Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:31

General

  • Target

    429c07af262631e4f38bdf15db90507be5f2d1a3eecfb8620bd99568ef578cd0.exe

  • Size

    1.1MB

  • MD5

    12f2278dd5f33b271cb431133dd011cf

  • SHA1

    5fa32ec32a316d526cb5fb6740b16c4681ba8bc3

  • SHA256

    429c07af262631e4f38bdf15db90507be5f2d1a3eecfb8620bd99568ef578cd0

  • SHA512

    23a1b4c2707376cff0cb21f32896555ab1459a7a0793e67b477de2759a6998f373ef5042a382501be3b94bb157da2c26eff679c60a5c5a74c1dd0e028441d01b

  • SSDEEP

    24576:LyeJWjtbkekP5XOFzdImRGbcVMxqcJwScvm+WD1wPgb:+4gBhu5sdIcJVim4

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 34 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\429c07af262631e4f38bdf15db90507be5f2d1a3eecfb8620bd99568ef578cd0.exe
    "C:\Users\Admin\AppData\Local\Temp\429c07af262631e4f38bdf15db90507be5f2d1a3eecfb8620bd99568ef578cd0.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xy810412.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xy810412.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wC577451.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wC577451.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:368
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zX270953.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zX270953.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\179049778.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\179049778.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2380
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284555789.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284555789.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3668
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\369119377.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\369119377.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3588
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3484
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4984
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4936
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:704
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1148
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2328
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1636
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\496765627.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\496765627.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:544
  • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:540
  • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:5616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xy810412.exe

    Filesize

    994KB

    MD5

    e1ac4373bc426832a7128182140dbefb

    SHA1

    e66fb7ea872354ad215cd39306c38ec28c4218f1

    SHA256

    b9bdeb69c6d1bccf22e779440979f7140d2baf1d30b3098b441d8786b81efd2f

    SHA512

    524587f3623bb04f5d191ed216a8fc6551b8756082a7ef2da6342500db2a96f6e7d98293cc041d34001779f621476d25902d767efec370df0c48e4c22a0f841c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\496765627.exe

    Filesize

    415KB

    MD5

    8e84a414af46b61fd295b11335596bf9

    SHA1

    0f4487198ccd0a13c571910c262395bc13906c47

    SHA256

    c5d5517e330a4a56b062d3bd58c476332fdae52b515017cd9fd6143fa991dfa1

    SHA512

    36dbd62f96a7b9c3ef7be4f5a3be1b1e214ce6ae6f243ef5d0776ad51851be84e878bc177c402eea47747155705f990b1aca4f999fc87e7680c9de2f7db4ebca

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wC577451.exe

    Filesize

    610KB

    MD5

    9af33260ce6ff737542aa1b5e78b2c1a

    SHA1

    6a7ae05fd2242e6ee798fed4b92b77d81266d5fb

    SHA256

    12c9d96c00c75d09e85eb966d73d36cc41221036710365a0341ba34614d0a25f

    SHA512

    6b3ff4d82594665e0aa786deda420ee78ac63bc6117ea0024992daaddd849a74821ed259c6ae802006bf31f2866ed3de3630b87a16725baaba1a0ce44cb8b4ab

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\369119377.exe

    Filesize

    204KB

    MD5

    008bb78e347f6fc54a62a278578a77bf

    SHA1

    a0f7a80df0eae81e9cd4d2d93ea33a9ff03d39a7

    SHA256

    d97168722d002a36c8a2fc8155dca64dc28b27e883e6bf483b96bd5edda886c8

    SHA512

    36c78ad1d7c6ed702295733c96a120d0d8d468b635e5d49fa70f83f7e3ce0cb638e41f8cae9862b12e740d7d197e178c327ce1ec72f8e32a4a85b5eac18638be

