Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 06:45

General

  • Target

    2914768256a1d0572768504785254a707da68a8cae03585a73f04a1b2d1488dc.exe

  • Size

    1.5MB

  • MD5

    b1e30c6e7107988a208cf1006f05502e

  • SHA1

    251e65dadfcbe8af3350cf6e0be66a81eacb01b7

  • SHA256

    2914768256a1d0572768504785254a707da68a8cae03585a73f04a1b2d1488dc

  • SHA512

    0d69540686de8a7dde2e59e6edf5f1157e9cc265da79cd78898d76ee4de613fb62296e81c0e8ecfcae0c51b695674877e1be0d1477cd24197afcd9a179643356

  • SSDEEP

    24576:LytwHPgLugt70LSJjRmV3f00LeGAr8XNo+xM7E9JnbnHyYwhRzSzbiaGhkvOxcKh:+gPiuouSREV3sy8uNo9SxEhRth5xx

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

amadey

Version

3.70

Botnet

47f88f

C2

http://193.201.9.43

Attributes
  • install_dir

    595f021478

  • install_file

    oneetx.exe

  • strings_key

    4971eddfd380996ae21bea987102e417

  • url_paths

    /plays/chapter/index.php

rc4.plain

Extracted

Family

redline

Botnet

maxi

C2

185.161.248.90:4125

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2914768256a1d0572768504785254a707da68a8cae03585a73f04a1b2d1488dc.exe
    "C:\Users\Admin\AppData\Local\Temp\2914768256a1d0572768504785254a707da68a8cae03585a73f04a1b2d1488dc.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki618803.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki618803.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki460807.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki460807.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki654702.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki654702.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1084
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ki191622.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ki191622.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1356
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\az818601.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\az818601.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2452
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bu901435.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bu901435.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3428
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 1084
                7⤵
                • Program crash
                PID:3260
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\co220815.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\co220815.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3708
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5352
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1388
              6⤵
              • Program crash
              PID:5476
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dkT15t90.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dkT15t90.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5596
          • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5860
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3368
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft150484.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft150484.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5960
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3428 -ip 3428
    1⤵
      PID:1896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3708 -ip 3708
      1⤵
        PID:5388
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6080
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:3012

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki618803.exe

        Filesize

        1.2MB

        MD5

        843e8f69ad96fa83bb0526f448073c6c

        SHA1

        97fe16795b3a084c2212ce61c6e65278d9293383

        SHA256

        ad5a9cd0491c713d10fa0c9a884fec98964c851b31d095ddd63252f769afa8e9

        SHA512

        27741ad9ba9fbb4a80b5db532f7c67b4b4caec479188e46d82f07481539d5654d0683c7dc76b0b973d5a3af7a655c47823162406aebdfb9edebf25abafb03b20

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft150484.exe

        Filesize

        168KB

        MD5

        f3f0110dd728ebd7a2e20609f3b7ff33

        SHA1

        9e846ddfc4e53793c77a8b74395ed1c1c73da027

        SHA256

        f7dbb53256eb8a1896925f31a12ef486afea188abd1ff3b67ae7325e5e756751

        SHA512

        81da25c6e399a6f312473b567541a72cb9a7907dec4a572af2e3b44fe8ff37465a06652b8cf903e152518f518b16a5055c598f34dd96306aa1b620d0b0a0bc4f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki460807.exe

        Filesize

        1.0MB

        MD5

        8f7ddd5925c136ffb1505ace615a2b1f

        SHA1

        384e3b0852ba0e39d79f8f7627a26c44f993c086

        SHA256

        333e6e2a9f6954e627e3486a53df168924cd809865fa8374d759faf98235da6c

        SHA512

        8946b9629d347afd7cb8b39cedcd0e7552eccc5754125345e0182bfa764fd2928286b22dafca750757dac9608bb09060a242571a0ecf3a9d6ebe1b7dc22434bb

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dkT15t90.exe

        Filesize

        229KB

        MD5

        ee1f5f0e1168ce5938997c932b4dcd27

        SHA1

        b8c0928da3a41d579c19f44b9e1fef6014d06452

        SHA256

        dea01b17d6e06c3bdf6f5387faa77a788ce9726a3110db90294b2e207b3d51ed

        SHA512

        bacc2d22b71bc5bc73c0699aaf4e2271effa4fe47c3ac63f3ee3ae3385d963eb6f93db082a9530d75d5c6f13884f30b0375d41badfe540f31ef747003a36c0a8

