Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 12:30

General

  • Target

    1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe

  • Size

    514KB

  • MD5

    1942d1d3d93833f0a1d4f5381ce33a23

  • SHA1

    4056636db4625bb6b3fee03b4c1be992681affa9

  • SHA256

    1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e

  • SHA512

    a9569c93345b4565b8e9bd30a1b09400eaba1ddeb3fbcf00d53563d1ba34d4d6f4f5bba9ffe6852ff699de66e8177eab35ffc771741fd9d528e6802726aa3a6c

  • SSDEEP

    12288:SMrqy908fsn+JqW9WsGJPMj1kn4tBA6jmcRyqBq08:4yIEqwWsKmy4YikWJ8

Malware Config

Extracted

Family

amadey

Version

3.85

C2

http://77.91.68.3

Attributes
  • install_dir

    3ec1f323b5

  • install_file

    danke.exe

  • strings_key

    827021be90f1e85ab27949ea7e9347e8

  • url_paths

    /home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

roma

C2

77.91.68.56:19071

Attributes
  • auth_value

    f099c2cf92834dbc554a94e1456cf576

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3228
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
            "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1384
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:5524
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:6016
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:4840
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "danke.exe" /P "Admin:N"
                  7⤵
                    PID:5660
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "danke.exe" /P "Admin:R" /E
                    7⤵
                      PID:5368
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:5096
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\3ec1f323b5" /P "Admin:N"
                        7⤵
                          PID:4792
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\3ec1f323b5" /P "Admin:R" /E
                          7⤵
                            PID:3628
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:4444
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3120
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:5640
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:5036

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe

                Filesize

                174KB

                MD5

                fd61776b34b5a58e732533da17d122d0

                SHA1

                336015c059047a658ea57b6ebe49418d23a65593

                SHA256

                64faeec435f51816cff0efdacc9e777d677400fd7a59bc1e037a24ec7ae7cb4b

                SHA512

                afbd9465a721b8e447359c88451f9525ecc5f3aedf79be424b49d4a93d5921797854471257fb1f1ea7d967e56d54aec7b712773875f92fd4335e5a12afd4fc68

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe

                Filesize

                359KB

                MD5

                e5fee7b57e9630eb6cbe1861cb6d1a82

                SHA1

                de69d6c77a4db78be5c7239199528da46bd4a9b9

                SHA256

                e7da30afc9870af8478dffe8cb7c3517dbcd725d83d3c9e7435cc5bcfaa1a76d

                SHA512

                c7af1fd9383094548929920e18b2adeb6d07fded702fc748f557d913ad8521c666e419aee611d994ec94154830967e39d797a98ba0cd18ab10548ce85f6a02ba

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe

                Filesize

                31KB

                MD5

                c4c414d786976435cb8561c43d8dc57d

                SHA1

                fd73133d3509d1a6982b000a75b9dbdc7769ec22

                SHA256

                129a6c5e5a8d98619b5be3818dfde6bab9c5345171d9d8401b886fed0660817a

                SHA512

                744106f95b8f57ea59e2906a7cbaf2e1a172cee013be12f0752b3308c428f92f9824a2497f3fced82d9124d3ab52448d3b240889fdad26925e710aa47f67b028

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe

                Filesize

                235KB

                MD5

                b3f0cfa1b2d4fab75074fe1a7b426ebb

                SHA1

                61d950a5d649826b8b646453df4398cdd56189b9

                SHA256

                0bd882b9fd1549e5b281cbaa19a8a2a2952a03219737db0af5cadf4e817c0561

                SHA512

                0141c9f835859df5fa0d8a04d010482961a693bada72d57e60677ee84b79bc86e59b523b3a4f9168fb240a815d9f80fbba05cc0d5f5a7f7d0415d0eabef699d0

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe

                Filesize

                13KB

                MD5

                c9767fb557c8496da35f32149019f254

                SHA1

                dc206616148aad4e06dd3fb380d34b4ba15a9c6d

                SHA256

                d039e2510d33b0cca9b9d06c2be8152c5e126660c7860649dd966e1a7b375e9c

                SHA512

                f9c225248b0a8f9766b936694f71b347a0f006110928d26717d886d6b78f1b9ea3b3518a3123004cb20c4d4ffa5eb394bd169641163b297046a967f1ac9c4445

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe

                Filesize

                225KB

                MD5

                9728e9852854da025b4314bd0fd3687c

                SHA1

                6a87c09c8e29b6ca1c336416088f12cce0c206f8

                SHA256

                2c0f306d091f752e409e8bcbe20934ffa23430a90dea79c62aff27ee1b3035cf

                SHA512

                23df44bd9f5ae665f2d4c320603162b1d98b30b5610e99b5a9082843d76f0a6444e83e1c1792c2febf20d771b297777af8faa0403ba80f2f3f8b1c487abf7144

              • memory/1720-22-0x00000000002A0000-0x00000000002AA000-memory.dmp

                Filesize

                40KB

              • memory/1720-21-0x00007FFC52FF3000-0x00007FFC52FF5000-memory.dmp

                Filesize

                8KB

              • memory/3120-44-0x0000000000830000-0x0000000000860000-memory.dmp

                Filesize

                192KB

              • memory/3120-45-0x0000000005150000-0x0000000005156000-memory.dmp

                Filesize

                24KB

              • memory/3120-46-0x000000000AC60000-0x000000000B278000-memory.dmp

                Filesize

                6.1MB

              • memory/3120-47-0x000000000A7E0000-0x000000000A8EA000-memory.dmp

                Filesize

                1.0MB

              • memory/3120-48-0x000000000A720000-0x000000000A732000-memory.dmp

                Filesize

                72KB

              • memory/3120-49-0x000000000A780000-0x000000000A7BC000-memory.dmp

                Filesize

                240KB

              • memory/3120-50-0x0000000004BE0000-0x0000000004C2C000-memory.dmp

                Filesize

                304KB

              • memory/4444-40-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB