Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:42

General

  • Target

    795af50363383db6cced03c6fb74363e4d02efe3a865beeb022c8f86fe8f08c4.exe

  • Size

    1.4MB

  • MD5

    69c449b4a7acd1ece42af0bd162deee5

  • SHA1

    13e86b75f403572f18da39efaea78309a8092b01

  • SHA256

    795af50363383db6cced03c6fb74363e4d02efe3a865beeb022c8f86fe8f08c4

  • SHA512

    06daa88cffd4273adc77c993a5d2e03e6a0e63c208c8b99e026a681ecc4f24ae582bc615b195bc99a545a2318f3dfa44ac033b647c2007fd516dfdcb0bff3c9c

  • SSDEEP

    24576:KyTDkczpgFhZXPtlf58vXVRvrlXNejxA4cBv+f5YvbCmdwqqOn:RTDksgfZ/txwjvrZG24cBvJbCbqF

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\795af50363383db6cced03c6fb74363e4d02efe3a865beeb022c8f86fe8f08c4.exe
    "C:\Users\Admin\AppData\Local\Temp\795af50363383db6cced03c6fb74363e4d02efe3a865beeb022c8f86fe8f08c4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JF225582.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JF225582.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Vr331199.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Vr331199.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xY690567.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xY690567.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:884
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\134233926.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\134233926.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3732
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3200
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\297522286.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\297522286.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1264
              6⤵
              • Program crash
              PID:6656
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\341398759.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\341398759.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6700
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6800
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:6892
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6924
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:6984
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:6992
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:7020
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5748
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5380
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2720
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477789641.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477789641.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:6840
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 1256
          4⤵
          • Program crash
          PID:3588
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\526917330.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\526917330.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4020
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1812 -ip 1812
    1⤵
      PID:6632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6840 -ip 6840
      1⤵
        PID:4004
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:5604
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:244

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\526917330.exe

        Filesize

        168KB

        MD5

        75103399f1705ef4e05d0e076d197b7f

        SHA1

        985ffcacb1250ca880eb6bc66a2474b3a733eae3

        SHA256

        a24b652d13dfdadac15144a5079dc65901e3e96125c0e4bc6f073113ab05e9c7

        SHA512

        2ff7aa6f6861dd7352d3db83e30a1660dd817246967145c502ea8f8b553293601bec36dba9b419998f7b12bd24c31f2c80ba2fddcce1209f6baf0b914c29aa36

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JF225582.exe

        Filesize

        1.3MB

        MD5

        9f8b833fae6a104f7499e789e609e6ef

        SHA1

        edfbaf3af67baeaaa268b0be5321869c8c9df82d

        SHA256

        0342156aedaf2b5fdec1d4e70a688f5354da7b50c4d8c6de5537adb6e0fe593b

        SHA512

        aabae523d550979bf668e61043967a797fc86c06a61bdf2c2e619e1f64d47e79c2de434197c5a05e3731bfa85bc210b457d8bd9a22d677ed7b5d0d4b42983c2a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477789641.exe

        Filesize

        583KB

        MD5

        1f546edfa95e2542e74f21f571f3c3c6

        SHA1

        f05628c6cda9ab8516c62abfc4afe941583c5102

        SHA256

        f34a67ad731c92299482eab5f92d3167073714c7b2600e1c07a55eed13b5005e

        SHA512

        0161e70fa05c21744c2af7b6ac0e2a009642ace6526789112fd03e6ad8c1837797b0027d000963d00bc8fe16ce35661009d46c7375dce562d0d24123612913a2

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Vr331199.exe

        Filesize

        852KB

        MD5

        77b61c9c476eb2d9c71e7fd0e770f10e

        SHA1

        c461671ba6fa9e0c5865b3a171e2b091f33b01ee

        SHA256

        57056805a22fc9c0d5c0b32a1ff635dd4261d6853442fd137f5e0e2634ce99f2

        SHA512

        ebeb78d1d9003f69ae0090f9a23790eef44dca0176bd79ed7b4a7edf7388c7f80c754160b995083dbde70002edff9f6f366e73a6d1d7e2afe0b8dd466fcc7a73

