Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 03:57

General

  • Target

    8c26f22050f84978e18a5b7f1ff0f9f03e77bbccb36b89b4b44282d2e60ebf7c.exe

  • Size

    1.4MB

  • MD5

    aa7d885343b72ffd69fd1fdb4d8470ec

  • SHA1

    ccd31be589e886c276ef516fc4e3bcd2e0435443

  • SHA256

    8c26f22050f84978e18a5b7f1ff0f9f03e77bbccb36b89b4b44282d2e60ebf7c

  • SHA512

    8ec58dc5361320ce8aa152f7d9d4940d9439cf1d79961258877a459ed2a9728f8a6b48d69fddbd10526c09bfc666614abf6a87463523989022a3922fd0ccf0cd

  • SSDEEP

    24576:oyNCCxw2QY/e8qnxc7mURIaglxYa95ghJrC6GfxnkNOXl1cF7:vvxw29xR7gXV95+rTGfx0S1q

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

amadey

Version

3.70

Botnet

47f88f

C2

http://193.201.9.43

Attributes
  • install_dir

    595f021478

  • install_file

    oneetx.exe

  • strings_key

    4971eddfd380996ae21bea987102e417

  • url_paths

    /plays/chapter/index.php

rc4.plain

Extracted

Family

redline

Botnet

maxi

C2

185.161.248.90:4125

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c26f22050f84978e18a5b7f1ff0f9f03e77bbccb36b89b4b44282d2e60ebf7c.exe
    "C:\Users\Admin\AppData\Local\Temp\8c26f22050f84978e18a5b7f1ff0f9f03e77bbccb36b89b4b44282d2e60ebf7c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki985500.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki985500.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki822347.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki822347.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki526169.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki526169.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:224
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ki360229.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ki360229.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\az084722.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\az084722.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:464
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bu952194.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bu952194.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4464
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 1080
                7⤵
                • Program crash
                PID:1008
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5373.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5373.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2848
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3464
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 1384
              6⤵
              • Program crash
              PID:4548
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAz09s28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAz09s28.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5080
          • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4556
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:5792
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft695372.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft695372.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4464 -ip 4464
    1⤵
      PID:4696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2848 -ip 2848
      1⤵
        PID:4044
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:2320
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:4296
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:6028

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki985500.exe

        Filesize

        1.1MB

        MD5

        0d772014a02e3af312a5c2cc8f5a67ab

        SHA1

        433940dd4d9970736b3cd76e09055d56a00f241a

        SHA256

        b3952a1631d39daebcaf20b162d5d69c7724994b07b083701fde1cf3a7c78d58

        SHA512

        1f92bc1689d7795c6f6bd1e9d2492737144c766223a679267343dbb9767d0f2dad7ea35a7592172382fc04c597710b6e25e785d8072e9acc36e49b80b0c899f3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft695372.exe

        Filesize

        168KB

        MD5

        f3f0110dd728ebd7a2e20609f3b7ff33

        SHA1

        9e846ddfc4e53793c77a8b74395ed1c1c73da027

        SHA256

        f7dbb53256eb8a1896925f31a12ef486afea188abd1ff3b67ae7325e5e756751

        SHA512

        81da25c6e399a6f312473b567541a72cb9a7907dec4a572af2e3b44fe8ff37465a06652b8cf903e152518f518b16a5055c598f34dd96306aa1b620d0b0a0bc4f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki822347.exe

        Filesize

        983KB

        MD5

        5534ec941a9199ff6532fe97469fa148

        SHA1

        689b4f10e7e1c394732bb26d4c2f4138a3b0060f

        SHA256

        37707a22a26d5ace9d93e5dd650f9f3c6b6a81fb4ffb1036d47a7d61963229f4

        SHA512

        60519d66c2ae2a8ea3add9c5f4a2284b1efc8f2dabae9918fee38e3038ff65c6ed5067616786b3251cfa7f591bf4fc5cd0ba4b7aa9c8af4fa38960c13edd456b

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAz09s28.exe

        Filesize

        229KB

        MD5

        ee1f5f0e1168ce5938997c932b4dcd27

        SHA1

        b8c0928da3a41d579c19f44b9e1fef6014d06452

        SHA256

        dea01b17d6e06c3bdf6f5387faa77a788ce9726a3110db90294b2e207b3d51ed

        SHA512

        bacc2d22b71bc5bc73c0699aaf4e2271effa4fe47c3ac63f3ee3ae3385d963eb6f93db082a9530d75d5c6f13884f30b0375d41badfe540f31ef747003a36c0a8

