Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:32

General

  • Target

    100f75e8ccb76de4ac7f1dd2892a2fe11d021779080189fea4e89f1d52b78b2c.exe

  • Size

    1.5MB

  • MD5

    a4148bc971e8dfd852829f2c3df581a9

  • SHA1

    605c1d4582885f66f33078acb945df77e0b8cf83

  • SHA256

    100f75e8ccb76de4ac7f1dd2892a2fe11d021779080189fea4e89f1d52b78b2c

  • SHA512

    c7d093a652881b67fff3830afac9a406017f12d72374edbdfe188a78c697e15e97771545dc26b2ef96bd2a9e1495d73ee555c388f36b454b908134d4bd132b1d

  • SSDEEP

    24576:Xy04+8/o0h/6aO0Of6KHtlhnX6A2kQwJrTZmyMs04U2N4eZc9FKDs3kHxSPIK2mK:i0aHy6YtPnWkQwJJl5U2N4eZcOY3AxqF

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\100f75e8ccb76de4ac7f1dd2892a2fe11d021779080189fea4e89f1d52b78b2c.exe
    "C:\Users\Admin\AppData\Local\Temp\100f75e8ccb76de4ac7f1dd2892a2fe11d021779080189fea4e89f1d52b78b2c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dE039464.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dE039464.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qm433307.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qm433307.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1264
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ay454788.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ay454788.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:728
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\184194069.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\184194069.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1432
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4696
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\200803696.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\200803696.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1456
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1252
              6⤵
              • Program crash
              PID:2196
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\397433487.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\397433487.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5412
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5368
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4768
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3680
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4284
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4516
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1432
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5924
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:6116
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4444
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\459415171.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\459415171.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5884
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 1256
          4⤵
          • Program crash
          PID:5556
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\578488271.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\578488271.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3192
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1456 -ip 1456
    1⤵
      PID:5960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5884 -ip 5884
      1⤵
        PID:5396
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6076
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:2368

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\578488271.exe

        Filesize

        168KB

        MD5

        920c0538b523fe3b67be84e1cc81fd55

        SHA1

        6aab2a35f770c06fb6dd1f555ac82caa8029e868

        SHA256

        20c2cced1bf88bd89918191bf304744bba845cbc60f2b7eecf3a23edb510385b

        SHA512

        316560327989457871c51b7f9f83eddf6b1a2e94824bee806eaaef0c0756786c18453f567e1bd73645781543a41aff93bd82bffdfa62db4b0e14731efba9746e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dE039464.exe

        Filesize

        1.3MB

        MD5

        a291b93ce9ae00d468a7b3c54802f126

        SHA1

        8a08d01d5a861fd03a6eb355667e1ad42d479b4e

        SHA256

        83775d63f98e41ae774102e42fcab9b3aa17f3f920e13c92ff216f496b0683f1

        SHA512

        7c24549f984c905ad3b6fa7cf0f742efe8aa03a484ef1d3e6963c17270ca20b82e0a5442aba000008e783513d8589a8ae26c8fba74bef00bc872bbb294e266e0

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\459415171.exe

        Filesize

        539KB

        MD5

        7c490157132fde7cb32990e7863c135b

        SHA1

        db8bafbf165c91a194489fa488b2f7138bb92370

        SHA256

        bc2fc67d8819c242fb75b2aff5e01e9eca8c27c753b4e9a2344a16d0fe85416e

        SHA512

        ab06bf157d205b2a52bc314f16aa0d97327b92da16903532a08bad6819b2fea3c01553ce4334a68c7fdf24fe97665eac8cb365422779d4b4b77afbd02fbf100a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qm433307.exe

        Filesize

        871KB

        MD5

        21fe7367e9d34a0cb7181beea5ca8b1e

        SHA1

        299e46e7a8d47d20ae6855112c7e08bc7f136ddc

        SHA256

        a1abd781b5f2ae21a849ae1b21cf0124ee5c6e8f6171924840402392fad56c91

        SHA512

        caa6c531892bd49289bda849bd8a91a76ce5f60ae192b007717d9fd3b24ca9070e3b3990f3b1945ddd6503e760edfe3d306ec9b815145abbed01bf0dc663572a