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\341398759.exe

        Filesize

        204KB

        MD5

        c8feb4a42159c2f8a01306647dac3d1d

        SHA1

        913fddee05d5b4fc8063374f0f35864f1f0b6be2

        SHA256

        0c8442df87e9ce0d15bcaab9ee5960a3b5c33d21ee40dc92e5a4dc8f86fee00b

        SHA512

        686460d818c8278a171a275169a141ec93ee392e6062243f34b77831202f33de01f582fe587757aa034484a4796fa53149883692312f004e764b50af8d676b25

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xY690567.exe

        Filesize

        680KB

        MD5

        f6f1496394725a4975d9d084db37e87b

        SHA1

        e48546301c813f76e9eedd562e0b63c787dd50a4

        SHA256

        93310850abfc688e38b3fc11e85696c0f94513a306e52d1c5981b41c055da1a7

        SHA512

        8dde39779001f51bcc1a2133406a73fc9df81013ede2a76bc1f1966a711e97707e384d79e3a85b9898a5ecce464ac449fba3a61286cff5421933ac5769de18a6

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\134233926.exe

        Filesize

        300KB

        MD5

        801065670ad64c2637db108bfd22ba32

        SHA1

        4468ee11bc76a25e2c0ad6de8a72221607b4527b

        SHA256

        a97c2c88dc9719e9da704f4c58eb1446c7f6732a7dc0a393345e1708b883b80f

        SHA512

        8653268af69659fa6fda82ff97d8e619f82e371c6eefb73cf1ba0c278894f98df3226f7614f93c9dd88147d7c696f16faa340588a446fbc74c1a36b882c49afb

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\297522286.exe

        Filesize

        522KB

        MD5

        bceb657f1424f65db867b44bae6d53a7

        SHA1

        f1a331778990ba8f726bb1e252dc388ac9d2cc5a

        SHA256

        480a061631d577cca2f2de4123d9031f09c8f1b5d9e084f6b3794881cad8a851

        SHA512

        c8a7657a8498003c6c6d6e667e4f0fabef47a9048acb557a521e18464c4bf2de530ed9f3338890885a79f9e1c2b0a002bd3513188461137d27ba93d8a94c080e

      • C:\Windows\Temp\1.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • memory/1812-4305-0x0000000005800000-0x0000000005892000-memory.dmp

        Filesize

        584KB

      • memory/3200-2175-0x00000000004F0000-0x00000000004FA000-memory.dmp

        Filesize

        40KB

      • memory/3732-80-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-36-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-84-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-88-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-78-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-76-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-74-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-72-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-71-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-68-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-64-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-62-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-60-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-58-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-56-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-54-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-52-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-50-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-46-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-44-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-42-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-40-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-38-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-86-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-34-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-66-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-48-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-32-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-31-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-2159-0x00000000052E0000-0x00000000052EA000-memory.dmp

        Filesize

        40KB

      • memory/3732-90-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-92-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-94-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-82-0x00000000049D0000-0x0000000004A21000-memory.dmp

        Filesize

        324KB

      • memory/3732-30-0x00000000049D0000-0x0000000004A26000-memory.dmp

        Filesize

        344KB

      • memory/3732-29-0x0000000004A60000-0x0000000005004000-memory.dmp

        Filesize

        5.6MB

      • memory/3732-28-0x0000000002420000-0x0000000002478000-memory.dmp

        Filesize

        352KB

      • memory/4020-6479-0x0000000000210000-0x0000000000240000-memory.dmp

        Filesize

        192KB

      • memory/4020-6480-0x0000000002470000-0x0000000002476000-memory.dmp

        Filesize

        24KB

      • memory/4020-6481-0x00000000052A0000-0x00000000058B8000-memory.dmp

        Filesize

        6.1MB

      • memory/4020-6482-0x0000000004D90000-0x0000000004E9A000-memory.dmp

        Filesize

        1.0MB

      • memory/4020-6483-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

        Filesize

        72KB

      • memory/4020-6485-0x0000000004D20000-0x0000000004D5C000-memory.dmp

        Filesize

        240KB

      • memory/4020-6486-0x0000000004EA0000-0x0000000004EEC000-memory.dmp

        Filesize

        304KB

      • memory/6840-4325-0x0000000004D90000-0x0000000004DF8000-memory.dmp

        Filesize

        416KB

      • memory/6840-6473-0x0000000005750000-0x0000000005782000-memory.dmp

        Filesize

        200KB

      • memory/6840-4326-0x0000000005500000-0x0000000005566000-memory.dmp

        Filesize

        408KB