Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:05

General

  • Target

    a1999e3851be68e2b50fedf2d6a38036672077c255389fad0177dba35b974bf1N.exe

  • Size

    1.5MB

  • MD5

    5f892ae7d934091bc45d65f7c7edde40

  • SHA1

    da696f4bb4631590e3053060063d7126aaaa8e6a

  • SHA256

    a1999e3851be68e2b50fedf2d6a38036672077c255389fad0177dba35b974bf1

  • SHA512

    bd6a9bebcae8830d40fb30769923ea6f61c669c4d40ebe654157d96d3018744058a497958e3b033a68d9e219382d335626c72a6e833f66cfd8555bc633f3497b

  • SSDEEP

    24576:ey7DPIxcO4hw/FqmNktSUHP2MuzjWJKSNHmos4r/SGpgeZ2UsSks3kHr/b9O6H:t/PpR+YmmtXHP2Muzjoh7sgpgeZ2YL34

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1999e3851be68e2b50fedf2d6a38036672077c255389fad0177dba35b974bf1N.exe
    "C:\Users\Admin\AppData\Local\Temp\a1999e3851be68e2b50fedf2d6a38036672077c255389fad0177dba35b974bf1N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gK196070.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gK196070.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:616
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UX382394.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UX382394.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL429057.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL429057.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5000
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\170921003.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\170921003.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2536
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2940
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\289963478.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\289963478.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5368
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 1192
              6⤵
              • Program crash
              PID:4892
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\385902639.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\385902639.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:456
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4024
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5840
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5648
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4580
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2148
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1916
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:6100
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4832
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\401510737.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\401510737.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 1252
          4⤵
          • Program crash
          PID:1428
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\538910162.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\538910162.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4948
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5368 -ip 5368
    1⤵
      PID:5924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4672 -ip 4672
      1⤵
        PID:2656
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:4512
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:812
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:840

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\538910162.exe

              Filesize

              168KB

              MD5

              d3f4051e09eeb7a5bb48ed5fde857525

              SHA1

              523a791d44eaa4c99892d03d880c168f9169444d

              SHA256

              b2646e0f58128860ef4708a9ca60f9287dbbd09bf533989821683d41af551154

              SHA512

              59507a76e6d0d67f7d7b00f8f302a5617f2cebbb553da424ed620e3df23f2fe79c113b5c694397cb91e25d399ed30ffa111a11972e45ebdfb8cce472829064fd

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gK196070.exe

              Filesize

              1.3MB

              MD5

              f9150ca922a24f1e8d9dec8e7ddb1eae

              SHA1

              eab20bbb404330bb93c66caebade4d3571e58e9d

              SHA256

              3a3d41e069e15640dc5686c2ef8b102e9bffa89228c08ba146028bcf5a2488c5

              SHA512

              31977a20c56f945a7c3f91d382e493f0b6900ff2d94382aecc2f2d77b7f107903fb59b314e26bd7e8cc59ada8d9294109a3e4953c390bcf950a106ab342a6f31

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\401510737.exe

              Filesize

              539KB

              MD5

              738ba0a46a0c9f3da4e3fe515d685d27

              SHA1

              14584ff9bbda7a7d8c0497d233e6ef1c2af9926f

              SHA256

              37cae7e2ec174adbbc9dab549b6ce15adce5e02bbd58c337080de528a64845fc

              SHA512

              65b3931aab84689a8f338137a3222256848ab1983ad66b73003f206e30d6e38cbb42e5e15fecca9a842c824361f12960b70b2eee57832948391c6bebcea953bc

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UX382394.exe

              Filesize

              871KB

              MD5

              856e4aa1e599bf692d33d28145a7d0f0

              SHA1

              7db9e9813ce7d30717016b4c712a7a4046f5aa3c

              SHA256

              1c20de9c2615abd94133118aa1e648f4acc7d061bd4f8f05a3e770dcfc4c47a7

              SHA512

              5e20a5b396e21068663b41ca09b5237cde28f88063c68e9d1853191ffefe04f677938694f9cd3d783f8863c186ecd002ce4bc3eacd2d30dbd01d222e9ffb6248

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\385902639.exe

              Filesize

              204KB

              MD5

              c7a78150eead6b78fba5ea072bd098bd

              SHA1

              9536e6a402e15d9ec434787e2d82f84e421da957

              SHA256

              a6a430a6fecf3389a401255a0db40cf9cb4d78ce2743cc588523cbb4b4e38537

              SHA512

              9cf6b82b04363d6e8502f786582402e832aba6cab0b3ab752ccb6306ce0c0b9e388341dbf80189711ebaae41a0c8d222de3979c826c2da1c10d371064fbbf169

