Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe
Resource
win10v2004-20241007-en
General
-
Target
8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe
-
Size
1.2MB
-
MD5
5c2c058f699ac46e10c7f068867cca5a
-
SHA1
59e553b1de8fcf53f382412a61ab081f90e217d2
-
SHA256
8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1
-
SHA512
eceb41eeb5609eb8496828ee5c1a031f642720b9eb18440d1e3b316527db4e2f1a709b7cc11e2c58196214fbebf5a4cab76872f5c119839e021fcb06ab260da4
-
SSDEEP
24576:ctRGhsPWEqfsDGbKmncgXF1z3hA0yPM5gLle1kwI:+RG4qUqumci1z3hA0yy
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral2/files/0x000b000000023b92-30.dat healer behavioral2/memory/3044-32-0x00000000007B0000-0x00000000007BA000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az595124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az595124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az595124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az595124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az595124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az595124.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
resource yara_rule behavioral2/memory/4828-55-0x00000000072D0000-0x000000000730C000-memory.dmp family_redline behavioral2/memory/4828-57-0x0000000007900000-0x000000000793A000-memory.dmp family_redline behavioral2/memory/4828-65-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-119-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-101-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-91-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-83-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-63-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-61-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-59-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-58-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-117-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-115-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-113-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-111-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-109-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-107-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-105-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-103-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-99-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-97-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-95-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-93-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-89-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-87-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-85-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-81-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-79-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-77-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-75-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-73-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-71-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-69-0x0000000007900000-0x0000000007935000-memory.dmp family_redline behavioral2/memory/4828-67-0x0000000007900000-0x0000000007935000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation bu844939.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 4448 ki212744.exe 1976 ki298702.exe 3564 ki007613.exe 3044 az595124.exe 3516 bu844939.exe 2956 oneetx.exe 4828 cf829870.exe 3952 oneetx.exe 2868 oneetx.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az595124.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ki212744.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ki298702.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" ki007613.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 388 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki007613.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki298702.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki212744.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bu844939.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf829870.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3044 az595124.exe 3044 az595124.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3044 az595124.exe Token: SeDebugPrivilege 4828 cf829870.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3516 bu844939.