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\397433487.exe

        Filesize

        204KB

        MD5

        a85e1fc75da19de0fd31a7d50fc115e1

        SHA1

        d5992e275dce88a11bf36eceb726a33926a29075

        SHA256

        01f0ae074a96a1ec86c1380563fa20dd0467cfbe40ca639559bdf533fd5b232d

        SHA512

        929ff4a4f0a470d294b9bfe96e9c60b14d809b7388a62092d66e792aafc9a374d3ad23a355691d8b69574e4b1094d26d9cae186fec20db8a2858b0f6d6388586

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ay454788.exe

        Filesize

        699KB

        MD5

        a448715767c519a3e7aba7c4ff9849d4

        SHA1

        fb7523779800924b63275c0d4efd0031f0dc4bf7

        SHA256

        34de95e823eeb7f9a306778a58d0eae2b6a4a4848fedee9dd39e8419ed5108cf

        SHA512

        7784da608f3bdd29131828819f5032c4ba094947de1c06a7706d500d53b6cfebc5fd6708d62bf5f5427c9613ae145b23da0e01a70e1cbc04ad77df566f8405b6

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\184194069.exe

        Filesize

        300KB

        MD5

        c319b65b1d502abe94bbe714acb5aef2

        SHA1

        389e61194f62a81fd0187c0537b4a51e07d29279

        SHA256

        94eb28b50e127af1acfeda593d08dac0914336b7faf126a792c9d01b7cbf85b1

        SHA512

        931d525f18c9e81efd821fe4074d489011986589aa95d4f07862b924076b0e4653e89b02446253c24ea0174a5b10fb7f0b28768983f29d851f178cdc010324cd

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\200803696.exe

        Filesize

        479KB

        MD5

        6f67e151be0ca7ab2de824e8f82197fb

        SHA1

        85a0293eaeb722de3ed1e8b39e8b1b16be0084ae

        SHA256

        6d299bab2a5e7b2690af31d5023585dbc5d6bb20564413336934e919eecadc23

        SHA512

        c3c96ede98ead327d04e84853acdae33ec6610bcdd3b5d98a771d0467ecd095ec6906a4edf21cb0300cf69465c783a9ea2824b55b5419a688e1f9ce4563198da

      • C:\Windows\Temp\1.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • memory/1432-82-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-31-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-88-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-86-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-84-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-92-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-78-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-76-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-74-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-72-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-70-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-68-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-66-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-62-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-60-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-58-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-56-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-54-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-50-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-42-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-40-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-38-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-36-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-34-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-32-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-90-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-64-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-53-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-48-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-46-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-44-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-2159-0x00000000052F0000-0x00000000052FA000-memory.dmp

        Filesize

        40KB

      • memory/1432-94-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-80-0x0000000005000000-0x0000000005051000-memory.dmp

        Filesize

        324KB

      • memory/1432-28-0x00000000049B0000-0x0000000004A08000-memory.dmp

        Filesize

        352KB

      • memory/1432-29-0x0000000004A10000-0x0000000004FB4000-memory.dmp

        Filesize

        5.6MB

      • memory/1432-30-0x0000000005000000-0x0000000005056000-memory.dmp

        Filesize

        344KB

      • memory/1456-4305-0x0000000005740000-0x00000000057D2000-memory.dmp

        Filesize

        584KB

      • memory/3192-6479-0x0000000000FB0000-0x0000000000FE0000-memory.dmp

        Filesize

        192KB

      • memory/3192-6480-0x0000000003160000-0x0000000003166000-memory.dmp

        Filesize

        24KB

      • memory/3192-6481-0x0000000005F60000-0x0000000006578000-memory.dmp

        Filesize

        6.1MB

      • memory/3192-6482-0x0000000005A50000-0x0000000005B5A000-memory.dmp

        Filesize

        1.0MB

      • memory/3192-6483-0x0000000005940000-0x0000000005952000-memory.dmp

        Filesize

        72KB

      • memory/3192-6484-0x0000000005960000-0x000000000599C000-memory.dmp

        Filesize

        240KB

      • memory/3192-6485-0x00000000059E0000-0x0000000005A2C000-memory.dmp

        Filesize

        304KB

      • memory/4696-2174-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

        Filesize

        40KB

      • memory/5884-4325-0x0000000004ED0000-0x0000000004F38000-memory.dmp

        Filesize

        416KB

      • memory/5884-4326-0x0000000005500000-0x0000000005566000-memory.dmp

        Filesize

        408KB

      • memory/5884-6473-0x0000000005750000-0x0000000005782000-memory.dmp

        Filesize

        200KB