Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 02:07

General

  • Target

    c90a4448aa6ba41b5dff530982a99913167e2733d26c96e4c86e78ddf430cfde.exe

  • Size

    1.1MB

  • MD5

    9ddc6bdd35b459ba643ac7bb28708565

  • SHA1

    09d923504fe540118f8858804512820e48b76da2

  • SHA256

    c90a4448aa6ba41b5dff530982a99913167e2733d26c96e4c86e78ddf430cfde

  • SHA512

    96841014954d8f64feb916dce4da31be9ec46f48c68fb8fb374c2f7b514403c9d0b82fce237c039383bdfd2791e2b570c0a7d2329102bf7af3e76bc810e52772

  • SSDEEP

    24576:2yQNexa+QN7AU9z6Wpmv1BhGHhLUih12VP31hpYXqckJbZDoPU:FMeI6dHoHBbh12VP37pYXByD

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c90a4448aa6ba41b5dff530982a99913167e2733d26c96e4c86e78ddf430cfde.exe
    "C:\Users\Admin\AppData\Local\Temp\c90a4448aa6ba41b5dff530982a99913167e2733d26c96e4c86e78ddf430cfde.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PH010121.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PH010121.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4720
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cC807446.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cC807446.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS251086.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS251086.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\181482417.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\181482417.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4584
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\282322747.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\282322747.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1600
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 1080
              6⤵
              • Program crash
              PID:1556
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325533682.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325533682.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4268
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3168
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4004
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1028
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3360
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1172
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1912
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3672
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2760
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\485547283.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\485547283.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1600 -ip 1600
    1⤵
      PID:4912
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:6120
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:5428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PH010121.exe

      Filesize

      930KB

      MD5

      e544be849b2aa5bcad760b7cc8ff1495

      SHA1

      b1eb252df4bdc10cd6fd44875008e694014ac877

      SHA256

      330b2ceea3d5d39a9539ee98877b4d57d57280511522ac1f2e4bb6ece43ac199

      SHA512

      1de7339eac926620ee426ceda6fee9461e539264337f583239c071606f57e36affd796c5d227c78b410cbfb42f2d5e1d359e086783303f1a9efc58f5c82e1adf

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\485547283.exe

      Filesize

      340KB

      MD5

      9d156bf69b4f3eae5dccc853f76c4b27

      SHA1

      bc1b16f12053b77ce435e6a79499a324428f3d06

      SHA256

      8d14b3dbea71c5b7ce460844f384606c2a17c8daa49572caddb411adc5818c51

      SHA512

      fb1a1a6a77db114b85815e2d0f9dcee703f14e27c966189f034ed1a17aa885ba15bbb757b360c29ff50ff4fd3d235587f18ba9aa8e0eb747c771872aec36b4ac

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cC807446.exe

      Filesize

      577KB

      MD5

      063a858ed09deab28e3c951695a4f136

      SHA1

      492a33c54dec1861a94175322ee3d587e06d0598

      SHA256

      6990acb933cea75d93ca1a75664526a0bdc78c0609ca280fa7e216205816dd99

      SHA512

      bdbcdefc4771c09d177d9d62a7eb125f080da77946f01bf17da436e7d2e89f5109ab9c88ee225e30a114b76f62c885eb576c2e9af764699629dba21b100e6171

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325533682.exe

      Filesize

      204KB

      MD5

      1304f384653e08ae497008ff13498608

      SHA1

      d9a76ed63d74d4217c5027757cb9a7a0d0093080

      SHA256

      2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

      SHA512

      4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS251086.exe

      Filesize

      406KB

      MD5

      a625d108eaedd571c2bcaa7c436a299c

      SHA1

      357b6dc31781fb6f875c8b7c816362b6b43f4518

      SHA256

      2affd01167421df4876bdb3bd35109b5c0ea45a3a707d285a9cde362f30371b5

      SHA512

      e2646ca42b13753c3f0640c6df7a99cb9dbe183774286ea1357f8caf45f2bda507af05b9caeee3e50d91c9adf5af154f59bb9bd9fbab4b0d7ccd9f8d4c7d08e6

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\181482417.exe

      Filesize

      176KB

      MD5

      2b71f4b18ac8214a2bff547b6ce2f64f

      SHA1

      b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

      SHA256

      f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

      SHA512

      33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\282322747.exe

      Filesize

      257KB

      MD5

      eccef80a7156067c3522d665b7af20b4

      SHA1

      f7016057d510cfa94e0fa6e3cf1f3f30e8d3ceee

      SHA256

      0c10395dad710c5bd713852cd01effc8e80f14a3d115f86f1ffed328e423d022

      SHA512

      a03f02ba2bd07ff4b6bc4e0f365cc25baff252cd508919c1d149fd4a88b7a5dee3fe612cbd671a6844f0826b0899cb1a015ebed4611f1b85d7561c41a655ad3a

    • memory/1600-93-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/1956-906-0x0000000009DC0000-0x000000000A3D8000-memory.dmp

      Filesize

      6.1MB

    • memory/1956-907-0x000000000A430000-0x000000000A442000-memory.dmp

      Filesize

      72KB

    • memory/1956-114-0x00000000078C0000-0x00000000078F5000-memory.dmp

      Filesize

      212KB

    • memory/1956-115-0x00000000078C0000-0x00000000078F5000-memory.dmp

      Filesize

      212KB

    • memory/1956-117-0x00000000078C0000-0x00000000078F5000-memory.dmp

      Filesize

      212KB

    • memory/1956-119-0x00000000078C0000-0x00000000078F5000-memory.dmp

      Filesize

      212KB

    • memory/1956-113-0x00000000078C0000-0x00000000078FA000-memory.dmp

      Filesize

      232KB

    • memory/1956-112-0x0000000004C10000-0x0000000004C4C000-memory.dmp

      Filesize

      240KB

    • memory/1956-908-0x000000000A450000-0x000000000A55A000-memory.dmp

      Filesize

      1.0MB

    • memory/1956-909-0x000000000A570000-0x000000000A5AC000-memory.dmp

      Filesize

      240KB

    • memory/1956-910-0x0000000004B10000-0x0000000004B5C000-memory.dmp

      Filesize

      304KB

    • memory/4584-56-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-32-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-31-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-34-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-36-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-38-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-40-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-46-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-58-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-48-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-50-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-52-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-54-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-44-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-42-0x0000000004F50000-0x0000000004F63000-memory.dmp

      Filesize

      76KB

    • memory/4584-30-0x0000000004F50000-0x0000000004F68000-memory.dmp

      Filesize

      96KB

    • memory/4584-29-0x0000000004960000-0x0000000004F04000-memory.dmp

      Filesize

      5.6MB

    • memory/4584-28-0x0000000002180000-0x000000000219A000-memory.dmp

      Filesize

      104KB