Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:28

General

  • Target

    150946d1162b8bd0fe5762c4ddad719f8474e526861dbd80d2c8b692c3e3326d.exe

  • Size

    1.7MB

  • MD5

    81a373a743b8befc51ff34be236b3e17

  • SHA1

    9e011dc5ed395d29cf42baf96881e076b2343b11

  • SHA256

    150946d1162b8bd0fe5762c4ddad719f8474e526861dbd80d2c8b692c3e3326d

  • SHA512

    d856bbf08b7a4edea6c280003202d48b3813a501cca6503bc6a3a94f5a90534232ce74fb99e5153f1bb4b362993bb68ab3d671c0c8cc73b64a58ce4cb4536b32

  • SSDEEP

    49152:1b6SQ5kMPYW+tB/3Ye1sFdgDPifyMbvl:cSQ5nPYDtBQesnCcyS

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\150946d1162b8bd0fe5762c4ddad719f8474e526861dbd80d2c8b692c3e3326d.exe
    "C:\Users\Admin\AppData\Local\Temp\150946d1162b8bd0fe5762c4ddad719f8474e526861dbd80d2c8b692c3e3326d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GV429637.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GV429637.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xz800572.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xz800572.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dN973663.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dN973663.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3228
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CR577578.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CR577578.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2500
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a32289708.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a32289708.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2516
              • C:\Windows\Temp\1.exe
                "C:\Windows\Temp\1.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Executes dropped EXE
                • Windows security modification
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1908
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74655041.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74655041.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:952
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1264
                7⤵
                • Program crash
                PID:6056
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c26704685.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c26704685.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5892
            • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
              "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:392
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:6140
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3636
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4276
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4876
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1692
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5868
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:N"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4168
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\cb7ae701b3" /P "Admin:R" /E
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5988
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d15998173.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d15998173.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1260
            5⤵
            • Program crash
            PID:6468
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f13088431.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f13088431.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6728
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 952 -ip 952
    1⤵
      PID:5628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4920 -ip 4920
      1⤵
        PID:6400
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:5472
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:6556

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GV429637.exe

        Filesize

        1.4MB

        MD5

        fefb0f202aca16421c1747f03b7996be

        SHA1

        7caa2318f7234594843379782c46330408d5537d

        SHA256

        9e0e6873dc23907c4f63f7cc4055fc6020590fe53a563c9a606e79f51438c035

        SHA512

        63371887988d81f3657d4fd8fc78dc57264d8a198c8ac30ea7442017d33ba40e3990009fd43e1c8c0c3023997694bc136cd8b0fec629e138f993f96fa9a90a2e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f13088431.exe

        Filesize

        168KB

        MD5

        8ef77bd29dc102b48dcd9f76fd3a4b1e

        SHA1

        7f1e8b4869a25686777ce786f3c778903a04b29b

        SHA256

        eb702e46be8dbdf445d628f882a9d706cda18737af6885d6ee1a6bab9c6270ff

        SHA512

        d8b8376277c8d4741815faf04ab7afc2a2cdecd651ed8018ac9ca258a84e6823b5e94cba7527bb4961c6ac67246972b26ea8a340a1c5a9eca111b1292b0a6e08

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xz800572.exe

        Filesize

        1.3MB

        MD5

        53838aa2160f01120bcf224e267c1435

        SHA1

        befa5a09fb1d392b8466b58f87953a07d8a6bd7f

        SHA256

        6094537605964466f766f069117daf2c1346722e71bafafd665d63a3f1f8b195

        SHA512

        02a49787d97d9238508fbb3e6549c2ab03d839c1f67436f63943a046b36c4402c4938a18d4b9a00943671bcb0c26a54b37bc81d6c7fce35f5921f2f64999f45a

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d15998173.exe

        Filesize

        581KB

        MD5

        93630db5de1e01af7b7f5c371775f4c2

        SHA1

        1d1eef55e7be22085ba4661b353fc1911acaf294

        SHA256

        40b9c1b756ed82543dac9d41025ad5d5f408304a73ff8221382bb494c91086bc

        SHA512

        1d2bdc2cb401e0597882be674b70d8526331c09c4766a067766be04378da19a5eade3d13b311716abd9fb67309f90e75c7fdde4167f099209e587a085a26bc80

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dN973663.exe

        Filesize

        851KB

        MD5

        063c768c7d4779d0ece03aac2b7762ab

        SHA1

        bd23e542e2bfb087ccae693aa70e0a94344fb4a6

        SHA256

        a1b34d6df9bd99b540472b4ea24f6babbf54f9fc5ac0bdaf280247452af0fc71

        SHA512

        43b253dfed478ff3adcce26b5985d69f5703d65005cdd6633b6080465a57ba1e69efafd4b453d265b4cf0dcc75eb47d32f166d9d701dd280016a5c2bba7c83cb

