Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 12:28

General

  • Target

    61ec6f7f3198f2f73155461b5544c1c55e467d0faa1776e05504a411b0530974.exe

  • Size

    680KB

  • MD5

    15c6e3a281fa49b0888ba712bdcf5d2d

  • SHA1

    215c908f8d6cea84000eb0e217088146a89e1be7

  • SHA256

    61ec6f7f3198f2f73155461b5544c1c55e467d0faa1776e05504a411b0530974

  • SHA512

    e42aae85487285410c2df8fc02941556cab4528aec809f2467c13de83ca8e6cbcdd6a24b34214c4fac674dc16a08fefdef64814feebac1b51553c9fbd253fde4

  • SSDEEP

    12288:UMrty900Sjwa4O2Nx174H8O9yWGxVeO+/n24gzqzC0W3PJyW:hyewOmxxyYWGXFI24g2zC0+R

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain

Extracted

Family

redline

Botnet

welos

C2

77.91.124.156:19071

Attributes
  • auth_value

    9605367dc0a1f64eb2f71769fb518fcf

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61ec6f7f3198f2f73155461b5544c1c55e467d0faa1776e05504a411b0530974.exe
    "C:\Users\Admin\AppData\Local\Temp\61ec6f7f3198f2f73155461b5544c1c55e467d0faa1776e05504a411b0530974.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6078870.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6078870.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8094658.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8094658.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1890207.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1890207.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8400544.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8400544.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3300
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7161503.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7161503.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3556
            • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
              "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3216
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:2932
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3772
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:1780
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "pdates.exe" /P "Admin:N"
                    8⤵
                      PID:2440
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "pdates.exe" /P "Admin:R" /E
                      8⤵
                        PID:2444
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:380
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\925e7e99c5" /P "Admin:N"
                          8⤵
                            PID:4320
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\925e7e99c5" /P "Admin:R" /E
                            8⤵
                              PID:4856
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9747003.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9747003.exe
                      4⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      PID:1892
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d7741225.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d7741225.exe
                    3⤵
                    • Executes dropped EXE
                    PID:2288
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:1272
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:3404

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6078870.exe

                Filesize

                515KB

                MD5

                46a5f69bf60289bf73f38e1d9be85075

                SHA1

                8639931600b10364a4c823b701c00893c22aea6b

                SHA256

                65db5d7052987e7e8d814719a1e9c77b7d0f755b7f100a0b3f0b0d1b83d9b43e

                SHA512

                dbc4506574b8a92d600e60fd642f44942f2a19c3effbf284891da05751b5b6d82dab4122dab6abc758ec40eb366e3e042c3bc46aec3360440e113a550cd7ce29

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d7741225.exe

                Filesize

                174KB

                MD5

                a438c0ff74d4f3006dd94b497bae7179

                SHA1

                d6618c08840cea64523e48bde1f433731049876d

                SHA256

                7a183cd5079b87c635002449d16a0fe2b686f777b58f507a5825033214aba176

                SHA512

                6ab764d9268aac5902b8026b7c5eb31e3956c86711e3ca52ab3fef12b45ad59a56b3ceb9e671c2efdf7b34543aa263dffe236eada2c754f23aa2ff0b7484a342

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8094658.exe

                Filesize

                359KB

                MD5

                eb475f3a8c4a25a19fa0abdc1e907952

                SHA1

                8988b40a69f6cb754a42bc5c7871ed839629b504

                SHA256

                40fbde6d35302d77db924d8a4db6569c23336d9205e82f12a82228cc100edb71

                SHA512

                3199b26a1ce8049c64556a2a9d0465c3ffa479594ca01d7ce052ba64fd128ab9da6302bf55baaaf59479e3a4c53f0569d93d7bb4d1566d1d65b4864b4a20af09

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9747003.exe

                Filesize

                42KB

                MD5

                6b8535ff7acd76f5a865bfa3e04fe4f7

                SHA1

                26d3dc99f638cf9cae4681dd14269fe9723c904b

                SHA256

                acf67950c3da59de03f145d42b15fb141395c524a091a46a0cc24d07e3e286da

                SHA512

                ea3a27b4bb1bb8050b593f64f9bb9bf6ba53de10fb7e12a1e6687e156d85fb5757a1797ad7a7b6cc966730c9fa9b713b8ec01f1e2c2b315977ed47441571f83a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1890207.exe

                Filesize

                234KB

                MD5

                2dfe4d2812a48ddbf22392cc3a90970b

                SHA1

                4f1b63d32b90a492f98673c94646a42a6e853ac6

                SHA256

                9e6f3fd3f785137a445cbe56ff06c292a6df24180f53811fc86132a2bd4859c2

                SHA512

                8b30e6f60dc809e9411dd14439766ec61da1ce41170a987c6c917abfe8df3985d8d6870672b38e72c10317e178e032fdc94f1f36bc4c48cc79938ae9d7c9b6da

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8400544.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7161503.exe

                Filesize

                235KB

                MD5

                bc91e6e768fd91095e2345589ee83b4a

                SHA1

                8d1b66b836cb0e5134a3f807e6f552068ae3e049

                SHA256

                d0ad15538e2a3f9aedb1b72fcd30581d83b8ca9e8e044f1a404cd3a71cc601a4

                SHA512

                2d8766287f50a95994a2c4496f09114406faa469baeb3719c061e08b323dd359338ba0a8fe526c2f7138fa1c8fa3018743ce2a26203626ecc5901e179d5224b1

              • memory/1892-46-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/1892-47-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/2288-53-0x000000000A460000-0x000000000AA78000-memory.dmp

                Filesize

                6.1MB

              • memory/2288-51-0x0000000000110000-0x0000000000140000-memory.dmp

                Filesize

                192KB

              • memory/2288-52-0x0000000004A30000-0x0000000004A36000-memory.dmp

                Filesize

                24KB

              • memory/2288-54-0x0000000009F80000-0x000000000A08A000-memory.dmp

                Filesize

                1.0MB

              • memory/2288-55-0x0000000009EC0000-0x0000000009ED2000-memory.dmp

                Filesize

                72KB

              • memory/2288-56-0x0000000009F20000-0x0000000009F5C000-memory.dmp

                Filesize

                240KB

              • memory/2288-57-0x00000000022A0000-0x00000000022EC000-memory.dmp

                Filesize

                304KB

              • memory/3300-28-0x0000000000250000-0x000000000025A000-memory.dmp

                Filesize

                40KB