Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 18:21 UTC

General

  • Target

    1c0cc29edf3fda05ac6cd12ee7acdaf9ca6233c60ef212f53b42d088f670c7ac.exe

  • Size

    390KB

  • MD5

    232287f5d562489800292f58e7147c69

  • SHA1

    6b9b9011bd9a0580c06a3777ca9b55fe2795ca43

  • SHA256

    1c0cc29edf3fda05ac6cd12ee7acdaf9ca6233c60ef212f53b42d088f670c7ac

  • SHA512

    514849f08ef74213c0a9950145b9fa8564028d189d03588fdf023f21da03555a09a910d46ae89561628e556bc64dc02467bb8dfc4b303affb071f30847ab4b15

  • SSDEEP

    6144:Kxy+bnr+ap0yN90QEpKP4ky5OqsVrV8q/9uYF0JwNampLy4dom+/2YLxSjr:LMrWy90ziVrV8qP0JcXpv42aUjr

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

redline

Botnet

lande

C2

77.91.124.84:19071

Attributes
  • auth_value

    9fa41701c47df37786234f3373f21208

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c0cc29edf3fda05ac6cd12ee7acdaf9ca6233c60ef212f53b42d088f670c7ac.exe
    "C:\Users\Admin\AppData\Local\Temp\1c0cc29edf3fda05ac6cd12ee7acdaf9ca6233c60ef212f53b42d088f670c7ac.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8785138.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8785138.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5926792.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5926792.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3856
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6964309.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6964309.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
          "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3556
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4956
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:264
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "pdates.exe" /P "Admin:N"
                6⤵
                  PID:388
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "pdates.exe" /P "Admin:R" /E
                  6⤵
                    PID:1776
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:716
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\925e7e99c5" /P "Admin:N"
                      6⤵
                        PID:1700
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\925e7e99c5" /P "Admin:R" /E
                        6⤵
                          PID:4824
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1262873.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1262873.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2792
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:1684
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4048

              Network

              • flag-us
                DNS
                75.159.190.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                75.159.190.20.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                75.159.190.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                75.159.190.20.in-addr.arpa
                IN PTR
              • flag-us
                DNS
                77.190.18.2.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                77.190.18.2.in-addr.arpa
                IN PTR
                Response
                77.190.18.2.in-addr.arpa
                IN PTR
                a2-18-190-77deploystaticakamaitechnologiescom
              • flag-us
                DNS
                77.190.18.2.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                77.190.18.2.in-addr.arpa
                IN PTR
              • flag-be
                GET
                https://www.bing.com/th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
                Remote address:
                88.221.83.219:443
                Request
                GET /th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
                host: www.bing.com
                accept: */*
                accept-encoding: gzip, deflate, br
                user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                Response
                HTTP/2.0 200
                cache-control: public, max-age=2592000
                content-type: image/png
                access-control-allow-origin: *
                access-control-allow-headers: *
                access-control-allow-methods: GET, POST, OPTIONS
                timing-allow-origin: *
                report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                content-length: 999
                date: Thu, 09 May 2024 18:22:04 GMT
                alt-svc: h3=":443"; ma=93600
                x-cdn-traceid: 0.d753dd58.1715278924.7578834
              • flag-us
                DNS
                26.35.223.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                26.35.223.20.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                219.83.221.88.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                219.83.221.88.in-addr.arpa
                IN PTR
                Response
                219.83.221.88.in-addr.arpa
                IN PTR
                a88-221-83-219deploystaticakamaitechnologiescom
              • flag-us
                DNS
                43.229.111.52.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                43.229.111.52.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                43.229.111.52.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                43.229.111.52.in-addr.arpa
                IN PTR
              • 88.221.83.219:443
                https://www.bing.com/th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
                tls, http2
                1.5kB
                6.2kB
                17
                11

