Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:13

General

  • Target

    891e6a8caed0a81b1bfdb8b945c43b34d03e165190e246d49855f4e02ba86309.exe

  • Size

    1.1MB

  • MD5

    33fd70d0ec34ad283616cf28ba7e5942

  • SHA1

    71f86d13d6e975784fc47250a881ec42925ffd4c

  • SHA256

    891e6a8caed0a81b1bfdb8b945c43b34d03e165190e246d49855f4e02ba86309

  • SHA512

    7c6970a89169229f6f0b876c7e19d020987ce110054b7ef3e27eb9f356f39da3d0f4a0fd2231ea6bc286b175161a1e5c5d5bd634b34a3a61f4937da3692100c0

  • SSDEEP

    24576:OyW7L3N6WEnTekjZXUAcPS5yqCb6b2qsjX8mekdYxVXMUq:dW70tnKkj1UtP8yqCb6b2zjXNO

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\891e6a8caed0a81b1bfdb8b945c43b34d03e165190e246d49855f4e02ba86309.exe
    "C:\Users\Admin\AppData\Local\Temp\891e6a8caed0a81b1bfdb8b945c43b34d03e165190e246d49855f4e02ba86309.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra951495.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra951495.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4536
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GJ979473.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GJ979473.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll918004.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll918004.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\129186351.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\129186351.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4572
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\253184295.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\253184295.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4288
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 1084
              6⤵
              • Program crash
              PID:2776
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\306788896.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\306788896.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4252
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4928
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1724
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2080
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3480
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1568
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5076
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4724
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:32
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2844
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\428716443.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\428716443.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4288 -ip 4288
    1⤵
      PID:2028
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:5592
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4364

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra951495.exe

            Filesize

            931KB

            MD5

            125602bdae134852612d576f1bd13ffd

            SHA1

            f128cbac54ab1eb4b37f852337910a19aca5e3a2

            SHA256

            2c4f2ec46aabd6b05d488d933033ce6d72259a76d96725f9027ffa74f44adc6c

            SHA512

            adbee57043da95cedfb1e3e703796c23dbcb5266ee037759eb54cb55780d1e0aa88b4f79c72c2bc2b6e8f5385206ab58fbe3e3885ead9171e410c26b6c42369b

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\428716443.exe

            Filesize

            348KB

            MD5

            a885887fcf9c043c58ea55c0dcd1376b

            SHA1

            61f340fea7eb6423b75c3b040c0917667d504124

            SHA256

            658fc79a117646d4f8b9656836fd46e70619c4005b4542d958c4a21fa1d5fbf1

            SHA512

            75b80864af76ed4ff20392a4c4b32379c1fd4e545d8537dca933943941b289e5ef060b4bd396e51dbab599cbfd8f929cea8781956800c9be1eef3f798fd15da8

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GJ979473.exe

            Filesize

            577KB

            MD5

            6a9a467ac5141a30f216429e81912b25

            SHA1

            08a4f19393d0eb9ad42a743692430b83b7319771

            SHA256

            de050de282624481009d1fafcf55a9e88c6083793180a2e7773ef080918d406a

            SHA512

            d894b6721cc69b8012d1f0b587bb6c333ef948123eb75ce971a3ebbd80c7e26bcb6c437a491655b976729fcae516e61c414d7a21027c2806d945f950274ced5d

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\306788896.exe

            Filesize

            204KB

            MD5

            1304f384653e08ae497008ff13498608

            SHA1

            d9a76ed63d74d4217c5027757cb9a7a0d0093080

            SHA256

            2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

            SHA512

            4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ll918004.exe

            Filesize

            406KB

            MD5

            edfe5f64f35d7af4f3451213dde05cd3

            SHA1

            2928c4e2cacc3a6e709bb4edc8d09798bca04a81

            SHA256

            b3e393ee2154b88c451f0fbb63107ebbe7737c51496629a222329a49e4eba1ec

            SHA512

            6d006aed28f43e3d811c66b73aa8372421054a595049c0062639326f307c9d337326ad6b9b8e4b4a123ebfa6989cba611e67c1afa8c9b5db57a4f0dbaafb224e

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\129186351.exe

            Filesize

            175KB

            MD5

            3d10b67208452d7a91d7bd7066067676

            SHA1

            e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

            SHA256

            5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

            SHA512

            b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\253184295.exe

            Filesize

            264KB

            MD5

            5196b35c6d69f5fe822aa40436430ff0

            SHA1

            1cc254a6d58c06e25fc03308eac95d5dfb16257f

            SHA256

            356486aebdcc77b86abc51e922231d4f622b9a3dad76254c783392358e3d7dba

            SHA512

            47d4281863a44f29840d5c1e1871d3ea55e8bccdcacf83eb19ec0c94f042d2b1dbf96674ca2d24ef33d8b806fd488398b6181185b88784d6a62cc9138c6c4e6a

          • memory/3036-906-0x0000000009C90000-0x000000000A2A8000-memory.dmp

            Filesize

            6.1MB

          • memory/3036-907-0x000000000A340000-0x000000000A352000-memory.dmp

            Filesize

            72KB

          • memory/3036-908-0x000000000A360000-0x000000000A46A000-memory.dmp

            Filesize

            1.0MB

          • memory/3036-114-0x0000000004C60000-0x0000000004C95000-memory.dmp

            Filesize

            212KB

          • memory/3036-115-0x0000000004C60000-0x0000000004C95000-memory.dmp

            Filesize

            212KB

          • memory/3036-117-0x0000000004C60000-0x0000000004C95000-memory.dmp

            Filesize

            212KB

          • memory/3036-119-0x0000000004C60000-0x0000000004C95000-memory.dmp

            Filesize

            212KB

          • memory/3036-113-0x0000000004C60000-0x0000000004C9A000-memory.dmp

            Filesize

            232KB

          • memory/3036-112-0x0000000004A80000-0x0000000004ABC000-memory.dmp

            Filesize

            240KB

          • memory/3036-909-0x000000000A480000-0x000000000A4BC000-memory.dmp

            Filesize

            240KB

          • memory/3036-910-0x0000000004940000-0x000000000498C000-memory.dmp

            Filesize

            304KB

          • memory/4288-93-0x0000000000400000-0x0000000002B9D000-memory.dmp

            Filesize

            39.6MB

          • memory/4572-54-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-52-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-50-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-58-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/4572-30-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

            Filesize

            96KB

          • memory/4572-29-0x0000000004C70000-0x0000000005214000-memory.dmp

            Filesize

            5.6MB

          • memory/4572-28-0x00000000021E0000-0x00000000021FA000-memory.dmp

            Filesize

            104KB