Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:06

General

  • Target

    fa0538138ae47aed4ddb4ed587f873ae6a0325655707fea80a9a2a1247ea7b8a.exe

  • Size

    1.7MB

  • MD5

    3db5b69a0766fa7f9f3d3b6cedd5480c

  • SHA1

    114820c0eb921476bacb3b250d746288c76017d8

  • SHA256

    fa0538138ae47aed4ddb4ed587f873ae6a0325655707fea80a9a2a1247ea7b8a

  • SHA512

    6b7192837d48976e496efc57f524654673337a9151628268dd10f077b8ff94078e670a049458bfa371793c1708b3e9c9c81e63fae46d89455a2031c404c00bbe

  • SSDEEP

    49152:0qQRh+HvztgJ5Um1VdVVe9DMV8wrmGVQKC:BzHvBM5UmX/Vi4V8wrjV7C

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa0538138ae47aed4ddb4ed587f873ae6a0325655707fea80a9a2a1247ea7b8a.exe
    "C:\Users\Admin\AppData\Local\Temp\fa0538138ae47aed4ddb4ed587f873ae6a0325655707fea80a9a2a1247ea7b8a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NR754039.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NR754039.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zf530855.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zf530855.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rJ203202.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rJ203202.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4300
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zL888612.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zL888612.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4312
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a76937131.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a76937131.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1488
              • C:\Windows\Temp\1.exe
                "C:\Windows\Temp\1.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Executes dropped EXE
                • Windows security modification
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5472
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b21279656.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b21279656.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5680
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 1260
                7⤵
                • Program crash
                PID:1828
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c77542637.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c77542637.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5308
            • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
              "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3148
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:4636
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4560
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3104
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:6716
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:7048
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4160
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4920
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1332
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d35590366.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d35590366.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:368
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 1260
            5⤵
            • Program crash
            PID:3196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f04152706.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f04152706.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5680 -ip 5680
    1⤵
      PID:3136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 368 -ip 368
      1⤵
        PID:6488
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6336
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6252
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:3660

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NR754039.exe

              Filesize

              1.4MB

              MD5

              70af0bfc05f34c08c00d34a8eb3e8059

              SHA1

              4b0cb0fc6bbfa447d5b9397f0624fa7908db3ba7

              SHA256

              57fe448776da62e24e92a98c1c985fbe57ffc3f19a4ca2eaa1c9a8f6c9193208

              SHA512

              31fdde530ac7fb8f5731d6ab4071f79817ba149f004d112c05b943136e577629af8f36828f7dfffee19bf5ba4ae6131b992f773c1121378979ba4f3156756e90

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zf530855.exe

              Filesize

              1.3MB

              MD5

              6ee39cb70b1f12ef8227d3acbfb099a8

              SHA1

              52f6baface32c78aec211e46083b430a0ad9ac0b

              SHA256

              95a5eba98fbd2eace63aec464e0e19f470d16687f256556330273f880cc627ca

              SHA512

              c7bf246ecdda77c908f41d9371529ad560a5b17727d4e83bd83b3e4ded694511b5ade86f127e089fa558e0a4e25b19620774c1a45d0727a1242903bc454afd8a

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f04152706.exe

              Filesize

              168KB

              MD5

              599c12324eb7d2819d168157faa0f0ee

              SHA1

              bea19e1f4c44d4197647fa68e153f31de52c1e61

              SHA256

              56d344599f497cb825342dadac93679cb841de0924ae7a80610b6e34000ea064

              SHA512

              0b4a323b123a1d4ebd970c82fc2e420041cca6b2c3c0fa3b057dfbf710de6a24c18e5593273ee356f00995b78c1e662671a0dad303451af7a5402b8c423196de

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d35590366.exe

              Filesize

              582KB

              MD5

              82a310e2356012b3b220048e26c2382d

              SHA1

              b2de18704376c38c203d6e75e0cb082d73a7bde3

              SHA256

              5d89b624d470d836e6e3d4923aad1ac4477200e4c09d233cd0de27f40b5141b8

              SHA512

              e98d6eb22da60f8778e5e444657942194300c0600a0e283641d001d4ca0420ed9ca92600067aca6c27428aed6fe68697537d5e5fa7e03d23aeb29a9c72917f72

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rJ203202.exe

              Filesize

              851KB

              MD5

              fc76f0680b8c7803e84e39a7de29ba4f

              SHA1

              133b955667414fdb24c6f13b205171a9567644c4

              SHA256

              ff0a6c18a67609fa9b1041c0b71954edf411104675fd0844f978a5330dc699db

              SHA512

              bc410ec095c72169ee796d02e328639643ca2fd28a5deb39a19faccc725d12a880727d1a365bacb36038f14fcd3548b6bd944da853a6df908bbbe6bd3190fb9d

