Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:42

General

  • Target

    94cbe1829ceae60d3d72c9ea945b5ee51520876c171e1ec74a31dcc60979b712.exe

  • Size

    1.1MB

  • MD5

    9973e4d0cb60ad15585380a3570d4888

  • SHA1

    f4bde7fc25314ad3943ea3b714164c1314ac98d4

  • SHA256

    94cbe1829ceae60d3d72c9ea945b5ee51520876c171e1ec74a31dcc60979b712

  • SHA512

    cc37890240186838134b51810ec22817e20ef83cd95b6093e062074d7a4ea933d07429d534ad8c9c67045a0d5108503e68f297951328065e35d3f62cca695b9b

  • SSDEEP

    24576:uyhab25wRDZYUJ+6xG9LpbZHN3Ycd52DrZ575qfFbo:9hab2SA6vGJFZH172/Z51q

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 34 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94cbe1829ceae60d3d72c9ea945b5ee51520876c171e1ec74a31dcc60979b712.exe
    "C:\Users\Admin\AppData\Local\Temp\94cbe1829ceae60d3d72c9ea945b5ee51520876c171e1ec74a31dcc60979b712.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY597826.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY597826.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BA113132.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BA113132.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\BO037891.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\BO037891.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3900
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\102536992.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\102536992.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5000
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216299277.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216299277.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:408
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 1076
              6⤵
              • Program crash
              PID:4956
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\333603298.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\333603298.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:372
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4600
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1856
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3080
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4536
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4984
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4192
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2912
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3116
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2644
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\420868863.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\420868863.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5020
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 408 -ip 408
    1⤵
      PID:1040
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:2764
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:1424

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY597826.exe

            Filesize

            993KB

            MD5

            356c487c96721146a63f2e8040391a57

            SHA1

            c838abd0801657e7c6a416fb00fdf46d0b6e1974

            SHA256

            485bf05fc539627ba3cf4e0da08d888ee51536dc40e478d13a81691d3478a614

            SHA512

            45e7e2fc644f11d31aecf9ebbf6b39eac887f0ff7520c249e9d47a3495be288ab125d5a2c98181110165ceb9592729ebde75bf85b5e966b87ecb9d376345a5ee

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\420868863.exe

            Filesize

            415KB

            MD5

            408555640538f3bba3572e284e29e584

            SHA1

            eb4b9baaa7b9de5bd9fa60fd312cb66c0b86bb42

            SHA256

            febcd65c7e03525f5c67b59672157aa92013fbe75929701ca609bea61140642c

            SHA512

            b2e9aeb955eaa997e4c73770bb128ac18efbdf30eb4111ebca0f6a48f881394f76599aa547f244671336cdf3f4aed67551d8d48895160101adc4fce6c2098bcf

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BA113132.exe

            Filesize

            609KB

            MD5

            85fecf6b72058f5c000364e13cddf1d8

            SHA1

            0cc30c18cce141af5bcaf5203c47bafd2e96bad2

            SHA256

            1bbbba64338563c7db060a0c9b4372792b7c2c081cf0086f8f6d1424b5e4efbd

            SHA512

            556f3dc4780383b16bf594dea295aa40abbe6a5924dea28a8649dc4ee118f9c567e5a4afb305fc0a9d9117f79eb9b02fa1e48bccdfc812867dce5683df2a16d3

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\333603298.exe

            Filesize

            204KB

            MD5

            74868a83e0d9cd4ef927bb51c929db13

            SHA1

            614e37c314bb4c635cae2be6419566687bfda3aa

            SHA256

            65bf2557142ec07761a872f6734bb13e27fe54acceba7efd728c745fc277eb6b

            SHA512

            8bdcc0a912bc192c22fad5184990d8e2cb029ce34410cb4a5871d966232c3ba399d77271645f0cbbb82e88f066e505be0f78d526d5694fc63845e878638b68d2