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zX270953.exe

    Filesize

    438KB

    MD5

    14ec86dc6660ac4d42048035ab61df60

    SHA1

    b4efd236bb744da38df393524d5941e81f42cbe2

    SHA256

    6c6c6657144896c42212adbae2e70cd2fa91aa6b4910cabb986d4000a9daf314

    SHA512

    2ab43b5127a05ccce2994c3fa8381d30a0d9c5dbbae76e369ebccf545374abcf7a97ffbb2d2a1325c77e4edfd78ac0071929edad81d42684f122508218286528

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\179049778.exe

    Filesize

    176KB

    MD5

    85bfba8fe8d97d64c48d89ff474beb10

    SHA1

    1c70be26e74499b0068ff17880586addaf1b984b

    SHA256

    27318550e7c58fbfa8a04d25c689d9b18bb1b45e36419ca926129610d1ece1cb

    SHA512

    e5f1c4801b49b8d2c1deeb2fb87e58270ae94bfea6b03ffb198af7cd5543a137437da971d2ff9d435e2bd87aff58c8b72333764e42cd924ec3c18f09efb5d124

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284555789.exe

    Filesize

    333KB

    MD5

    7a8728f6cc1134f9471cad9f19dc47c4

    SHA1

    c0ff6800ad308d1d36a0419ee4329635300ae03c

    SHA256

    25732fea26b16873700a3c85980c2ca3eca671cb6a0412871255c2ed7a5dd201

    SHA512

    121cc592782074d8a2f6cf642a0f9c6c56297ce4787ce1abe03336bdb1488981b9a314cfcc0b1b30802f971e597ad0bc7c6bbaebebf8533103ae98d764bc3804

  • memory/544-114-0x0000000002370000-0x00000000023AC000-memory.dmp

    Filesize

    240KB

  • memory/544-115-0x00000000050C0000-0x00000000050FA000-memory.dmp

    Filesize

    232KB

  • memory/544-912-0x0000000002290000-0x00000000022DC000-memory.dmp

    Filesize

    304KB

  • memory/544-911-0x0000000007720000-0x000000000775C000-memory.dmp

    Filesize

    240KB

  • memory/544-910-0x0000000007600000-0x000000000770A000-memory.dmp

    Filesize

    1.0MB

  • memory/544-908-0x0000000007BE0000-0x00000000081F8000-memory.dmp

    Filesize

    6.1MB

  • memory/544-909-0x00000000026A0000-0x00000000026B2000-memory.dmp

    Filesize

    72KB

  • memory/544-116-0x00000000050C0000-0x00000000050F5000-memory.dmp

    Filesize

    212KB

  • memory/544-117-0x00000000050C0000-0x00000000050F5000-memory.dmp

    Filesize

    212KB

  • memory/544-119-0x00000000050C0000-0x00000000050F5000-memory.dmp

    Filesize

    212KB

  • memory/544-121-0x00000000050C0000-0x00000000050F5000-memory.dmp

    Filesize

    212KB

  • memory/2380-43-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-50-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-44-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-40-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-36-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-34-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-32-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-56-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-48-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-28-0x00000000021A0000-0x00000000021BA000-memory.dmp

    Filesize

    104KB

  • memory/2380-46-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-29-0x0000000004BA0000-0x0000000005144000-memory.dmp

    Filesize

    5.6MB

  • memory/2380-30-0x0000000002430000-0x0000000002448000-memory.dmp

    Filesize

    96KB

  • memory/2380-31-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-38-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-58-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-54-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/2380-52-0x0000000002430000-0x0000000002443000-memory.dmp

    Filesize

    76KB

  • memory/3668-65-0x0000000002490000-0x00000000024A8000-memory.dmp

    Filesize

    96KB

  • memory/3668-89-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-79-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-75-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-73-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-71-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-83-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-85-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-87-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-81-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-91-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-93-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-77-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-69-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-64-0x0000000002240000-0x000000000225A000-memory.dmp

    Filesize

    104KB

  • memory/3668-67-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-66-0x0000000002490000-0x00000000024A2000-memory.dmp

    Filesize

    72KB

  • memory/3668-94-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/3668-96-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB