Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:26

General

  • Target

    bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe

  • Size

    1.1MB

  • MD5

    02ea92117780415bab2a5272571e5981

  • SHA1

    9cea6857b20378f53d4614e9480df8a36b3dc23a

  • SHA256

    bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751

  • SHA512

    8179ce727e9e146115c82e9ef04b941d609ef3733257f6c4ac48b06cc421986de2b53d63548c1432b24d8b3a6118a054fa32981338c4ece9fdb1c5c094ccc7e7

  • SSDEEP

    24576:wy49Vo+Wk0ADAkXWmNBjjJXwqkB4zL+zuo1cJf2lENDZI:34AZr2WmNBjjlwT6+zuo1cJYCD

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe
    "C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1580
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3624
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1080
              6⤵
              • Program crash
              PID:3084
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3288
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1080
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1796
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1084
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4848
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4568
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2052
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2204
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3500
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3792
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4764
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3624 -ip 3624
    1⤵
      PID:4868
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:6052
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:1968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe

      Filesize

      136KB

      MD5

      100a9d616da8dbb82fd696af48f1891e

      SHA1

      ca5011879625e02ef42b732232885c736d30fbd0

      SHA256

      307c15e07a61de6f9d9c4cbf949504460d8f1725e812c97ca2aa8656180bd18e

      SHA512

      0f8f3271c8a466502da57f6f2e126f96e3cca594334242f700d900dafad856120206353e77896e49b3f12a50193e4e4b78c6a8ba7529cb4dfea18e97909a70c5

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe

      Filesize

      940KB

      MD5

      6d4c69e485cda470e0e520484bdf8ffc

      SHA1

      8f0fd745a678be9d1f26e6e749be129bead771b1

      SHA256

      f4d386660fa1295364b0c62216bdb9ab9765b176774c59380764ed5fde617bb8

      SHA512

      ba7fe6386ddccc583a54dd72758a15d803f22f93bcf35540dd61550637c1f5a2fc1a45712600a9173737b31345fcee78c23c654aeb8e589d4a66facd87c2b566

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

      Filesize

      342KB

      MD5

      87ae6e0ec4e835d5a476b312a62dcdc3

      SHA1

      9bfa479bc59a8153901c766bc2dc3e7faa4b993d

      SHA256

      948b51d0b7b480000ecf0f9634f2112d0c940a6277fedacf697bf21ac7c58293

      SHA512

      1b75194daf0909b14dee53b5c518dbdbe1bbf337edaf80fc2e785d581a8c07b1206cf4c4d408a4b962c534eb2ae9cb89f86d99f13f095d84a9d3f28342a0c127

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe

      Filesize

      585KB

      MD5

      18a3145a836714106a300a27a17b9d6c

      SHA1

      7a29a99e32eabfae1f0c6de903f87809e92ac149

      SHA256

      dcebde37a04a6abe051556d8ea7d02c7c983dfebb71b8eff8aa797f489c04bce

      SHA512

      6fe9fd407f206df13d6102c73d9d1fe173d7e96ca58469c03e7edbbbf51d303539040cadb8e49a3ebf591c5e4d0914bb2e94ccc33cb9c2445b38f7309b070273

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe

      Filesize

      204KB

      MD5

      1304f384653e08ae497008ff13498608

      SHA1

      d9a76ed63d74d4217c5027757cb9a7a0d0093080

      SHA256

      2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

      SHA512

      4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe

      Filesize

      414KB

      MD5

      44468af881a4a93a83da9027fd3c4754

      SHA1

      f121ec469716330080b8333cb85d1f86502a8135

      SHA256

      f7db511644ef5d27641297993ee32ce1a29a0895c6b038d6f8ceea7984b4e9ce

      SHA512

      67f6eb9e0f2139083b4694da618cb41b322ba877f13785627fa352a1057005b3c8467a89b76cd9f66bb18819e02a8fcbe3e03697934ff46fb09562e7bec97a7f

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe

      Filesize

      175KB

      MD5

      3d10b67208452d7a91d7bd7066067676

      SHA1

      e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

      SHA256

      5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

      SHA512

      b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe

      Filesize

      259KB

      MD5

      ad2967beee518632cb84139f9a634aa2

      SHA1

      654a336303389ea74f1ee0b26bbb9761f57a6a20

      SHA256

      d1815f9bc574917de2b60df1f3cea67924c43552e3dfff174640295689b44476

      SHA512

      b4ddf71652e6167ce1f9c7c8c79f6b39ad713f07714da51cd526af325bf73523be470226fa5df66f788c8334d8f43a582505b9ab7771e535cabb973f93de0b84

    • memory/1580-31-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-30-0x0000000004980000-0x0000000004998000-memory.dmp

      Filesize

      96KB

    • memory/1580-50-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-48-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-46-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-45-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-42-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-58-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-40-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-39-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-36-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-34-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-54-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-32-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-56-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/1580-28-0x0000000002100000-0x000000000211A000-memory.dmp

      Filesize

      104KB

    • memory/1580-29-0x0000000004AE0000-0x0000000005084000-memory.dmp

      Filesize

      5.6MB

    • memory/1580-52-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2176-122-0x0000000000BB0000-0x0000000000BD8000-memory.dmp

      Filesize

      160KB

    • memory/2176-919-0x0000000002CF0000-0x0000000002D3C000-memory.dmp

      Filesize

      304KB

    • memory/2176-892-0x0000000007970000-0x00000000079AC000-memory.dmp

      Filesize

      240KB

    • memory/2176-614-0x0000000007A40000-0x0000000007B4A000-memory.dmp

      Filesize

      1.0MB

    • memory/2176-612-0x0000000007E60000-0x0000000008478000-memory.dmp

      Filesize

      6.1MB

    • memory/2176-613-0x00000000078D0000-0x00000000078E2000-memory.dmp

      Filesize

      72KB

    • memory/3624-92-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/3624-94-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/4764-123-0x0000000002560000-0x0000000002595000-memory.dmp

      Filesize

      212KB

    • memory/4764-121-0x0000000002560000-0x000000000259A000-memory.dmp

      Filesize

      232KB

    • memory/4764-124-0x0000000002560000-0x0000000002595000-memory.dmp

      Filesize

      212KB

    • memory/4764-117-0x00000000022C0000-0x00000000022FC000-memory.dmp

      Filesize

      240KB

    • memory/4764-114-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/4764-116-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/4764-112-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB