Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe
Resource
win10v2004-20241007-en
General
-
Target
d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe
-
Size
1.2MB
-
MD5
f40309e82c8e8eb2f6403deea4dfa574
-
SHA1
5826579cf2b408d60759efdd557b3e9683668a20
-
SHA256
d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988
-
SHA512
a3bb17d513dd6e2ba36b04daf6a4ca650e5f3853e21f7cf53a4dfe5950e8db8ede4687f392a59e6bee92b0ceede9836c4f35db29b0ddbd54bd38207dea301f44
-
SSDEEP
24576:Ckck/cnT4nu32bskTZqxC89KgC9ZpJdHG1pMQXEtjLHjulF5bavh9:Cs/cn8uNkTZsKgCHp34pMxLDI
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral2/files/0x0008000000023c9e-31.dat healer behavioral2/memory/2400-32-0x00000000000C0000-0x00000000000CA000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az503960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az503960.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az503960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az503960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az503960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az503960.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
resource yara_rule behavioral2/memory/4388-55-0x0000000004A10000-0x0000000004A4C000-memory.dmp family_redline behavioral2/memory/4388-57-0x0000000007780000-0x00000000077BA000-memory.dmp family_redline behavioral2/memory/4388-59-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-67-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-120-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-115-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-113-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-111-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-109-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-107-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-106-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-103-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-101-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-99-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-97-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-95-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-93-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-91-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-89-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-87-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-85-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-83-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-81-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-79-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-77-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-75-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-71-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-70-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-65-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-63-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-61-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-117-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-73-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline behavioral2/memory/4388-58-0x0000000007780000-0x00000000077B5000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation bu062300.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 10 IoCs
pid Process 744 ki436607.exe 2896 ki586823.exe 856 ki970331.exe 2400 az503960.exe 2316 bu062300.exe 4908 oneetx.exe 4388 cf554524.exe 2376 oneetx.exe 4964 oneetx.exe 5348 oneetx.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az503960.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" ki970331.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ki436607.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ki586823.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf554524.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki970331.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bu062300.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki436607.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki586823.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1980 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2400 az503960.exe 2400 az503960.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2400 az503960.exe Token: SeDebugPrivilege 4388 cf554524.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 bu062300.