Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:17

General

  • Target

    63ae322c56a4013c1d60080c290db9abcfe8efa0404b72ded0c3f7f1567e6fbaN.exe

  • Size

    1.7MB

  • MD5

    2780537e6bf94573f40ecf02d11cf960

  • SHA1

    8eed3cf5232a991834f39cdd14bbe5e40224a7ef

  • SHA256

    63ae322c56a4013c1d60080c290db9abcfe8efa0404b72ded0c3f7f1567e6fba

  • SHA512

    ea7eba8103e372b2f18b3148bca361916015c0486a1fe2582bd7181a6a10b7a697de64acbe833496bbdc1682e9c6b7ce5fabc8cca3bbd391c6a2e71d1495541e

  • SSDEEP

    49152:Eb0+059x8Ob0mIcf8TVtsjKNLYu6W4tqCJ:O0/5k80mI7s2CLHz

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63ae322c56a4013c1d60080c290db9abcfe8efa0404b72ded0c3f7f1567e6fbaN.exe
    "C:\Users\Admin\AppData\Local\Temp\63ae322c56a4013c1d60080c290db9abcfe8efa0404b72ded0c3f7f1567e6fbaN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oE606234.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oE606234.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ej741818.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ej741818.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\JV814224.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\JV814224.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1268
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Iw630812.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Iw630812.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1380
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a30455456.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a30455456.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Windows\Temp\1.exe
                "C:\Windows\Temp\1.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Executes dropped EXE
                • Windows security modification
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5636
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b31150111.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b31150111.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 1256
                7⤵
                • Program crash
                PID:3108
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c62285251.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c62285251.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1112
            • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
              "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3724
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5356
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5416
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5580
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5804
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5924
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4964
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4360
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5864
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d31605503.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d31605503.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5032
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1252
            5⤵
            • Program crash
            PID:1924
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f99598195.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f99598195.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6428
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5672 -ip 5672
    1⤵
      PID:5992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5032 -ip 5032
      1⤵
        PID:6496
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:1976
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6812

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oE606234.exe

              Filesize

              1.4MB

              MD5

              f9e7fc4c2d269f265123bd7bbb8273a4

              SHA1

              5d2058cde5875369b10806f977d6623d8a3f7bdc

              SHA256

              3ad830e85f989bd812b96a525123bf2f22dbee7ce17b0a966866102c3d8bae88

              SHA512

              3d8af5729a3b6cce28d71a2325e93b1ed83d64f5b2c08ec1532d265c6f5c5dfda608b1fe85608618d50db0a19980910fa28b1344b51d36129e1c748157b94dad

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ej741818.exe

              Filesize

              1.3MB

              MD5

              aab070e5656e5b4bdebb70b65e0eb263

              SHA1

              4e208630f9a968d61f3d4fad6a467ae5fb247cb7

              SHA256

              1f591690a84d1d6e245d2f7dec62b873395dcc61807891283ec0d6bf5438264d

              SHA512

              eabe9ca4d4807b048cc537d636f8532e723ef29198298d9a9280a79e1fdd01bcc480c054e493f6ff8da78b66b1bbf7e13c6d9cdc0a0334363687d83f7447d8f0

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f99598195.exe

              Filesize

              169KB

              MD5

              58dae70b0842d0d4cccbfa860e90da3d

              SHA1

              2ec9ddee41ba4e850537cb70a8a8bbcf42d25dff

              SHA256

              2cca5c718cb85833e8594082e28c3d229d0d3b9a58867b4423cc744bf2636210

              SHA512

              d63ccab9743d5ad76b0145c90b9cc0a49bb0d92554fea7171217f50a7121157bf10550f8777a8dabf6637967172cfe167e09f75f8780c9f6b0b37de95b1ff117

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\JV814224.exe

              Filesize

              851KB

              MD5

              2eb2a087a44d5945200ebc1f6d2e3ed4

              SHA1

              a375395a9db9e9f5d2e4a17b3de3429718cde52f

              SHA256

              3fb198e1d7c3dcd68933abb49119fe062c5349098fdddee37af075b86c46245d

              SHA512

              97be359f77feba898802d814f43cb98014c7e8f800c52a679c084b9434f8103464b96e932a98450443bebd321ca457bdce7c8280b542121b6a24f83d01f144f8

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d31605503.exe

              Filesize

              582KB

              MD5

              e3916636dab8efab853f94bdd692efa1

              SHA1

              33b01ca241c69c5239cb6b25d7830fc76122f8a9

              SHA256

              cfaf533f6776e820dfeb08ee8b73605037832c0373f86ff5e8849aa826d71bde

              SHA512

              d0e44a0b890e9f1c56c3ac30e9bf423800e03c65d937ac9de32973600fc961f1f17fc909605da36001b97e57e87c56e0663c7fad4d2ce3c00bdff641c2ff1d79

