Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe
Resource
win7-20240903-en
General
-
Target
6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe
-
Size
374KB
-
MD5
9abf0ea0643fa018e9c7cf3f94c3f421
-
SHA1
33798c4f784a63c1b34b1c78186814a649248e86
-
SHA256
6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b
-
SHA512
c2b0f6754c50629871516f697ab32fdad2ea3fec8de8d09702057aab0e8a2389983484106c9d850ba22be3cd4275de2cf115aeb67f602a34f4e713a5d91030fe
-
SSDEEP
6144:6BdLNonYcBtYajv4hZfmEhAfMjfiHP8JITTEWqO:6BdpwYc9jv8kEaIuPlTTrN
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 3 IoCs
pid Process 3504 oneetx.exe 1112 oneetx.exe 2372 oneetx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 3484 556 WerFault.exe 82 2796 556 WerFault.exe 82 1484 556 WerFault.exe 82 1636 556 WerFault.exe 82 1888 556 WerFault.exe 82 732 556 WerFault.exe 82 1344 556 WerFault.exe 82 5100 556 WerFault.exe 82 2388 556 WerFault.exe 82 1704 556 WerFault.exe 82 4012 556 WerFault.exe 82 860 556 WerFault.exe 82 3764 3504 WerFault.exe 108 1524 3504 WerFault.exe 108 3892 3504 WerFault.exe 108 2832 3504 WerFault.exe 108 3560 3504 WerFault.exe 108 1340 3504 WerFault.exe 108 2724 3504 WerFault.exe 108 4892 3504 WerFault.exe 108 4344 3504 WerFault.exe 108 1100 3504 WerFault.exe 108 4608 3504 WerFault.exe 108 2644 3504 WerFault.exe 108 2928 3504 WerFault.exe 108 412 3504 WerFault.exe 108 216 1112 WerFault.exe 164 1080 2372 WerFault.exe 167 860 3504 WerFault.exe 108 5040 3504 WerFault.exe 108 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 800 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 556 6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 556 wrote to memory of 3504 556 6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe 108 PID 556 wrote to memory of 3504 556 6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe 108 PID 556 wrote to memory of 3504 556 6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe 108 PID 3504 wrote to memory of 800 3504 oneetx.exe 126 PID 3504 wrote to memory of 800 3504 oneetx.exe 126 PID 3504 wrote to memory of 800 3504 oneetx.exe 126 PID 3504 wrote to memory of 1660 3504 oneetx.exe 132 PID 3504 wrote to memory of 1660 3504 oneetx.exe 132 PID 3504 wrote to memory of 1660 3504 oneetx.exe 132 PID 1660 wrote to memory of 3484 1660 cmd.exe 136 PID 1660 wrote to memory of 3484 1660 cmd.exe 136 PID 1660 wrote to memory of 3484 1660 cmd.exe 136 PID 1660 wrote to memory of 2524 1660 cmd.exe 137 PID 1660 wrote to memory of 2524 1660 cmd.exe 137 PID 1660 wrote to memory of 2524 1660 cmd.exe 137 PID 1660 wrote to memory of 1748 1660 cmd.exe 138 PID 1660 wrote to memory of 1748 1660 cmd.exe 138 PID 1660 wrote to memory of 1748 1660 cmd.exe 138 PID 1660 wrote to memory of 2220 1660 cmd.exe 139 PID 1660 wrote to memory of 2220 1660 cmd.exe 139 PID 1660 wrote to memory of 2220 1660 cmd.exe 139 PID 1660 wrote to memory of 2796 1660 cmd.exe 140 PID 1660 wrote to memory of 2796 1660 cmd.exe 140 PID 1660 wrote to memory of 2796 1660 cmd.exe 140 PID 1660 wrote to memory of 2616 1660 cmd.exe 141 PID 1660 wrote to memory of 2616 1660 cmd.exe 141 PID 1660 wrote to memory of 2616 1660 cmd.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe"C:\Users\Admin\AppData\Local\Temp\6641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 5482⤵
- Program crash
PID:3484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 6282⤵
- Program crash
PID:2796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 6762⤵
- Program crash
PID:1484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 8402⤵
- Program crash
PID:1636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 8042⤵
- Program crash
PID:1888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 8242⤵
- Program crash
PID:732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 11082⤵
- Program crash
PID:1344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 11522⤵
- Program crash
PID:5100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 12522⤵
- Program crash
PID:2388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 8682⤵
- Program crash
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 5883⤵
- Program crash
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8323⤵
- Program crash
PID:1524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9803⤵
- Program crash
PID:3892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9803⤵
- Program crash
PID:2832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8323⤵
- Program crash
PID:3560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9603⤵
- Program crash
PID:1340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9683⤵
- Program crash
PID:2724
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9043⤵
- Program crash
PID:4892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6723⤵
- Program crash
PID:4344
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:2524
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:1748
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:2220
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9003⤵
- Program crash
PID:1100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 11763⤵
- Program crash
PID:4608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 12043⤵
- Program crash
PID:2644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 12123⤵
- Program crash
PID:2928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8323⤵
- Program crash
PID:412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6883⤵
- Program crash
PID:860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 9603⤵
- Program crash
PID:5040
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 6482⤵
- Program crash
PID:4012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 6562⤵
- Program crash
PID:860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 556 -ip 5561⤵PID:832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 556 -ip 5561⤵PID:2952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 556 -ip 5561⤵PID:1736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 556 -ip 5561⤵PID:4092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 556 -ip 5561⤵PID:3276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 556 -ip 5561⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 556 -ip 5561⤵PID:4616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 556 -ip 5561⤵PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 556 -ip 5561⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 556 -ip 5561⤵PID:1528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 556 -ip 5561⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 556 -ip 5561⤵PID:2588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3504 -ip 35041⤵PID:2780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3504 -ip 35041⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3504 -ip 35041⤵PID:4496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3504 -ip 35041⤵PID:4620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3504 -ip 35041⤵PID:2044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3504 -ip 35041⤵PID:4812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3504 -ip 35041⤵PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3504 -ip 35041⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3504 -ip 35041⤵PID:3588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3504 -ip 35041⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3504 -ip 35041⤵PID:3276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3504 -ip 35041⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3504 -ip 35041⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3504 -ip 35041⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 3162⤵
- Program crash
PID:216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1112 -ip 11121⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 3162⤵
- Program crash
PID:1080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2372 -ip 23721⤵PID:2408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3504 -ip 35041⤵PID:2664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3504 -ip 35041⤵PID:3544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
374KB
MD59abf0ea0643fa018e9c7cf3f94c3f421
SHA133798c4f784a63c1b34b1c78186814a649248e86
SHA2566641f40539e78d756b92665342ae6adbeb818b3ce3eb5a7b8da2bd3eaf565d6b
SHA512c2b0f6754c50629871516f697ab32fdad2ea3fec8de8d09702057aab0e8a2389983484106c9d850ba22be3cd4275de2cf115aeb67f602a34f4e713a5d91030fe