Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 12:30

General

  • Target

    1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe

  • Size

    390KB

  • MD5

    1b39c696c7ebdec56e5bd5e819ff51c2

  • SHA1

    13499e2a975747bbc7dfa629b93c79143980cb5e

  • SHA256

    1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691

  • SHA512

    bd4e865d924da4f2cbbb97f96cc5b31c88f4698fb5d4bc109e191336171aa87f64458960279732395e1ec47c4a10683809435612d9bce181f440a653ff2e3f8c

  • SSDEEP

    6144:KKy+bnr+vp0yN90QEITqYImmruIrRHY6y0ZJJqB5bu9CVCyXyNRK2h7nSXO/:uMrry90mTImmiazSBJlwuXO/

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://5.42.92.67

Attributes
  • install_dir

    ebb444342c

  • install_file

    legola.exe

  • strings_key

    5680b049188ecacbfa57b1b29c2f35a7

  • url_paths

    /norm/index.php

rc4.plain

Extracted

Family

redline

Botnet

krast

C2

77.91.68.68:19071

Attributes
  • auth_value

    9059ea331e4599de3746df73ccb24514

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe
    "C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2868
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:820
        • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
          "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3412
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4988
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:2404
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legola.exe" /P "Admin:N"
                6⤵
                  PID:2100
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "legola.exe" /P "Admin:R" /E
                  6⤵
                    PID:3644
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:4252
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\ebb444342c" /P "Admin:N"
                      6⤵
                        PID:3556
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\ebb444342c" /P "Admin:R" /E
                        6⤵
                          PID:4932
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2260
              • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                1⤵
                • Executes dropped EXE
                PID:4620
              • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
                1⤵
                • Executes dropped EXE
                PID:3856

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe

                Filesize

                173KB

                MD5

                b8c5d95c1f7a38803ce7e06a3163b115

                SHA1

                8f5850e40c86222637fdf8fe190880eb203bd546

                SHA256

                dca8ac02fa9e6017548cee8be5c5073643fb1096ed887ac87301018c8f663f61

                SHA512

                2d55b6393a16147be65d6f5dd8b35bbea1b06b6aafd32256a2accb59877156de41dec5d48f8d05a22abb2853f32ac79932fc43cca7d38a83e89e2f14c55b823c

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe

                Filesize

                234KB

                MD5

                859530ca071eca4d755d51e586e8e887

                SHA1

                de62d33ce5bdbcaee3969c0b7f5923be57f65b18

                SHA256

                51fe2b44092632d15df632de06f77403d4ed876e788b6b513102a552a4fd7532

                SHA512

                acd81f2a81bdf865b7ae581034c813d41e694cd942ceca7c5ce801d427c5163803da91d0d06e6eeef5b7906af6dcd075aa869eb5901c96fb162a9031cb0621c1

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe

                Filesize

                11KB

                MD5

                9df47b120c7025ec8ffdc3338bf3371a

                SHA1

                18c9a5590d838f935ea38598118558686094db80

                SHA256

                cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829

                SHA512

                a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe

                Filesize

                223KB

                MD5

                a748d210956507aaeb3aa55c796c4493

                SHA1

                6536facee8829b5d0cab1bcb31c9bb528812c0eb

                SHA256

                970a4c051a4e15f2fb1aef52a2916e417719475bf3bf076194c3978ca526ac83

                SHA512

                e117d4e660e74fafee8aab8cc412969b6f27287ce9efd787a72aa40d4128853b46e5a04e5217f1d72cbd5b69ac5570d49c823134776aa9f9cb297b71061aed25

              • memory/2260-36-0x000000000A430000-0x000000000A53A000-memory.dmp

                Filesize

                1.0MB

              • memory/2260-33-0x00000000005C0000-0x00000000005F0000-memory.dmp

                Filesize

                192KB

              • memory/2260-34-0x0000000002760000-0x0000000002766000-memory.dmp

                Filesize

                24KB

              • memory/2260-35-0x000000000A8F0000-0x000000000AF08000-memory.dmp

                Filesize

                6.1MB

              • memory/2260-37-0x000000000A370000-0x000000000A382000-memory.dmp

                Filesize

                72KB

              • memory/2260-38-0x000000000A3D0000-0x000000000A40C000-memory.dmp

                Filesize

                240KB

              • memory/2260-39-0x00000000048D0000-0x000000000491C000-memory.dmp

                Filesize

                304KB

              • memory/2868-15-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

                Filesize

                40KB

              • memory/2868-14-0x00007FFE0D463000-0x00007FFE0D465000-memory.dmp

                Filesize

                8KB