                HTTP Request

                GET https://www.bing.com/th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

                HTTP Response

                200
              • 77.91.124.84:19071
                n1262873.exe
                260 B
                5
              • 77.91.68.61:80
                pdates.exe
                260 B
                5
              • 77.91.124.84:19071
                n1262873.exe
                260 B
                5
              • 77.91.68.61:80
                pdates.exe
                260 B
                5
              • 77.91.124.84:19071
                n1262873.exe
                260 B
                5
              • 77.91.68.61:80
                pdates.exe
                260 B
                5
              • 77.91.124.84:19071
                n1262873.exe
                260 B
                5
              • 77.91.124.84:19071
                n1262873.exe
                260 B
                5
              • 77.91.124.84:19071
                n1262873.exe
                208 B
                4
              • 8.8.8.8:53
                75.159.190.20.in-addr.arpa
                dns
                144 B
                158 B
                2
                1

                DNS Request

                75.159.190.20.in-addr.arpa

                DNS Request

                75.159.190.20.in-addr.arpa

              • 8.8.8.8:53
                77.190.18.2.in-addr.arpa
                dns
                140 B
                133 B
                2
                1

                DNS Request

                77.190.18.2.in-addr.arpa

                DNS Request

                77.190.18.2.in-addr.arpa

              • 8.8.8.8:53
                26.35.223.20.in-addr.arpa
                dns
                71 B
                157 B
                1
                1

                DNS Request

                26.35.223.20.in-addr.arpa

              • 8.8.8.8:53
                219.83.221.88.in-addr.arpa
                dns
                72 B
                137 B
                1
                1

                DNS Request

                219.83.221.88.in-addr.arpa

              • 8.8.8.8:53
                43.229.111.52.in-addr.arpa
                dns
                144 B
                158 B
                2
                1

                DNS Request

                43.229.111.52.in-addr.arpa

                DNS Request

                43.229.111.52.in-addr.arpa

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1262873.exe

                Filesize

                173KB

                MD5

                32c2acad2c12abb25019500dad28c31a

                SHA1

                e3257b765ac17610819329b8fdce2e80203767d7

                SHA256

                1a058c4e3e19863aa5969585d26eac9d357e1ecb0fb6170dad6e2f5907547465

                SHA512

                01e0d106c9668514f0bd6f3caa53fc5af0f0d658d213d99c473fe35bf8edd8a8ba1185310b571cb1700d7b9dd3ce67ef53f5d4bf4806f2c890c18a57ac433287

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8785138.exe

                Filesize

                234KB

                MD5

                7656d0226e7d34f51709ef23d12c4f37

                SHA1

                388c380d267da66b9cdb330597de99966d91c11c

                SHA256

                8e5cbb6b3a5579e441baff3482ecceeaf640dcf272a9ec2d7f7993e6d2363aaa

                SHA512

                9134d3f4ff369a9a05cc0c75d3cfb6645178c2076bf93e662d19595e27cb7c13e0da031d5bed67058551d152a20536ce3389e49eecb19e2c3bb08e95365a87cd

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5926792.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6964309.exe

                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

              • memory/2792-36-0x0000000005B40000-0x0000000005C4A000-memory.dmp

                Filesize

                1.0MB

              • memory/2792-33-0x0000000000FB0000-0x0000000000FE0000-memory.dmp

                Filesize

                192KB

              • memory/2792-34-0x00000000059D0000-0x00000000059D6000-memory.dmp

                Filesize

                24KB

              • memory/2792-35-0x0000000006010000-0x0000000006628000-memory.dmp

                Filesize

                6.1MB

              • memory/2792-37-0x0000000005A80000-0x0000000005A92000-memory.dmp

                Filesize

                72KB

              • memory/2792-38-0x0000000005AE0000-0x0000000005B1C000-memory.dmp

                Filesize

                240KB

              • memory/2792-39-0x0000000005C50000-0x0000000005C9C000-memory.dmp

                Filesize

                304KB

              • memory/3856-14-0x00007FF96DAD3000-0x00007FF96DAD5000-memory.dmp

                Filesize

                8KB

              • memory/3856-15-0x0000000000170000-0x000000000017A000-memory.dmp

                Filesize

                40KB

              We care about your privacy.

              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.