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 548 wrote to memory of 4448 548 8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe 87 PID 548 wrote to memory of 4448 548 8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe 87 PID 548 wrote to memory of 4448 548 8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe 87 PID 4448 wrote to memory of 1976 4448 ki212744.exe 88 PID 4448 wrote to memory of 1976 4448 ki212744.exe 88 PID 4448 wrote to memory of 1976 4448 ki212744.exe 88 PID 1976 wrote to memory of 3564 1976 ki298702.exe 89 PID 1976 wrote to memory of 3564 1976 ki298702.exe 89 PID 1976 wrote to memory of 3564 1976 ki298702.exe 89 PID 3564 wrote to memory of 3044 3564 ki007613.exe 90 PID 3564 wrote to memory of 3044 3564 ki007613.exe 90 PID 3564 wrote to memory of 3516 3564 ki007613.exe 95 PID 3564 wrote to memory of 3516 3564 ki007613.exe 95 PID 3564 wrote to memory of 3516 3564 ki007613.exe 95 PID 3516 wrote to memory of 2956 3516 bu844939.exe 96 PID 3516 wrote to memory of 2956 3516 bu844939.exe 96 PID 3516 wrote to memory of 2956 3516 bu844939.exe 96 PID 1976 wrote to memory of 4828 1976 ki298702.exe 97 PID 1976 wrote to memory of 4828 1976 ki298702.exe 97 PID 1976 wrote to memory of 4828 1976 ki298702.exe 97 PID 2956 wrote to memory of 792 2956 oneetx.exe 98 PID 2956 wrote to memory of 792 2956 oneetx.exe 98 PID 2956 wrote to memory of 792 2956 oneetx.exe 98 PID 2956 wrote to memory of 3748 2956 oneetx.exe 100 PID 2956 wrote to memory of 3748 2956 oneetx.exe 100 PID 2956 wrote to memory of 3748 2956 oneetx.exe 100 PID 3748 wrote to memory of 2276 3748 cmd.exe 102 PID 3748 wrote to memory of 2276 3748 cmd.exe 102 PID 3748 wrote to memory of 2276 3748 cmd.exe 102 PID 3748 wrote to memory of 2492 3748 cmd.exe 103 PID 3748 wrote to memory of 2492 3748 cmd.exe 103 PID 3748 wrote to memory of 2492 3748 cmd.exe 103 PID 3748 wrote to memory of 3956 3748 cmd.exe 104 PID 3748 wrote to memory of 3956 3748 cmd.exe 104 PID 3748 wrote to memory of 3956 3748 cmd.exe 104 PID 3748 wrote to memory of 2088 3748 cmd.exe 105 PID 3748 wrote to memory of 2088 3748 cmd.exe 105 PID 3748 wrote to memory of 2088 3748 cmd.exe 105 PID 3748 wrote to memory of 2560 3748 cmd.exe 106 PID 3748 wrote to memory of 2560 3748 cmd.exe 106 PID 3748 wrote to memory of 2560 3748 cmd.exe 106 PID 3748 wrote to memory of 3820 3748 cmd.exe 107 PID 3748 wrote to memory of 3820 3748 cmd.exe 107 PID 3748 wrote to memory of 3820 3748 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe"C:\Users\Admin\AppData\Local\Temp\8adbe79ff502bb7832393b9824fd3120ad2616903afe9c589530928b76149ac1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki212744.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki212744.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki298702.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki298702.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki007613.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki007613.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az595124.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az595124.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu844939.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu844939.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:792
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
- System Location Discovery: System Language Discovery
PID:2276
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"8⤵
- System Location Discovery: System Language Discovery
PID:2492
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E8⤵
- System Location Discovery: System Language Discovery
PID:3956
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"8⤵
- System Location Discovery: System Language Discovery
PID:2560
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E8⤵
- System Location Discovery: System Language Discovery
PID:3820
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf829870.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf829870.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3952
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2868
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:388
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
855KB
MD52fd9aa68544b56c3e3ca59f349c1f9bc
SHA17e5c86100808545a738b8e54d04b1ddc58022535
SHA25687d88ae0acfec206089d3333156ab5c0febfed00995616fbf9d021159c8cc6a3
SHA51211ea565d3553864a267a099bba6392916c5cf0e061d70bf4b282ee43eb39d4f14c6b0e77dcbfcb7c45f239d4ab788f3487750e3302d8bb7c7fd42a9fa0a9566b
-
Filesize
580KB
MD5109a78aa95e46d400f298e2413266634
SHA1df07508990d319d7fb2c7b6cd35ea2195675c692
SHA2561761d720d1c3aec2d47b8abbc248aab422b3d368e4f1861be4e9c77d901faa26
SHA512c1d1e38feb2a1c4b10bee528ca2c55e8050843e964880d2631449a26162965d4da29b6bb0c4ed521808e320177e4d991dd6dbb2521aef3c655cade68c4bde559
-
Filesize
360KB
MD5a9891aff23463349365d9db34f973f37
SHA1459b2ad7e1abf10cd47ae094748978a0dfd92676
SHA256394e802f27b9e9d2d75ba23dcc0ac8526f998a63f9e7eb91937bd443884537cd
SHA5125c5775b5187cafb78accea2da03a7f3629d7a09785fe2d109598b8c5c1f44a0ab9f442224f80d39df541da4ff4ea276cdf0ced68057e57fc0f04f7e0f6a3f40d
-
Filesize
223KB
MD55b5c75a9a5a9eba88436c609dde2c296
SHA138e49367ffda431e58cdb89741d820ee413161cb
SHA256ee5f1d9c7ef5915cd257146919b254d00b258edf0899498fe5c33ac599910e86
SHA5129884336575dd0f6ca4823483d028c9e2041a76aa179b374a20b2ffdeb2329a414a6976511a9ccb731bf9ba4390b31f17c132fdf5adfe1a2f9783cb35394e97c9
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
204KB
MD51304f384653e08ae497008ff13498608
SHA1d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA2562a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA5124138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1