488a90d9da19941481b20006

                  SHA512

                  16ea6bbe9d4e1985aae4267adabf6264502c1ff11bca9e10f1e1229e31b2f46c77c38a4895ee1850193850e130afd4cf32d7476889b9621a14123563056f537e

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe

                  Filesize

                  880KB

                  MD5

                  37691c4b8a38e1bdde62373071049e22

                  SHA1

                  570897cd139febdcbb0036cee7c1702a2fde52f6

                  SHA256

                  2fd230cc780deaed560d74f61ab1b8d26829366bef1d3a95bce553a6ad353227

                  SHA512

                  35e2ee567cad19eafa471662631c1c784c4d13e520292dbddfb33384060a61dffe9e1de6a2ed83b0bf40f43396c0c0d05a55f516ca7035690e8066e064e6d79e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe

                  Filesize

                  1.7MB

                  MD5

                  a3238956a9ff6eab99493e126762bdc2

                  SHA1

                  45cd641ded64afee4f73a2c0ac86c102f3ed06f0

                  SHA256

                  87ec0501cc2cc74bf386ed9fa12dabd82e5e50872b4ca22c4145c88b603bb6b9

                  SHA512

                  816e3609808e6fdc00715b1807f3a02949ffb01bb1ed7affab54f5ff5b2cb7770db9e2a1a641c5de7126c30729f09f9fbd79f088e695ed7e0d365200d70e963f

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe

                  Filesize

                  224KB

                  MD5

                  8c6b79ec436d7cf6950a804c1ec7d3e9

                  SHA1

                  4a589d5605d8ef785fdc78b0bf64e769e3a21ad6

                  SHA256

                  4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d

                  SHA512

                  06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

                • memory/1648-21-0x0000000000401000-0x0000000000530000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3988-38-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

                  Filesize

                  40KB

                • memory/4720-43-0x0000000000EA0000-0x0000000000ED0000-memory.dmp

                  Filesize

                  192KB

                • memory/4720-44-0x0000000005800000-0x0000000005806000-memory.dmp

                  Filesize

                  24KB

                • memory/4720-45-0x000000000B330000-0x000000000B948000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4720-46-0x000000000AE50000-0x000000000AF5A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4720-47-0x000000000AD90000-0x000000000ADA2000-memory.dmp

                  Filesize

                  72KB

                • memory/4720-48-0x000000000ADF0000-0x000000000AE2C000-memory.dmp

                  Filesize

                  240KB

                • memory/4720-49-0x00000000031D0000-0x000000000321C000-memory.dmp

                  Filesize

                  304KB