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CR577578.exe

        Filesize

        679KB

        MD5

        85d5e787634b45ee0f8ca6a1498ef6a1

        SHA1

        c8dc44398023d5930eb2418c1e4bb38f7879e1bf

        SHA256

        e584a0491c002b70e57df85855d4c297341aa6822b181611121c7271c0f8d814

        SHA512

        6998b07286fdcc8adc3ea7d2c059c2778a174b2aecc15cafc4c5dc35c7ea3036cd4979690cb4c9f583361d8c7ddb83c171dd83a0c7f439c6ea58e96b9d706743

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c26704685.exe

        Filesize

        205KB

        MD5

        beec456a7be999d4b7572ed63cfb4a7b

        SHA1

        846a1b0514211debf77e24fab2a20e58398abbea

        SHA256

        de5a9dea781b22d23dcd55e1aa680142758cdc96b4f7603eab9c32a2919c14e0

        SHA512

        9f1cbff9bb7bbf0a558b4853cc374f346c4c1bd40404c1adfca8998454fa08eef3caa2f81637a276c4a2c6be59d14fcdf24e2acd019146c171d84233af60f6d5

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a32289708.exe

        Filesize

        301KB

        MD5

        e31d74d1deb89480005c9525b721e9c7

        SHA1

        eebeb20f3c64e8042aba2cf4462131fbbe0dabf5

        SHA256

        aa579cfe23f9e69d945378caafee8a716a73b8889ec6f94db81c2f0065847425

        SHA512

        03921ba5054ac5026ef9a6617c2e2903f4a63e6bee781cdac6c5a5f24cb6afc29fb4f0405137a9fad40b1279e9096f2afd9f059aa73b55455f6eb27242179504

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74655041.exe

        Filesize

        521KB

        MD5

        d3e922936e47329777b3847f871b2d74

        SHA1

        b2f844f52ff62d0faf41202f1fb02b69b19e43ab

        SHA256

        7175586f8702c00252ff38efbacee0c8006a4f5a01e3850f36136674c2827a50

        SHA512

        9c79ca0b4a5b03e97e160044dbb77c95fd296fb648eaf190fa227f5071c1f00d25b1758e4cedf68d940eb667fcc5435ce06d3ea25ff24650e953fc186225824c

      • C:\Windows\Temp\1.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • memory/952-4312-0x0000000005750000-0x00000000057E2000-memory.dmp

        Filesize

        584KB

      • memory/1908-2179-0x00000000006B0000-0x00000000006BA000-memory.dmp

        Filesize

        40KB

      • memory/2516-91-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-41-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-95-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-89-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-87-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-85-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-81-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-79-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-77-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-73-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-71-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-69-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-67-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-63-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-61-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-59-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-57-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-53-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-51-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-49-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-47-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-45-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-43-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-93-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-75-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-65-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-55-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-39-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-38-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-2166-0x0000000005430000-0x000000000543A000-memory.dmp

        Filesize

        40KB

      • memory/2516-97-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-99-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-101-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-83-0x0000000004B30000-0x0000000004B81000-memory.dmp

        Filesize

        324KB

      • memory/2516-37-0x0000000004B30000-0x0000000004B86000-memory.dmp

        Filesize

        344KB

      • memory/2516-36-0x0000000004BD0000-0x0000000005174000-memory.dmp

        Filesize

        5.6MB

      • memory/2516-35-0x0000000004A90000-0x0000000004AE8000-memory.dmp

        Filesize

        352KB

      • memory/4920-4333-0x0000000005510000-0x0000000005576000-memory.dmp

        Filesize

        408KB

      • memory/4920-6480-0x0000000005760000-0x0000000005792000-memory.dmp

        Filesize

        200KB

      • memory/4920-4332-0x0000000004D40000-0x0000000004DA8000-memory.dmp

        Filesize

        416KB

      • memory/6728-6486-0x0000000000320000-0x0000000000350000-memory.dmp

        Filesize

        192KB

      • memory/6728-6487-0x0000000004C00000-0x0000000004C06000-memory.dmp

        Filesize

        24KB

      • memory/6728-6488-0x0000000005360000-0x0000000005978000-memory.dmp

        Filesize

        6.1MB

      • memory/6728-6489-0x0000000004EB0000-0x0000000004FBA000-memory.dmp

        Filesize

        1.0MB

      • memory/6728-6490-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

        Filesize

        72KB

      • memory/6728-6491-0x0000000004E40000-0x0000000004E7C000-memory.dmp

        Filesize

        240KB

      • memory/6728-6492-0x0000000004FC0000-0x000000000500C000-memory.dmp

        Filesize

        304KB