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Iw630812.exe

              Filesize

              680KB

              MD5

              245666d019af6076a90c3e349f8cb1d6

              SHA1

              1d838283de0a408e0fb58397fb7fbf6863418ba5

              SHA256

              1cbad9669d4db2539fe2a1f84280e2b8540b1ff2670b0ecf7d2efd2becacac4f

              SHA512

              2e3003938bb766985a789b725024824c16dc26d38700f55fdc434492fd97984bf7b95607d491d7f6a5621af6f00ff51daa9dbddcf41f5cdb1d97b678d5cf5141

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c62285251.exe

              Filesize

              205KB

              MD5

              849b96fff066448788c01a4e4f53dfdf

              SHA1

              9638c0a294636ba6388b4e142724d324d979f95e

              SHA256

              d6205e7b7b57af2dbf63e9cc43d7a4918172da8a82ba01d787c9ca8c04f52048

              SHA512

              b03f4593e94fd7fedcb7bfa74c14a587ebb4389c2ae8fa7e22c3616c621ed7c21198077ce0d4064ff12a31c10a6abc075d57345b782e0f6c233622ddac016026

            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a30455456.exe

              Filesize

              302KB

              MD5

              78ca54a77ae6b2ebd1742d43bc2b166d

              SHA1

              1660a6ca41dbc4563abd4da8d94980aebac453e7

              SHA256

              8d5d89f3b7d7f59693fe965d576dffc795ed8ddebe93041c118a5108c1448041

              SHA512

              6637126e06009168225dc844a38eae08a6c8b64e10edc9feb8863d5120c83e2c6b6eadbf724c7d2a6a43d7ea35307b86e823ae27f39055ee93f845d549d55abe

            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b31150111.exe

              Filesize

              522KB

              MD5

              7edd3c6f26aaf6cece240bfb771d3299

              SHA1

              911f4d739ccd50023037e1e8dd08918e068022b7

              SHA256

              cb29785bffc9632c5acb9a50e23e0e8df978f772e94471f15eee6e0ef1c326ad

              SHA512

              231cd08c0e54b87a845ed0ac50e7c65734628afd15f7f7788b203071199fd20b4d2f864021af8189b9af8e68fbfc98da62274582a92d10688dd327cc8a3be455

            • C:\Windows\Temp\1.exe

              Filesize

              11KB

              MD5

              7e93bacbbc33e6652e147e7fe07572a0

              SHA1

              421a7167da01c8da4dc4d5234ca3dd84e319e762

              SHA256

              850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

              SHA512

              250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

            • memory/1236-89-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-43-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-93-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-91-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-97-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-87-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-85-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-83-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-81-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-77-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-75-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-73-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-71-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-69-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-67-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-65-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-63-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-61-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-57-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-55-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-53-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-51-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-49-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-47-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-45-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-95-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-39-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-79-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-59-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-41-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-38-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp

              Filesize

              40KB

            • memory/1236-101-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-99-0x0000000004FD0000-0x0000000005021000-memory.dmp

              Filesize

              324KB

            • memory/1236-35-0x0000000002400000-0x0000000002458000-memory.dmp

              Filesize

              352KB

            • memory/1236-36-0x00000000049E0000-0x0000000004F84000-memory.dmp

              Filesize

              5.6MB

            • memory/1236-37-0x0000000004FD0000-0x0000000005026000-memory.dmp

              Filesize

              344KB

            • memory/5032-4332-0x0000000004E20000-0x0000000004E88000-memory.dmp

              Filesize

              416KB

            • memory/5032-4333-0x0000000004E90000-0x0000000004EF6000-memory.dmp

              Filesize

              408KB

            • memory/5032-6480-0x0000000005760000-0x0000000005792000-memory.dmp

              Filesize

              200KB

            • memory/5636-2182-0x0000000000D40000-0x0000000000D4A000-memory.dmp

              Filesize

              40KB

            • memory/5672-4312-0x0000000005750000-0x00000000057E2000-memory.dmp

              Filesize

              584KB

            • memory/6428-6486-0x0000000000DD0000-0x0000000000E00000-memory.dmp

              Filesize

              192KB

            • memory/6428-6487-0x00000000055B0000-0x00000000055B6000-memory.dmp

              Filesize

              24KB

            • memory/6428-6488-0x0000000005D40000-0x0000000006358000-memory.dmp

              Filesize

              6.1MB

            • memory/6428-6489-0x0000000005830000-0x000000000593A000-memory.dmp

              Filesize

              1.0MB

            • memory/6428-6490-0x0000000005750000-0x0000000005762000-memory.dmp

              Filesize

              72KB

            • memory/6428-6491-0x00000000057B0000-0x00000000057EC000-memory.dmp

              Filesize

              240KB

            • memory/6428-6492-0x0000000005940000-0x000000000598C000-memory.dmp

              Filesize

              304KB