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL429057.exe

              Filesize

              700KB

              MD5

              5f65b3f14656fbf85a7288c2faf335bc

              SHA1

              92affa291b28e91495a163282208b32c386da599

              SHA256

              71f3e059d5c179c40dcf3e882f7b6b3bc00e5163d6935e557c5398996c429bfb

              SHA512

              04b16f573499ca778d2dfa9d9cbe3a6df6ec44a1f9347bdcb7a9c271b99000cbb26507f94a6f72e3a74f77b652fd45cc2787efe46aee58757ecd0906dfbca9ee

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\170921003.exe

              Filesize

              300KB

              MD5

              9417ca58f026e4e5208bd6158a54356c

              SHA1

              8b1b8280cb2ce0a945b32d276f78de7bc7545f9c

              SHA256

              b4ccbe483f3af0eb59d35be964f5b081f17a0c0ad1328c4eec6f727db09c7afd

              SHA512

              6b8e44a37f30a9f8fc6ee13a2673c31f6b725fa8558fb06589c792d533cd061a44d1b17b79657971b49fb862b01a6555aa064c458180500e2e2ff0afc0260355

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\289963478.exe

              Filesize

              479KB

              MD5

              0dbf1883d5095523f54cbb0359aaf3a0

              SHA1

              2c7294fd7ef826af681c9449225330dd3892c569

              SHA256

              7015ea5061b799b505fb1a59cc9814414184703c036f56f4bbfc7a005933014e

              SHA512

              5484e677dac51cb5a17626148d4fe4d07ee2fcf5e803b9dcb7747fd8f8a1a2d5854ee2b082c767b08c241bb299134631ec647244b824ffa42224524d80940b8e

            • C:\Windows\Temp\1.exe

              Filesize

              11KB

              MD5

              7e93bacbbc33e6652e147e7fe07572a0

              SHA1

              421a7167da01c8da4dc4d5234ca3dd84e319e762

              SHA256

              850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

              SHA512

              250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

            • memory/2536-90-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-46-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-40-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-31-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-94-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-64-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-88-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-86-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-84-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-82-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-78-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-76-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-74-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-72-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-70-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-68-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-66-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-62-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-60-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-58-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-56-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-54-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-52-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-50-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-48-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-44-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-42-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-38-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-36-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-34-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-32-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-2159-0x0000000005430000-0x000000000543A000-memory.dmp

              Filesize

              40KB

            • memory/2536-80-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-28-0x0000000004A20000-0x0000000004A78000-memory.dmp

              Filesize

              352KB

            • memory/2536-92-0x00000000050E0000-0x0000000005131000-memory.dmp

              Filesize

              324KB

            • memory/2536-29-0x0000000004AD0000-0x0000000005074000-memory.dmp

              Filesize

              5.6MB

            • memory/2536-30-0x00000000050E0000-0x0000000005136000-memory.dmp

              Filesize

              344KB

            • memory/2940-2172-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

              Filesize

              40KB

            • memory/4672-4325-0x0000000004ED0000-0x0000000004F38000-memory.dmp

              Filesize

              416KB

            • memory/4672-4326-0x0000000005530000-0x0000000005596000-memory.dmp

              Filesize

              408KB

            • memory/4672-6473-0x0000000005750000-0x0000000005782000-memory.dmp

              Filesize

              200KB

            • memory/4948-6479-0x0000000000DB0000-0x0000000000DE0000-memory.dmp

              Filesize

              192KB

            • memory/4948-6480-0x0000000003180000-0x0000000003186000-memory.dmp

              Filesize

              24KB

            • memory/4948-6481-0x000000000B2C0000-0x000000000B8D8000-memory.dmp

              Filesize

              6.1MB

            • memory/4948-6483-0x000000000ADB0000-0x000000000AEBA000-memory.dmp

              Filesize

              1.0MB

            • memory/4948-6484-0x000000000ACA0000-0x000000000ACB2000-memory.dmp

              Filesize

              72KB

            • memory/4948-6485-0x000000000ACC0000-0x000000000ACFC000-memory.dmp

              Filesize

              240KB

            • memory/4948-6486-0x0000000003070000-0x00000000030BC000-memory.dmp

              Filesize

              304KB

            • memory/5368-4305-0x0000000005740000-0x00000000057D2000-memory.dmp

              Filesize

              584KB