Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:14

General

  • Target

    527c2858f891102ffde752e81478a98873d20c019d85a7f220035112ba3d3fbe.exe

  • Size

    1.1MB

  • MD5

    a595f98443dcb1dc9f68dc7431cbe0c7

  • SHA1

    0faf1058cf0fd3af501645333ab3fbc77554ed56

  • SHA256

    527c2858f891102ffde752e81478a98873d20c019d85a7f220035112ba3d3fbe

  • SHA512

    defc529ae057d362d045985c07f60ef5c3dae9cc337f6f7569219af8463b16c31c12a78140250697605fe253cd3a5c9463edbd5de7dfaf9c2a74936f9b841258

  • SSDEEP

    24576:9ybc94xhNBndKHtmNBjpDEVzBDBWSbVCtY35mwun9TxBp6W:YbcyxDxYHt+lYdbt5pmrn9Txn6

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\527c2858f891102ffde752e81478a98873d20c019d85a7f220035112ba3d3fbe.exe
    "C:\Users\Admin\AppData\Local\Temp\527c2858f891102ffde752e81478a98873d20c019d85a7f220035112ba3d3fbe.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OI530521.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OI530521.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3112
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pK526318.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pK526318.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\NN388877.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\NN388877.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\169128747.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\169128747.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2180
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\240391504.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\240391504.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4588
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1076
              6⤵
              • Program crash
              PID:2768
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\370385170.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\370385170.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2076
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2272
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4528
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1512
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1628
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1920
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3228
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\480893262.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\480893262.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1428
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4588 -ip 4588
    1⤵
      PID:4824
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4708
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4796

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OI530521.exe

            Filesize

            941KB

            MD5

            be8c27f946078dfe76f55fd542652a17

            SHA1

            f1f20cc94ee0b705e144821180bc371a5bb9aa55

            SHA256

            0741455c9385d886b526deb54e70dfa63698b21410de93fcc136de53fc4c7c64

            SHA512

            1e5525b3d65f2c18138913926f1c6d32e5fe963105806fe9d519e32f9be4ca142a5264081e3abb084ac13946f70daad8bf3da9dafbf50c520e584bcec688a4ce

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\480893262.exe

            Filesize

            341KB

            MD5

            3cc833b875ca4fba54da3be3411d5dce

            SHA1

            251810e2b24b6f5df13a9561c520f9b6dcaa5ac3

            SHA256

            721b684fe65d2c2ed3f75fd0547cef4e34c0d087a82b9de04109b1e9ee913980

            SHA512

            64d31b4b89348ecb89e4f7340c82f89a0cbee5d10a3be234cb0fe2f9a20138f3282ca08a87c8e86b3c79c3152099115fdda631b84e2b3406cebe1d48d6dcd429

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pK526318.exe

            Filesize

            586KB

            MD5

            e93815908f74048fb8dc6654624febc0

            SHA1

            d9f9734822d21740aae52acfd17949206dcfa71a

            SHA256

            dd63eb2da70996894ba59321e7ff7735af2fee52c9f1cb4e3eafc896b359677b

            SHA512

            3c0c4bb3f0d368825d9012e48cfd563781b455ff22e901cc23537847916900314e161674b9f1bfcd7bb8b8629ac6bff6f4059f7315ba933d0f4dae9817653636

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\370385170.exe

            Filesize

            204KB

            MD5

            1304f384653e08ae497008ff13498608

            SHA1

            d9a76ed63d74d4217c5027757cb9a7a0d0093080

            SHA256

            2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

            SHA512

            4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\NN388877.exe

            Filesize

            414KB

            MD5

            9051ad35928fc126e4244006b7269be6

            SHA1

            93c8a4316c261cba6132d46f386a2e897c045c78

            SHA256

            989afd42e6885e1b3c632bd6075f08ce25c18e4766e3cfd8757607d5a011ed52

            SHA512

            ac603789a0f4e3d3d8ef176e99be2336a23488943dfe0961f45fb729aab0f07a78c4b8d233438636cbe21d79d5b6112fb03e9e77b79986d4193246a2de7aca07

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\169128747.exe

            Filesize

            175KB

            MD5

            a165b5f6b0a4bdf808b71de57bf9347d

            SHA1

            39a7b301e819e386c162a47e046fa384bb5ab437

            SHA256

            68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

            SHA512

            3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\240391504.exe

            Filesize

            259KB

            MD5

            cffc5c57359ebe7d8de6e8dd4d1d0d18

            SHA1

            c712397d76308a645e9fba5e34f0967858a44b1c

            SHA256

            2d10203702e811c25cb05cca7952ed932c65a5af62951f92deb6704450d65d6c

            SHA512

            ac91185a9316b0c750b2327bcc9f47657abecd5aea2edee7acb99144a4a965a9035559ea6f21f4bd718c3d729802a1cfda7611866a2d4754b088fdb9de9ebef6

          • memory/1428-906-0x0000000007530000-0x0000000007B48000-memory.dmp

            Filesize

            6.1MB

          • memory/1428-907-0x0000000007BF0000-0x0000000007C02000-memory.dmp

            Filesize

            72KB

          • memory/1428-908-0x0000000007C10000-0x0000000007D1A000-memory.dmp

            Filesize

            1.0MB

          • memory/1428-119-0x0000000002600000-0x0000000002635000-memory.dmp

            Filesize

            212KB

          • memory/1428-114-0x0000000002600000-0x0000000002635000-memory.dmp

            Filesize

            212KB

          • memory/1428-115-0x0000000002600000-0x0000000002635000-memory.dmp

            Filesize

            212KB

          • memory/1428-117-0x0000000002600000-0x0000000002635000-memory.dmp

            Filesize

            212KB

          • memory/1428-113-0x0000000002600000-0x000000000263A000-memory.dmp

            Filesize

            232KB

          • memory/1428-112-0x0000000002550000-0x000000000258C000-memory.dmp

            Filesize

            240KB

          • memory/1428-909-0x0000000007D30000-0x0000000007D6C000-memory.dmp

            Filesize

            240KB

          • memory/1428-910-0x0000000002480000-0x00000000024CC000-memory.dmp

            Filesize

            304KB

          • memory/2180-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-54-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-28-0x00000000024A0000-0x00000000024BA000-memory.dmp

            Filesize

            104KB

          • memory/2180-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-50-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-52-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-58-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

            Filesize

            76KB

          • memory/2180-30-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

            Filesize

            96KB

          • memory/2180-29-0x0000000004B40000-0x00000000050E4000-memory.dmp

            Filesize

            5.6MB

          • memory/4588-93-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB