Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 17:57

General

  • Target

    45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566.exe

  • Size

    514KB

  • MD5

    a3b12999051bccd12021b96b6f86c928

  • SHA1

    d8fa4600a37079cabc0b61744970a0e1efaeb502

  • SHA256

    45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566

  • SHA512

    d795296547eefe35537e545f47a5b3bfb2a2cbc298c0ec422a62fd888fab370685b2102c4ee289ad8cc34e30f97dd616ec53e8cce3682d711ab28c5504a933b4

  • SSDEEP

    12288:kMrPy90Ptd6fvSMfJOjUlYm3Yw+uMNdwmD+gV3:DyTfqMfJOjQY2z+dwmD7

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

lande

C2

77.91.124.84:19071

Attributes
  • auth_value

    9fa41701c47df37786234f3373f21208

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566.exe
    "C:\Users\Admin\AppData\Local\Temp\45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8571074.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8571074.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7534543.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7534543.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9088149.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9088149.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1152
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0441540.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0441540.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
            "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:624
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:440
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4432
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:60
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "pdates.exe" /P "Admin:N"
                  7⤵
                    PID:748
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "pdates.exe" /P "Admin:R" /E
                    7⤵
                      PID:3396
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:1980
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\925e7e99c5" /P "Admin:N"
                        7⤵
                          PID:3536
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\925e7e99c5" /P "Admin:R" /E
                          7⤵
                            PID:3264
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4395091.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4395091.exe
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:2424
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6019551.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6019551.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2640
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4992
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:3044

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6019551.exe

                Filesize

                173KB

                MD5

                c225c96cdafa0b5c23bc6baa2e0218e7

                SHA1

                a2c128cdd18527022d211987d099a027d20d33e7

                SHA256

                ecdcf172ca1f833298183532ce056cdcd23b2f69aa7092967658c8c334355bf3

                SHA512

                7eebd21ab59ff872f8e5e5f2d15bf42c8cc23e18fd4e070292327d18983e7ba754ef292bae217c5b69af9758d0df51306127c85fc4aa5e8a29e8793e3a06d870

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8571074.exe

                Filesize

                359KB

                MD5

                17d1a5ab9b16045d2dee23b240c08d7f

                SHA1

                502e9887c3f215a103fb32326ac868d341136e3e

                SHA256

                27fb7e92926ed2a5e601d4557b0a0bb6bfc3846f6dc07549c649a895db23be3d

                SHA512

                c081f2954f9c6fcc9734cdea3fa67671e184afb569a33bd3def6ae96e44c1d95fd7d3c849cc946d3077683fdc8cecb47712fb3dce3971296c058c5a1221e0649

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4395091.exe

                Filesize

                36KB

                MD5

                9018fd85966acb075a6077f581e9c415

                SHA1

                6d2ddd0f1dde7ebbe5ad037a7f1588a0d074806e

                SHA256

                b66fe3af1bc03d7e5db29ce891bfd74b993c0ce51b62996c3597ab94ee2ef3dc

                SHA512

                56b09c151580d09752eec68ba0f352a8d04f54be32a1e1442899c8f4c24acb751ffdc663040efe1bcf51f1600b3f395168b0e02e696565c86d495adecfa982cb

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7534543.exe

                Filesize

                234KB

                MD5

                b786098c10ef1eb2666be81b39e90d70

                SHA1

                56aaafa89e86b6453b7e200bcf267054fdbb9e89

                SHA256

                6fdb9ee41ccdf016c13381cd5e63143c68c4a9d37eb1df34bbcf29ba497c5f34

                SHA512

                d80f60aad2a7a704f7462a5a7055d398a50a18a4b2277b70ccd7f9694c08e3df58e23c7f4ca059af2e499ee9f34ff380b459b35471ad3d82a2a70396261dbcaf

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9088149.exe

                Filesize

                13KB

                MD5

                f8e8d84ee1180cf04cb01bbf1e053624

                SHA1

                eea22fb1665b5207cc6f08ad3073583020d50d5e

                SHA256

                859e6ad11c4a75949c0392c1913581e5b29cbad41785dbfbd22965c4528a2fc5

                SHA512

                1461454dbf645266d7854228d2344c2561d4699e68eb212f326fe5d7e90c9fdbb7ca062feb17c0afc922a57c7a23bad412d338a7fc14bac8b5e1a0ac0c4a1edc

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0441540.exe

                Filesize

                225KB

                MD5

                1cbbdf5652b08dce4b85036f6830622d

                SHA1

                33cd3306e88009701d2fc86ae1d50abdf356b78d

                SHA256

                067c4afa5333fda19de1c681eb2bb0f815529fd10a57f8dc82d35935e45bbf9e

                SHA512

                ed59c16425568d61e2458c32cf2beb851a3befaa2c07422b25f845bcf358cf928fbafac88cfe60a11bb99cb352dc8577743955f5b7bf50304e4b4d4dc33eea34

              • memory/1152-21-0x0000000000B70000-0x0000000000B7A000-memory.dmp

                Filesize

                40KB

              • memory/1152-22-0x00007FFD5B0B3000-0x00007FFD5B0B5000-memory.dmp

                Filesize

                8KB

              • memory/2424-40-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/2640-45-0x0000000000DC0000-0x0000000000DF0000-memory.dmp

                Filesize

                192KB

              • memory/2640-46-0x00000000057E0000-0x00000000057E6000-memory.dmp

                Filesize

                24KB

              • memory/2640-47-0x000000000B230000-0x000000000B848000-memory.dmp

                Filesize

                6.1MB

              • memory/2640-48-0x000000000AD70000-0x000000000AE7A000-memory.dmp

                Filesize

                1.0MB

              • memory/2640-49-0x000000000ACB0000-0x000000000ACC2000-memory.dmp

                Filesize

                72KB

              • memory/2640-50-0x000000000AD10000-0x000000000AD4C000-memory.dmp

                Filesize

                240KB

              • memory/2640-51-0x00000000051D0000-0x000000000521C000-memory.dmp

                Filesize

                304KB