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3952 wrote to memory of 744 3952 d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe 86 PID 3952 wrote to memory of 744 3952 d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe 86 PID 3952 wrote to memory of 744 3952 d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe 86 PID 744 wrote to memory of 2896 744 ki436607.exe 87 PID 744 wrote to memory of 2896 744 ki436607.exe 87 PID 744 wrote to memory of 2896 744 ki436607.exe 87 PID 2896 wrote to memory of 856 2896 ki586823.exe 88 PID 2896 wrote to memory of 856 2896 ki586823.exe 88 PID 2896 wrote to memory of 856 2896 ki586823.exe 88 PID 856 wrote to memory of 2400 856 ki970331.exe 89 PID 856 wrote to memory of 2400 856 ki970331.exe 89 PID 856 wrote to memory of 2316 856 ki970331.exe 94 PID 856 wrote to memory of 2316 856 ki970331.exe 94 PID 856 wrote to memory of 2316 856 ki970331.exe 94 PID 2316 wrote to memory of 4908 2316 bu062300.exe 95 PID 2316 wrote to memory of 4908 2316 bu062300.exe 95 PID 2316 wrote to memory of 4908 2316 bu062300.exe 95 PID 2896 wrote to memory of 4388 2896 ki586823.exe 96 PID 2896 wrote to memory of 4388 2896 ki586823.exe 96 PID 2896 wrote to memory of 4388 2896 ki586823.exe 96 PID 4908 wrote to memory of 1980 4908 oneetx.exe 97 PID 4908 wrote to memory of 1980 4908 oneetx.exe 97 PID 4908 wrote to memory of 1980 4908 oneetx.exe 97 PID 4908 wrote to memory of 4168 4908 oneetx.exe 99 PID 4908 wrote to memory of 4168 4908 oneetx.exe 99 PID 4908 wrote to memory of 4168 4908 oneetx.exe 99 PID 4168 wrote to memory of 1356 4168 cmd.exe 101 PID 4168 wrote to memory of 1356 4168 cmd.exe 101 PID 4168 wrote to memory of 1356 4168 cmd.exe 101 PID 4168 wrote to memory of 3444 4168 cmd.exe 102 PID 4168 wrote to memory of 3444 4168 cmd.exe 102 PID 4168 wrote to memory of 3444 4168 cmd.exe 102 PID 4168 wrote to memory of 3808 4168 cmd.exe 103 PID 4168 wrote to memory of 3808 4168 cmd.exe 103 PID 4168 wrote to memory of 3808 4168 cmd.exe 103 PID 4168 wrote to memory of 4592 4168 cmd.exe 104 PID 4168 wrote to memory of 4592 4168 cmd.exe 104 PID 4168 wrote to memory of 4592 4168 cmd.exe 104 PID 4168 wrote to memory of 2032 4168 cmd.exe 105 PID 4168 wrote to memory of 2032 4168 cmd.exe 105 PID 4168 wrote to memory of 2032 4168 cmd.exe 105 PID 4168 wrote to memory of 2852 4168 cmd.exe 106 PID 4168 wrote to memory of 2852 4168 cmd.exe 106 PID 4168 wrote to memory of 2852 4168 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe"C:\Users\Admin\AppData\Local\Temp\d7f0994343a10af33d3ffa6f0d3f1309b20956662ccac59533f6c475a2a17988.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki436607.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki436607.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki586823.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki586823.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki970331.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki970331.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az503960.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az503960.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu062300.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu062300.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
- System Location Discovery: System Language Discovery
PID:1356
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"8⤵
- System Location Discovery: System Language Discovery
PID:3444
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E8⤵
- System Location Discovery: System Language Discovery
PID:3808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
- System Location Discovery: System Language Discovery
PID:4592
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"8⤵
- System Location Discovery: System Language Discovery
PID:2032
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E8⤵
- System Location Discovery: System Language Discovery
PID:2852
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf554524.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf554524.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2376
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4964
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:5348
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
862KB
MD5cec1ce5318555d73f57204ffa15da4f4
SHA18e7ecd5aa0e6b005fbea795900618e94b2880674
SHA2565d5ffc47ae1d8ded67771c9d546a13793a0622cb98f5238d4069866f84a6f7bc
SHA5122eb122871e256625688e9470d19518cb195ec233b018d0890a7d065403a3c5630ea9a049de48adfcb5d88cfb3f25b6674e1fc90191c48aea31194c616894ad26
-
Filesize
584KB
MD54ae31f6e2fe3b5635820cc5936ce08c2
SHA178399a6911db1a73d83bb61df042a7b3b087e705
SHA2567e8a5f1286d45a482013057e9aa18e9cfc1adc9237a32882683995241712d04b
SHA512a5e376db14e26924139ce3dadcb1e3f8390f6e475948aca693f8d9936392134c4ebd8724950e0c46f9cb197fc2c0e4e8d0f286db892c990e099e0dd4f6f60091
-
Filesize
369KB
MD5f8b49ca0965b0a1a4989039c682f5ad3
SHA166322c1d801a7c90c46a289521401e5c6fd758a5
SHA2566b6a03c0cea0d5c524201918e24ed767f2345dbb82f83da75653a31dc4a99d73
SHA51233abef8277003f8f27eb364c60d2cd8c78f3acf6402a3036cbfea055f354bc7cc4a8355bdd9ed8e330e983caf7be01d0e27f9cfe67201896e62f313617f57062
-
Filesize
223KB
MD5336f38a46355bec86647c050e5457b7f
SHA18b5c06095b8f340abe622b75df17715cdec1515f
SHA256c2acc3656220a7b5c1c4c5009680d326f439daff81f5269d9a45c54a20867f7f
SHA512b6772ca9bcc9bed3fe52d167a28d1ab803be9b3daeefdf325909c6edb9cc85837fb1ea2d95b8b123945e642f342a04b9b13ba264ae75e3f6f0bf7021444d8cc7
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
204KB
MD51304f384653e08ae497008ff13498608
SHA1d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA2562a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA5124138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1