Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:40

General

  • Target

    13ac3efec993c6818e6d255e7cf2d9dbbef04d8d854e5c997a43fe5672709032.exe

  • Size

    1.1MB

  • MD5

    c4d6d04d5dc03c72fc171fe9d6c3afd4

  • SHA1

    d9b785d175ef17b3af2a60c76a81612f4262804c

  • SHA256

    13ac3efec993c6818e6d255e7cf2d9dbbef04d8d854e5c997a43fe5672709032

  • SHA512

    d0d8f1efc8064ebff3544160680f03e0634ec9d4ce80bb5522750cbd764ab631125d7bfe266e518de9120cfd9ffe02907d6c4d2183d761f872c1b0a348ea9510

  • SSDEEP

    24576:5yRa/aYbPdw8NtRjuXfucwf6V8f3WjSimeHlDg:soyYrm8N7j4f/wxfGjSb

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13ac3efec993c6818e6d255e7cf2d9dbbef04d8d854e5c997a43fe5672709032.exe
    "C:\Users\Admin\AppData\Local\Temp\13ac3efec993c6818e6d255e7cf2d9dbbef04d8d854e5c997a43fe5672709032.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn344101.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn344101.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bR154927.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bR154927.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pG968957.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pG968957.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3740
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\145019496.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\145019496.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2888
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284004981.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284004981.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1568
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1084
              6⤵
              • Program crash
              PID:1516
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\319219348.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\319219348.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1580
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:888
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3116
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:400
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1148
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4080
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1092
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1668
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417887497.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417887497.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4280
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1568 -ip 1568
    1⤵
      PID:2532
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:636
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4708

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn344101.exe

      Filesize

      931KB

      MD5

      05182e39e02da6b15bb4cd02d77b5038

      SHA1

      edafe6c4de7a123d43208eeefa55ddd10557ae73

      SHA256

      9de01618c2b91eefc5800163e6d3f4cbc085ac5656d46e090210f78150546044

      SHA512

      20d7a13097669ba8645201b4a2e66a985dae9e22f044b272f777b4c27d4ce04bd883f36602c2db3439876b0fd5813f71a6159ec9d6103fae06ef4f7dfc602729

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417887497.exe

      Filesize

      348KB

      MD5

      f6f7fe154a6f190e0ecb8316a36c370f

      SHA1

      0e9d78080d5102a0967fdf1f7939c0e3b09ecb3e

      SHA256

      15a6b9f5414f42b18d4805aed89ee1aab8f3ae41682c3a746a3dec3a9f090ad8

      SHA512

      8f23c502185f36caed3abceb32eb20c912df70d4b5d326bdbb6e59a838eebcba81b1358cd461727806f9e6954d5908c0a429eb313a98cbfeff911880c5cf2fc2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bR154927.exe

      Filesize

      577KB

      MD5

      23a9e352f0c969cf2ba7052fd5f94f20

      SHA1

      10fc97f8899ed6f52bd01603203b6198166432df

      SHA256

      01b03d7f3d40ba821d46bfd1a38c16175fdc6ab66bc92e47414e7c27dc3fdb6c

      SHA512

      68352e327d331796bd2df50565c41d48f5eab840f98f6ce4a0fb7dba2be8d2eee800f1df2f71d6a34ea662b69fe4214877dd328ce8160ece4910055f961f5761

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\319219348.exe

      Filesize

      204KB

      MD5

      1304f384653e08ae497008ff13498608

      SHA1

      d9a76ed63d74d4217c5027757cb9a7a0d0093080

      SHA256

      2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

      SHA512

      4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pG968957.exe

      Filesize

      406KB

      MD5

      73bfebad9b603c800ab92d38eb969824

      SHA1

      a867650ae0570d000bba3b423d0468450703f05f

      SHA256

      e69e545a27d9af8e59d4fd88f01c909157ad5eb136c48518e159210682324f99

      SHA512

      18c9a4397b865f25f3425a23315f1f4def211708e8009b42b74515eb94b115eaa02fe5036e598aec66f6a365dbf0cbec37153b6343ce76d6f67cd31c58146f63

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\145019496.exe

      Filesize

      175KB

      MD5

      3d10b67208452d7a91d7bd7066067676

      SHA1

      e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

      SHA256

      5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

      SHA512

      b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284004981.exe

      Filesize

      264KB

      MD5

      35d7b6cd3132a98f77c183d59304d814

      SHA1

      22c457824e0b296738eb01f0f833e13a7399fad6

      SHA256

      218041b492a7b38e85f68c0c532da7e233b16dba7a345eca49c922432f1c7c84

      SHA512

      16ce435f10589b0fd01b14c7a50739ada1a5c5ec20de1a32667450c2ff5f0ffc87b19c5afe5b10558f5984f1f03986efdccf002a53cabde7be308d234172c5f4

    • memory/1568-94-0x0000000000400000-0x0000000002B9D000-memory.dmp

      Filesize

      39.6MB

    • memory/1568-92-0x0000000000400000-0x0000000002B9D000-memory.dmp

      Filesize

      39.6MB

    • memory/2888-36-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-30-0x0000000004AD0000-0x0000000004AE8000-memory.dmp

      Filesize

      96KB

    • memory/2888-44-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-42-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-40-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-38-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-58-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-56-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-54-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-48-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-34-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-32-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-31-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-50-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-52-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-46-0x0000000004AD0000-0x0000000004AE3000-memory.dmp

      Filesize

      76KB

    • memory/2888-29-0x0000000004BD0000-0x0000000005174000-memory.dmp

      Filesize

      5.6MB

    • memory/2888-28-0x00000000023C0000-0x00000000023DA000-memory.dmp

      Filesize

      104KB

    • memory/4280-112-0x0000000007130000-0x000000000716C000-memory.dmp

      Filesize

      240KB

    • memory/4280-113-0x0000000007790000-0x00000000077CA000-memory.dmp

      Filesize

      232KB

    • memory/4280-117-0x0000000007790000-0x00000000077C5000-memory.dmp

      Filesize

      212KB

    • memory/4280-119-0x0000000007790000-0x00000000077C5000-memory.dmp

      Filesize

      212KB

    • memory/4280-115-0x0000000007790000-0x00000000077C5000-memory.dmp

      Filesize

      212KB

    • memory/4280-114-0x0000000007790000-0x00000000077C5000-memory.dmp

      Filesize

      212KB

    • memory/4280-906-0x0000000009C90000-0x000000000A2A8000-memory.dmp

      Filesize

      6.1MB

    • memory/4280-907-0x000000000A340000-0x000000000A352000-memory.dmp

      Filesize

      72KB

    • memory/4280-908-0x000000000A360000-0x000000000A46A000-memory.dmp

      Filesize

      1.0MB

    • memory/4280-909-0x000000000A480000-0x000000000A4BC000-memory.dmp

      Filesize

      240KB

    • memory/4280-910-0x0000000006C20000-0x0000000006C6C000-memory.dmp

      Filesize

      304KB