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\BO037891.exe

            Filesize

            437KB

            MD5

            15dee508636f87b626b7ff0960e22579

            SHA1

            45758d6cf96855e6c745c5449f4879d6fd787fe1

            SHA256

            39b2ec824c7ce37e845800635ff31686633f4716cdc7ef2a39a250477ae6a175

            SHA512

            b7067f135fa35ed69d01b8bb04dfdcda67d0d051d7bf6c6529c50e255feea37e866b458694541dcdad149410b86490162616002d69ed9e5f848c2ebefdc7c6b6

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\102536992.exe

            Filesize

            175KB

            MD5

            7cde207e539b3d05abea96e4db24fea9

            SHA1

            a147baa9c33cfbe6239c0ad52a399f2b0a1974af

            SHA256

            d805d69423832ad21f12b957f56d5bcc4334b791233a5b0e789aeebe9dbe69bc

            SHA512

            a00b233ddbf255d44a7fc376bc8e34f92a7eab3c085f5548f4ccdbeabf33c59e8d4d622182136bafd4f261148cca0f7c5e30615d67c92a023b3d1740e8bf4ad6

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216299277.exe

            Filesize

            332KB

            MD5

            90fdccedec8ddffabd7ea43c6eae08ff

            SHA1

            42ff695eb40dd477770fe5f31d64fa17d441b697

            SHA256

            384b7b43931e84103447cb2ccab215bc9f949417990123ea24df54b408ce75b3

            SHA512

            5cd54e0394b2814bc6eac8ef0287a9c4ad8130fccaec5145d5cb02e4905b3e862766820b8b4e7f8f3279ee3c139c557c43fe3cad6a14fdd373464612dff17d9c

          • memory/408-66-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-96-0x0000000000400000-0x0000000000466000-memory.dmp

            Filesize

            408KB

          • memory/408-94-0x0000000000400000-0x0000000000466000-memory.dmp

            Filesize

            408KB

          • memory/408-67-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-69-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-71-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-73-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-75-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-77-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-79-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-81-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-87-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-89-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-91-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-93-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-85-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/408-64-0x0000000002240000-0x000000000225A000-memory.dmp

            Filesize

            104KB

          • memory/408-65-0x0000000002390000-0x00000000023A8000-memory.dmp

            Filesize

            96KB

          • memory/408-83-0x0000000002390000-0x00000000023A2000-memory.dmp

            Filesize

            72KB

          • memory/5000-56-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-46-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-42-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-32-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-34-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-36-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-38-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-40-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-45-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-58-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-48-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-50-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-54-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-30-0x00000000024B0000-0x00000000024C8000-memory.dmp

            Filesize

            96KB

          • memory/5000-31-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-29-0x0000000004A50000-0x0000000004FF4000-memory.dmp

            Filesize

            5.6MB

          • memory/5000-52-0x00000000024B0000-0x00000000024C3000-memory.dmp

            Filesize

            76KB

          • memory/5000-28-0x00000000008D0000-0x00000000008EA000-memory.dmp

            Filesize

            104KB

          • memory/5020-115-0x0000000002650000-0x000000000268A000-memory.dmp

            Filesize

            232KB

          • memory/5020-114-0x0000000002390000-0x00000000023CC000-memory.dmp

            Filesize

            240KB

          • memory/5020-121-0x0000000002650000-0x0000000002685000-memory.dmp

            Filesize

            212KB

          • memory/5020-119-0x0000000002650000-0x0000000002685000-memory.dmp

            Filesize

            212KB

          • memory/5020-117-0x0000000002650000-0x0000000002685000-memory.dmp

            Filesize

            212KB

          • memory/5020-116-0x0000000002650000-0x0000000002685000-memory.dmp

            Filesize

            212KB

          • memory/5020-908-0x0000000007570000-0x0000000007B88000-memory.dmp

            Filesize

            6.1MB

          • memory/5020-909-0x0000000007C00000-0x0000000007C12000-memory.dmp

            Filesize

            72KB

          • memory/5020-910-0x0000000007C20000-0x0000000007D2A000-memory.dmp

            Filesize

            1.0MB

          • memory/5020-911-0x0000000007D40000-0x0000000007D7C000-memory.dmp

            Filesize

            240KB

          • memory/5020-912-0x0000000002580000-0x00000000025CC000-memory.dmp

            Filesize

            304KB