Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:29

General

  • Target

    fca20906269e534594e3b86ffdde34250f6f8806091291b74054aac1a00d625e.exe

  • Size

    1.5MB

  • MD5

    01c53e0fd928f1d49fa9173b153ed347

  • SHA1

    619c5d48d808376168206a69a013373a8d6ef6d3

  • SHA256

    fca20906269e534594e3b86ffdde34250f6f8806091291b74054aac1a00d625e

  • SHA512

    9fd09d28b36a52ec3f2375acf12b0d3dca75aa3a35626fcea5424918d23ea9b95fb1c4bf6d0642e76787c0a86811d540490d2c710a73f2e4765a14300d206ba6

  • SSDEEP

    24576:rydTDdd99jsSuBsp+qhNt3KPkv0fB7qAMVou2xBgTV9bvaO4o9:eBd79IBsgq7taAQ7qAMau4GhvaH

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fca20906269e534594e3b86ffdde34250f6f8806091291b74054aac1a00d625e.exe
    "C:\Users\Admin\AppData\Local\Temp\fca20906269e534594e3b86ffdde34250f6f8806091291b74054aac1a00d625e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zL091473.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zL091473.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zx280938.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zx280938.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eV523786.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eV523786.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\103063084.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\103063084.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1416
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5576
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\273235483.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\273235483.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5648
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 1260
              6⤵
              • Program crash
              PID:3608
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320867557.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320867557.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1860
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5732
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1540
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5548
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:368
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5500
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2620
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1644
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2576
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\453715691.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\453715691.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3064
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1256
          4⤵
          • Program crash
          PID:3352
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\594695299.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\594695299.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3280
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5648 -ip 5648
    1⤵
      PID:440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3064 -ip 3064
      1⤵
        PID:2900
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:4796
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:4184
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:3196

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\594695299.exe

        Filesize

        168KB

        MD5

        23bf8277fe81d432902a96d16906735b

        SHA1

        998bd641c8084bf425b2185419f3d91f4cf0dec4

        SHA256

        743b918aa649e9dfb54739b2ac00523fa048d1495dcf1ed3baf6afe5b10b106b

        SHA512

        cd0db15dd275d05d7156842ee3033fdd834c623a321ee476e53dfc400f6bf9f1a3df06e4e815071da554ba2e2b075bfc16ba2087ff92e84a29b55f501e3aadf2

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zL091473.exe

        Filesize

        1.3MB

        MD5

        fe10cd7e74f5fe786215f96b97746b23

        SHA1

        59b853a3af00ebf19aa43760deeb562c0d46240f

        SHA256

        636b7ca21cb9fa31ee98c29b9f98ee32358a04abc0a59da71fdc3e7c5e877235

        SHA512

        d2a969055d009c4571b132941252331e839872e00def5dc26f62503785a5d7885fb5847fbe30a31926c52b3df9157d6268f99d3e068fd39a1c7b989752859c65

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\453715691.exe

        Filesize

        539KB

        MD5

        d2a2fd2cb1dcf57958cbc1483574bfc3

        SHA1

        8913bcf12ce453f6e300e7065a57a86bd85674ac

        SHA256

        b203a481480020fbbbd3503334e9cb9cd5f39c2746b638a3faabd47bbb968323

        SHA512

        f03831b9d3a20ac6e4ce4bd7999c2233ad3e3b9e06bee60375f9353272b4c40fc5deaa17fe955d16a36537b8a4ec1c6fa9cc76db016a2336ea3fdc01c29a8aae

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zx280938.exe

        Filesize

        871KB

        MD5

        4b135b0b0e75c6b2c6ef5f55ce6ba08c

        SHA1

        89d55a09cc799803d566b5a2531a73281776168f

        SHA256

        b91318b20ad47631997dd2c5efea6bbb1cc08de4a00f818f2d3914db9b5baf8a

        SHA512

        c9d74b46e9ea45d6a6bdcb34fdba9008bc5f9e8d81b50748ffe0292868a57fcaabf3511245d9f359988ee882c35411453f8fcc0042ab1dc8e42237dfd97c06e7

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320867557.exe

        Filesize

        204KB

        MD5

        a8747ab975cf210280c28f33311d718f

        SHA1

        3cb555e669e4659d1c25e09480fda99948d904ce

        SHA256

        5b0c68cdf5f9a1f0e7692cb0bb9d801549137d9c640de6ea90a28af3a633ac5f

        SHA512

        9faea59c2405d67e4251a54a43ea7584f42b47d79940ea1a16af7b10e49585c427fab3497f451c69c4b518b710bb1a66ca09086e4b092b0482bd80b0ec1e42ee

