Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:23

General

  • Target

    31d0d0eb5a1e7982dd0e55dd7d772abdea1ede74efae9ad71245d2a0a7e99dfb.exe

  • Size

    1.7MB

  • MD5

    db2a1404027d32d2935364c83532671b

  • SHA1

    17900888cdf49da8b61ef38dfa1109c9c5ee05fd

  • SHA256

    31d0d0eb5a1e7982dd0e55dd7d772abdea1ede74efae9ad71245d2a0a7e99dfb

  • SHA512

    8f8a35554f1fce5d2353e9b8bd66db63f48ddd63c163e7022eb2662f84c057634d6a94815d8ddbbee4acd89d129dd696299ae8bfb1b11a20ed0bef2403ea13af

  • SSDEEP

    24576:TyCm1/92/Q9oldunAbICta3/7yvKmDA7ei7Mhno8JbIXbDIZy/eolrtLbTdBuWlG:mLJ/euAbftQ/mSm0eisnTZynJXBcY

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31d0d0eb5a1e7982dd0e55dd7d772abdea1ede74efae9ad71245d2a0a7e99dfb.exe
    "C:\Users\Admin\AppData\Local\Temp\31d0d0eb5a1e7982dd0e55dd7d772abdea1ede74efae9ad71245d2a0a7e99dfb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4200
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LH247275.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LH247275.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CR649435.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CR649435.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pv051029.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pv051029.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\QE766986.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\QE766986.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2316
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a61549336.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a61549336.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3036
              • C:\Windows\Temp\1.exe
                "C:\Windows\Temp\1.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Executes dropped EXE
                • Windows security modification
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2388
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61440764.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61440764.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4280
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 1260
                7⤵
                • Program crash
                PID:1100
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c49896094.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c49896094.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5000
            • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
              "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1740
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5280
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5076
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:6472
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:6440
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4304
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5952
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5372
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4212
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d20787189.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d20787189.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2868
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1252
            5⤵
            • Program crash
            PID:4484
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f26946966.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f26946966.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3032
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4280 -ip 4280
    1⤵
      PID:5324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2868 -ip 2868
      1⤵
        PID:3736
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6264
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:4284
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:3884
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:712

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LH247275.exe

        Filesize

        1.4MB

        MD5

        337b22bb9e10d325a6aee96939d3d185

        SHA1

        39a0a12b9a0c02b1fc291050d3b0ba18b06537f2

        SHA256

        ad2efa35b73db58795b841d713f9e2f804a1ac6a9731b16d6a7e3b54c16d4a5b

        SHA512

        7e81286fe4fc5781144b98c4c02ea0c95213e1355fca583e4d6c4eba4c3dd1db40d947bc6f286fab4ce54d07531c230aadd8af446f87d585633a75fb3febe4cf

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CR649435.exe

        Filesize

        1.3MB

        MD5

        213eb6f14f0cec42a512e843e2eaf2e4

        SHA1

        f9faa3bf033976e6acc7115d57877abf8b6e4789

        SHA256

        a3f9b5ecd601403fa41377f2276b73449ea7c20e1bdf972cc606c9e8d9522b38

        SHA512

        3e499cbf47a4b33ae2078e8119b9cabb8a84ce844224c93ed98e70cf464b4afc0bbcbe500ddef1777a808bb1a2c20effe164e84963cc93731639b40a5d101c40

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f26946966.exe

        Filesize

        169KB

        MD5

        b9eb4c503b8bc54b126b72a7eeeb03f6

        SHA1

        ff4ecf0bcee88283e8ce5cdcfe8259ea1adc23b6

        SHA256

        cd78ec7ad93ae75e554c8f6271374e0472b32d55491fb15e43e07383c5ce8d71

        SHA512

        b23f91dc6566e46c3d9802742bee97c8a1c3c437083ce45e0c253af87e14a4e14cb25cf739d4dcb6502841efd9278155cb732d457f607f435ba05fbeab392ffa

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d20787189.exe

        Filesize

        576KB

        MD5

        b8374592f0c90494edf1a5625389803b

        SHA1

        dcaa5d6a1a808c565eb54ee94ceebf8889e7cfd1

        SHA256

        a9271b51b8a550b8b95741c5ac66b242d0afb0c13e02e7df95c4207cf62c482a

        SHA512

        e3c27adf6d16185f3c2de72ac2a8704c663f6e88451a1a1cadd4d2fc6d1723549123ceaaed973ff32c3f735bc41f44e9f8cab0229350e58743a54e19f0b03eeb

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pv051029.exe

        Filesize

        850KB

        MD5

        53d3bd036dcefa7dd716268632521f75

        SHA1

        0b6f9b6025c3730ad61a084b420034558d9bb6f2

        SHA256

        a61e4916ab352195466bc9cc404cc32195d100ce635d0fd0214c322a1a08ba86

        SHA512

        f8b4492684af206f58a932d7fb04ad52664f2a3cdb9dc4d580cbad5ac2cd6f13753300b3d05b270a67da137029b9eea44896d3d945c50fff45c8c068ef94ab89