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki526169.exe

        Filesize

        800KB

        MD5

        ef6255683b09b9788cc2411c296878fb

        SHA1

        91bc024ea5767ea331bad04940370b3d66ee3b12

        SHA256

        39f8469afca460dfd9e030a5b6c8058c29ce315216eb81d9a10acaeeacbd9901

        SHA512

        6ddaa49432dc275ff83b1896d51188909f2a97a9635792a5b474a6d4db4b497ddfa2263d1e514175fb95af566d6833cedb268412659d8babbeabb46f47a48b6c

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5373.exe

        Filesize

        438KB

        MD5

        914a80728cae4a184798fd18b2469885

        SHA1

        5f510006eaa7300c2d7ff5f7556b97a42b935466

        SHA256

        6e23c1e416eef1808f29384a0ee431f58304dfeb21ee02e9d15148ca0a49e83f

        SHA512

        1706f36a58d3983fa604a9290acfc98400911cfc6e7b8e5081c11ef5ad64c1744a960132ac59af64f180c387ce9916d2f1f85123301d357b7bf64ecac1ca770e

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ki360229.exe

        Filesize

        334KB

        MD5

        e4fd12f5174155d64776baa5dc6974c4

        SHA1

        401a3dcc7cf17cdf92c54f393dbc5421ef8053ab

        SHA256

        3ca68b3b3b94759108086e9b927122af42a81dea5271d79509b6773ffb40cd1e

        SHA512

        9e250ffe30b7e776a202eae023adf0d516eaf459a8b9f9d435791c229e743e053bd1a4cf4d9a9b365e69b0fd0c877e4822f1528ed7916067a9671466176d82d4

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\az084722.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bu952194.exe

        Filesize

        254KB

        MD5

        48c5a8bd416d0fe60bd8da1d2064243b

        SHA1

        d826f436fc87ce8320e24de570ea199a43a13e60

        SHA256

        ee2d80f2dba34070692aff9f173ed7a4b3dfb5bc3e66979a376a09cb779c1fb5

        SHA512

        d339b49cc5a36870f7f3972f3f093806f30e7b795dfb825bcb42f9c3190c7cf5edfe417264839504fed5b9dd35a8f647f381ac8e327d839f3cc16d9e8b535c74

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        03728fed675bcde5256342183b1d6f27

        SHA1

        d13eace7d3d92f93756504b274777cc269b222a2

        SHA256

        f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

        SHA512

        6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

      • memory/464-35-0x0000000000E60000-0x0000000000E6A000-memory.dmp

        Filesize

        40KB

      • memory/2848-102-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-2223-0x0000000005400000-0x0000000005432000-memory.dmp

        Filesize

        200KB

      • memory/2848-81-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-82-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-84-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-86-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-89-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-90-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-95-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-96-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-98-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-104-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-106-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-108-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-110-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-112-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-114-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-79-0x0000000002420000-0x0000000002488000-memory.dmp

        Filesize

        416KB

      • memory/2848-80-0x00000000025F0000-0x0000000002656000-memory.dmp

        Filesize

        408KB

      • memory/2848-92-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/2848-100-0x00000000025F0000-0x0000000002650000-memory.dmp

        Filesize

        384KB

      • memory/3464-2236-0x0000000000D00000-0x0000000000D2E000-memory.dmp

        Filesize

        184KB

      • memory/3464-2243-0x0000000005730000-0x000000000577C000-memory.dmp

        Filesize

        304KB

      • memory/3464-2241-0x00000000056F0000-0x000000000572C000-memory.dmp

        Filesize

        240KB

      • memory/3464-2240-0x0000000005690000-0x00000000056A2000-memory.dmp

        Filesize

        72KB

      • memory/3464-2239-0x0000000005780000-0x000000000588A000-memory.dmp

        Filesize

        1.0MB

      • memory/3464-2238-0x0000000005C90000-0x00000000062A8000-memory.dmp

        Filesize

        6.1MB

      • memory/3464-2237-0x00000000017E0000-0x00000000017E6000-memory.dmp

        Filesize

        24KB

      • memory/4464-53-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-57-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-59-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-61-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-63-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-65-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-44-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-67-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-69-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-71-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-42-0x0000000004B80000-0x0000000005124000-memory.dmp

        Filesize

        5.6MB

      • memory/4464-55-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-51-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-49-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-47-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-45-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4464-72-0x0000000000400000-0x00000000004AF000-memory.dmp

        Filesize

        700KB

      • memory/4464-74-0x0000000000400000-0x00000000004AF000-memory.dmp

        Filesize

        700KB

      • memory/4464-43-0x0000000004A40000-0x0000000004A58000-memory.dmp

        Filesize

        96KB

      • memory/4464-41-0x0000000002150000-0x000000000216A000-memory.dmp

        Filesize

        104KB

      • memory/5668-2260-0x0000000000480000-0x00000000004B0000-memory.dmp

        Filesize

        192KB

      • memory/5668-2261-0x0000000004C60000-0x0000000004C66000-memory.dmp

        Filesize

        24KB