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eV523786.exe

        Filesize

        699KB

        MD5

        7d61046827497b2ed627b416742b6451

        SHA1

        cc686f96384f6b5420e24163bd97e0a8372eb64c

        SHA256

        86941e0edab04ae216625245a2d8ebc18fd090094fd4213b26a14d3d04bdef03

        SHA512

        5787c24ee2dbbb0a06c2317218b121805e717f30a6d536d41dba54609ced4b2895dcd1bf5b0add069d65e9d1d4b2c9f4a0dc5a8f78fd9546a14135ca4ec0e81a

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\103063084.exe

        Filesize

        300KB

        MD5

        c59b5d06f5bdfe96b3c3cca501cdc5f0

        SHA1

        734b011117254f967c8bca10194b4b776d421132

        SHA256

        e03ba49b1039ed9b7edc5bc5ce2855728d5d9968b87c60715c639194cef488b7

        SHA512

        f6c98034f767093a9bc9b3ec8c8f22a92e791bb3053402b98f81a1d2f87c894d363514959abf67596c475b912e6726ed7c497f46983cc1bd3dcdcc74171cf178

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\273235483.exe

        Filesize

        479KB

        MD5

        a9b7f042e305cfe680e01d295d73c588

        SHA1

        efd11fb06e7c2edc2b0e159f2e5e40931629691e

        SHA256

        621941d6d6d87b9e38e84b1f48e8c38c74d14839059e1002599eedca22c06eb4

        SHA512

        681b5258e74d2e0f7a9f856055d795b16dcc5641ee21b9d1fa9ab53428976b4337499a5ef68d388b1fb675155347275324c62939c22a92c64cc1300b75c0e8fa

      • C:\Windows\Temp\1.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • memory/1416-84-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-42-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-90-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-88-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-86-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-94-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-82-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-80-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-78-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-76-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-74-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-72-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-70-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-68-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-66-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-62-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-60-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-58-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-56-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-54-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-52-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-51-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-48-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-46-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-44-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-92-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-38-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-36-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-34-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-32-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-31-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-2159-0x00000000052F0000-0x00000000052FA000-memory.dmp

        Filesize

        40KB

      • memory/1416-64-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-40-0x00000000049E0000-0x0000000004A31000-memory.dmp

        Filesize

        324KB

      • memory/1416-28-0x0000000004900000-0x0000000004958000-memory.dmp

        Filesize

        352KB

      • memory/1416-29-0x0000000004AB0000-0x0000000005054000-memory.dmp

        Filesize

        5.6MB

      • memory/1416-30-0x00000000049E0000-0x0000000004A36000-memory.dmp

        Filesize

        344KB

      • memory/3064-4325-0x00000000026F0000-0x0000000002758000-memory.dmp

        Filesize

        416KB

      • memory/3064-4326-0x0000000002900000-0x0000000002966000-memory.dmp

        Filesize

        408KB

      • memory/3064-6473-0x0000000002C60000-0x0000000002C92000-memory.dmp

        Filesize

        200KB

      • memory/3280-6479-0x0000000000AB0000-0x0000000000AE0000-memory.dmp

        Filesize

        192KB

      • memory/3280-6480-0x0000000005290000-0x0000000005296000-memory.dmp

        Filesize

        24KB

      • memory/3280-6481-0x000000000AEE0000-0x000000000B4F8000-memory.dmp

        Filesize

        6.1MB

      • memory/3280-6482-0x000000000AA60000-0x000000000AB6A000-memory.dmp

        Filesize

        1.0MB

      • memory/3280-6483-0x000000000A990000-0x000000000A9A2000-memory.dmp

        Filesize

        72KB

      • memory/3280-6484-0x000000000A9F0000-0x000000000AA2C000-memory.dmp

        Filesize

        240KB

      • memory/3280-6485-0x0000000002C10000-0x0000000002C5C000-memory.dmp

        Filesize

        304KB

      • memory/5576-2172-0x00000000008F0000-0x00000000008FA000-memory.dmp

        Filesize

        40KB

      • memory/5648-4305-0x0000000005840000-0x00000000058D2000-memory.dmp

        Filesize

        584KB