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\QE766986.exe

        Filesize

        679KB

        MD5

        7dc694a921da4aef5e179799a3e9c22b

        SHA1

        a684d704eb57db68f8e9d322a6bfb91ea5f8995f

        SHA256

        2b9319f34a9adb1f0e0885fab01212a66e7c04b10d7b95649b9010daa390d2b8

        SHA512

        7aaae7ff1984a93a8e000f2ac5e7ea033b83bbff07e685f3b0242822c4a762dcaefa545307700365863e2a5f88b3452974a9f99c458fb7e4c05969778d3f6d75

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c49896094.exe

        Filesize

        205KB

        MD5

        a563b7e1b2f741bf35566004e35bb156

        SHA1

        2d9f24b865d091aa356a3ab60594b88c745717e8

        SHA256

        49feecf2def8a7f8268f34c32b5320c85776a168603202728be4d856dd6d5699

        SHA512

        132ba9b6cc6be6b8ef4f935d1d2e3a48a0924478df322d1b010dc437b9652339112ec418e6834a83380b17e5ea46e5362317b0c15be404c27bab4106b71ac6f2

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a61549336.exe

        Filesize

        302KB

        MD5

        4a67efd9cb4273ff5c1263481f6628e8

        SHA1

        9c374d439cc875b0529206662b8bf22ecdaa1eaa

        SHA256

        7946f183b63bf1ba3e71156679030d5d164fa580a786f499ec8acff8c1d61f13

        SHA512

        9e4fc724dd2572cc2fcaa1802487cabbdf5c8e5ed7e5a648dccbda7b649ea3beaa08d32be164ef5b76f09ee5f6e00983cc5bb39a325fa962895cc5dfc6bba5fc

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b61440764.exe

        Filesize

        516KB

        MD5

        f17c6199c7b1d169a1c80c9e3df33fed

        SHA1

        93848fbc4a1818dd541cf0af58bbf3e5bc9bcce7

        SHA256

        3096c4392c6801e078ec40b77b8d3016d78baf9d15a5862618395290fdbf9d33

        SHA512

        92448749175fd6bfe811b680746723b8a8cf3ad87136498a2da3505d16f48ff156dfd4a5930faa81507cae6ebfbad437dafe6a590cd33095864a0d6e0e64e98d

      • C:\Windows\Temp\1.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • memory/2388-2180-0x0000000000B30000-0x0000000000B3A000-memory.dmp

        Filesize

        40KB

      • memory/2868-4332-0x0000000002790000-0x00000000027F8000-memory.dmp

        Filesize

        416KB

      • memory/2868-4333-0x0000000004F80000-0x0000000004FE6000-memory.dmp

        Filesize

        408KB

      • memory/2868-6480-0x0000000005760000-0x0000000005792000-memory.dmp

        Filesize

        200KB

      • memory/3032-6493-0x00000000026E0000-0x000000000272C000-memory.dmp

        Filesize

        304KB

      • memory/3032-6486-0x00000000004F0000-0x0000000000520000-memory.dmp

        Filesize

        192KB

      • memory/3032-6487-0x0000000002680000-0x0000000002686000-memory.dmp

        Filesize

        24KB

      • memory/3032-6488-0x000000000A930000-0x000000000AF48000-memory.dmp

        Filesize

        6.1MB

      • memory/3032-6489-0x000000000A490000-0x000000000A59A000-memory.dmp

        Filesize

        1.0MB

      • memory/3032-6490-0x000000000A3C0000-0x000000000A3D2000-memory.dmp

        Filesize

        72KB

      • memory/3032-6491-0x000000000A420000-0x000000000A45C000-memory.dmp

        Filesize

        240KB

      • memory/3036-93-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-38-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-71-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-69-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-67-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-65-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-63-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-61-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-59-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-57-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-55-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-53-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-51-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-49-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-47-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-45-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-43-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-41-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-39-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-73-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-2166-0x0000000002580000-0x000000000258A000-memory.dmp

        Filesize

        40KB

      • memory/3036-75-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-77-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-79-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-35-0x00000000049E0000-0x0000000004A38000-memory.dmp

        Filesize

        352KB

      • memory/3036-81-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-83-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-87-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-91-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-95-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-97-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-99-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-101-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-85-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-89-0x0000000004A40000-0x0000000004A91000-memory.dmp

        Filesize

        324KB

      • memory/3036-37-0x0000000004A40000-0x0000000004A96000-memory.dmp

        Filesize

        344KB

      • memory/3036-36-0x0000000004B50000-0x00000000050F4000-memory.dmp

        Filesize

        5.6MB

      • memory/4280-4312-0x0000000005880000-0x0000000005912000-memory.dmp

        Filesize

        584KB