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c77542637.exe

              Filesize

              205KB

              MD5

              57a60b29f42e6550b5cf9be5587fb905

              SHA1

              a5ce59f84fb919bcefe3a5fbb7fad897014293c1

              SHA256

              2024693c603e10f36ae62f244a8df2590ce743cb0a3684e7a6f640971b387ee8

              SHA512

              1090671e51bd0282e8bb632e9aaef57d28885fd989da9472613c416473f2bd891ca73bcb3c97b555916efeb0f9f324ce70192e0c57803f4f771df01e04baf862

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zL888612.exe

              Filesize

              679KB

              MD5

              2f0c327a8e014fad520e6194ae0ad49e

              SHA1

              b497666b7ae6fbf7492ca2c7a13551fc1df6b6c4

              SHA256

              9152a3f943f27d834489359f45f912b81cf74eb5f0b54288a38d117dcd5cc72c

              SHA512

              f79a1981a63342c1b216b5d908405fe26b7f6ede0241ba9b870d9094724a1c3d039b48aee8bd977d76b114e7c267a702e699cd59ad79cc8eedfc83909f5bf70b

            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a76937131.exe

              Filesize

              301KB

              MD5

              1fbcc3d4f60d42aa4d28f74411f65f3c

              SHA1

              861530fd635b145ee6aab83396cef9d469d34172

              SHA256

              d6cae518c6952355b018626f377c7ef50e72fa9cc1dc4bcdc7108e284ea3ebea

              SHA512

              21493decf0fca589846c0bac8cdb1ea8c2350c6c20d697e673635a26aeaf698a13ce2919fa68a97e25325e8f32c917e3b6ba1203287fda1383755c2c201fd60b

            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b21279656.exe

              Filesize

              521KB

              MD5

              e04819c27255e1fa888fa4558ee359cc

              SHA1

              60f174670db0f7d117bdabcf2945ecad29706a9f

              SHA256

              0188eb711e772165c233a1d02a003e8aa2b8b90e3c325e94f7f826fa5e0a27cc

              SHA512

              9d7d921e6710241c4adb4e4509ac7f22507e0216c91d58dadc74af2df74ae6f917cf5530ec23ffaf3e032066adc1a2f7773edeac57d553bcd38942d3d2eb5482

            • C:\Windows\Temp\1.exe

              Filesize

              11KB

              MD5

              7e93bacbbc33e6652e147e7fe07572a0

              SHA1

              421a7167da01c8da4dc4d5234ca3dd84e319e762

              SHA256

              850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

              SHA512

              250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

            • memory/368-4333-0x0000000005540000-0x00000000055A6000-memory.dmp

              Filesize

              408KB

            • memory/368-4332-0x0000000004EE0000-0x0000000004F48000-memory.dmp

              Filesize

              416KB

            • memory/368-6480-0x0000000005760000-0x0000000005792000-memory.dmp

              Filesize

              200KB

            • memory/1488-97-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-47-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-96-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-93-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-91-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-89-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-87-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-85-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-83-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-79-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-77-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-75-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-73-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-71-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-69-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-67-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-65-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-61-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-59-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-57-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-55-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-51-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-49-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-99-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-45-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-43-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-39-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-38-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp

              Filesize

              40KB

            • memory/1488-102-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-41-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-35-0x00000000025E0000-0x0000000002638000-memory.dmp

              Filesize

              352KB

            • memory/1488-36-0x00000000049E0000-0x0000000004F84000-memory.dmp

              Filesize

              5.6MB

            • memory/1488-53-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-63-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-81-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1488-37-0x0000000004FD0000-0x0000000005026000-memory.dmp

              Filesize

              344KB

            • memory/3416-6486-0x0000000000EA0000-0x0000000000ED0000-memory.dmp

              Filesize

              192KB

            • memory/3416-6487-0x0000000003160000-0x0000000003166000-memory.dmp

              Filesize

              24KB

            • memory/3416-6488-0x0000000006070000-0x0000000006688000-memory.dmp

              Filesize

              6.1MB

            • memory/3416-6489-0x0000000005B60000-0x0000000005C6A000-memory.dmp

              Filesize

              1.0MB

            • memory/3416-6490-0x0000000005860000-0x0000000005872000-memory.dmp

              Filesize

              72KB

            • memory/3416-6491-0x00000000058C0000-0x00000000058FC000-memory.dmp

              Filesize

              240KB

            • memory/3416-6493-0x0000000005A50000-0x0000000005A9C000-memory.dmp

              Filesize

              304KB

            • memory/5472-2182-0x0000000000C20000-0x0000000000C2A000-memory.dmp

              Filesize

              40KB

            • memory/5680-4312-0x0000000005750000-0x00000000057E2000-memory.dmp

              Filesize

              584KB