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki654702.exe

        Filesize

        884KB

        MD5

        7099c430deb15fbfd8c643a2aa5980b6

        SHA1

        d94b6595b2ed5fae2a1378844dbc90b92621330b

        SHA256

        7cc8742c21743a956583d70cb58d476a0cbc454552799cb1516a92ed04eed283

        SHA512

        892ff238c09b8f81d94f6e019d8c6aa036262e4ba7a1729fe8d033c0ac47eab26c7a6cd66487092a0787616f9fe674fcb8d75511cbcfd7c88e66abcc4c3c1323

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\co220815.exe

        Filesize

        588KB

        MD5

        30bad4374d4cb3fae7b8f168d6b1b670

        SHA1

        79b8d1a3783a8d8a1c52a2c4f4ab4ccc8ee1ebad

        SHA256

        0af4cfbe97735bd3685056e371428e58f0b2136b88adb22dcaab56864ad1b788

        SHA512

        2f012d5548da1d07f1bf2c5fff8326d486ed60107c0ae2b236698d2253b2436b5f6ffc6662db6d8d78d8bd0ea3ee64f893437d33f9174038a5398f4d811f8fc8

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ki191622.exe

        Filesize

        375KB

        MD5

        d62ec34a9799b26b68f2efb067d766c4

        SHA1

        5d96151bf550d9c1e3d1699cb054e8798394ad9c

        SHA256

        3eaf1df59ec664978a527095a3e5cb26e82943790e4ea86ba4993b0d02e9465c

        SHA512

        8127097dc67baba9eb3e58b1b8e39d6c6ec00a35d5fabbd1e7bff67e791fe50eb36af5bdee35b34fb060f05c92771a38377c480d7508d511275f84658bf57516

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\az818601.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bu901435.exe

        Filesize

        403KB

        MD5

        786beda6a173f9c2fcf4109abe9b9c05

        SHA1

        c47165673c634d487f133a9c49e303758f652258

        SHA256

        36c9fee28178260c1c8638ceb96c653662154b32be4868ab2d936b508e650c60

        SHA512

        c878fe45097c74591cc3752920139cfd3bd6a5d5ed519b54e59274fe45d716c1175fcbb04b0595725dee794ec8de9acb3f15b5f77c1895dc470d4a4b111871a8

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        03728fed675bcde5256342183b1d6f27

        SHA1

        d13eace7d3d92f93756504b274777cc269b222a2

        SHA256

        f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

        SHA512

        6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

      • memory/2452-35-0x0000000000790000-0x000000000079A000-memory.dmp

        Filesize

        40KB

      • memory/3428-74-0x0000000000400000-0x000000000080A000-memory.dmp

        Filesize

        4.0MB

      • memory/3428-42-0x0000000004EF0000-0x0000000005494000-memory.dmp

        Filesize

        5.6MB

      • memory/3428-43-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

        Filesize

        96KB

      • memory/3428-71-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-69-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-67-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-65-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-63-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-61-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-59-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-57-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-55-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-53-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-51-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-44-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/3428-72-0x0000000000400000-0x000000000080A000-memory.dmp

        Filesize

        4.0MB

      • memory/3428-41-0x00000000026D0000-0x00000000026EA000-memory.dmp

        Filesize

        104KB

      • memory/3708-110-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-90-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-81-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-114-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-112-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-79-0x0000000002840000-0x00000000028A8000-memory.dmp

        Filesize

        416KB

      • memory/3708-109-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-106-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-104-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-102-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-100-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-99-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-96-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-94-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-92-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-80-0x0000000005530000-0x0000000005596000-memory.dmp

        Filesize

        408KB

      • memory/3708-88-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-86-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-84-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-82-0x0000000005530000-0x0000000005590000-memory.dmp

        Filesize

        384KB

      • memory/3708-2223-0x0000000005760000-0x0000000005792000-memory.dmp

        Filesize

        200KB

      • memory/5352-2236-0x00000000001B0000-0x00000000001DE000-memory.dmp

        Filesize

        184KB

      • memory/5352-2237-0x0000000000880000-0x0000000000886000-memory.dmp

        Filesize

        24KB

      • memory/5352-2238-0x0000000005110000-0x0000000005728000-memory.dmp

        Filesize

        6.1MB

      • memory/5352-2239-0x0000000004C00000-0x0000000004D0A000-memory.dmp

        Filesize

        1.0MB

      • memory/5352-2240-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/5352-2245-0x0000000004B90000-0x0000000004BCC000-memory.dmp

        Filesize

        240KB

      • memory/5352-2246-0x0000000004D10000-0x0000000004D5C000-memory.dmp

        Filesize

        304KB

      • memory/5960-2261-0x0000000002800000-0x0000000002806000-memory.dmp

        Filesize

        24KB

      • memory/5960-2260-0x00000000005F0000-0x0000000000620000-memory.dmp

        Filesize

        192KB