Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 02:05

General

  • Target

    585665a722a8f8379ff1ce6e13350e33509592ee2e0cb2aa356ba11d86b1c5df.exe

  • Size

    1.1MB

  • MD5

    655a29e810848e61b376835243a7772f

  • SHA1

    83e9c7234c41f7233903535cd30bcefbcd710955

  • SHA256

    585665a722a8f8379ff1ce6e13350e33509592ee2e0cb2aa356ba11d86b1c5df

  • SHA512

    037c5ff70115cf044b2d7d13e30686733a4f207acdb44f88397ea17c1505580001846c575cb6575f13513ffb18ba8c3f4d93277c53ce23a1dc7c5ff98055507e

  • SSDEEP

    24576:jyyk15XHcSRDs/FWehWq+f8O2M3Dc+dUJcvmnWDpwL7s:2yi53c+g/c4Wq+0O1m2xiH

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 34 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\585665a722a8f8379ff1ce6e13350e33509592ee2e0cb2aa356ba11d86b1c5df.exe
    "C:\Users\Admin\AppData\Local\Temp\585665a722a8f8379ff1ce6e13350e33509592ee2e0cb2aa356ba11d86b1c5df.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ew518644.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ew518644.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jc179336.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jc179336.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TV097313.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TV097313.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\101907103.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\101907103.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2868
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\282295760.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\282295760.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1084
              6⤵
              • Program crash
              PID:1920
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320881375.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320881375.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:864
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4776
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2200
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2168
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5012
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2076
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3496
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1312
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2452
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\481328904.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\481328904.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4816 -ip 4816
    1⤵
      PID:2440
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:5928
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ew518644.exe

      Filesize

      994KB

      MD5

      5ca355e29a78b7d8ef365b89b48f15c6

      SHA1

      a5c0d53d4d879caea67b1438d68892eda2808ea2

      SHA256

      5c219198dd8647621b4c5fb9db16d6043d45988802be6ab62e2c91382feea344

      SHA512

      42f9bad8005a916cf3bc93b5856c9af95c044ce253836e496d88e0ef73168b577765f63666766cbc32217d29ef7f6cb3c4e6432f0326dfde4527993fabb595e9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\481328904.exe

      Filesize

      415KB

      MD5

      4ea5a50f124e3485cfe32afda4481f3c

      SHA1

      508979a5e0226cfcdaed6516fd0765ef3ea7536d

      SHA256

      f3db0b1699c3963e13455e86bcffa9ed80314540cdc7626a08ce64dbcbc165b6

      SHA512

      a68912d18bbcd134bba402b65fd641e7d13463f36a0d2b3382e1996abdaad1b54b1451460fc6281c1344cc11f36bfa523a087bb38118084edf969f50a8bd9ca2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jc179336.exe

      Filesize

      610KB

      MD5

      18eb1f12f573e87c0a058079f00e45fd

      SHA1

      7d8857f0218df706e9562f3a788c529e16acd0b2

      SHA256

      f7ff46be5c41622499a18a1a8b2134085a1dc0ba7cabb6a6893864654362f68c

      SHA512

      720dd7c07fa65b9b24f959946b82b77f83364cdc105158eeab6706648a928951e5dbbd74de0c2a15fdddb6968024c3e007d64239c3a04fc99fd2ba8fd36c2bbb

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320881375.exe

      Filesize

      204KB

      MD5

      7df57dcba83df3af2f1c4cc565c3986c

      SHA1

      83d478c1fe41df3c890c9fd164b1f32739080806

      SHA256

      90b6cf8add819b6251c2cea77d34d5c1f8c96847bc9964cc636773bd872bdb8f

      SHA512

      747f10202e8cfa5cd30234e2b75371eadce9c7f996ee71781e099f811c3467cb875a7c77d5573649da33125beee85f89bbd06938010fd817350b68f412e40d88

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TV097313.exe

      Filesize

      438KB

      MD5

      b73e1dfa7a91802f3fb472123dce8872

      SHA1

      d8c0084ddb86521540b9ba4241a7a827603454b4

      SHA256

      c24420e3db14750462ba45829981e64f6f0813cb34c03df3a30c5a5f499b05ad

      SHA512

      365cebed67c33e656e090d122501971a6c84f8c35653fcc4e4724d187416807474c9799ae6c288a1e12bc3dee89d81ddfe4f4d0f053f5e34e9627dcb5d8635ff

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\101907103.exe

      Filesize

      176KB

      MD5

      7333397feae6baa380ead8d6bf035007

      SHA1

      01e32041cb37ecfa297857587ef5254bc7a76186

      SHA256

      10515b65e1755f55d9f349388168bf8d72476e2aa01e1ab573e46fcaede94c7f

      SHA512

      99e1c0ddc35a085a7e8134549cf00caf3eab324b5cae233eb6dbfcc904b372f29cbb17c253a595e8660b016deacc541b74925d7ad5462b1af4bb9043972e54ef

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\282295760.exe

      Filesize

      333KB

      MD5

      4e0d6942be6933fb18886c46b5f27035

      SHA1

      28c79a77bd47ff981e82d4e2d5112aa1dfc8369b

      SHA256

      74aea0fe8a12623d3593c31aacb182f0fae549374c6a82cec07dad599e91d876

      SHA512

      82e8771787aaee2ddaf0116496e0b6d7ce93e50b43acf042c64c8e3c2873be3594244707ff5c2fe2c6c4d0c69207477af0fa785f44ab57a2770c85ef77cbfeb2

    • memory/2256-114-0x00000000024B0000-0x00000000024EC000-memory.dmp

      Filesize

      240KB

    • memory/2256-115-0x0000000004A50000-0x0000000004A8A000-memory.dmp

      Filesize

      232KB

    • memory/2256-912-0x0000000004510000-0x000000000455C000-memory.dmp

      Filesize

      304KB

    • memory/2256-911-0x0000000007D40000-0x0000000007D7C000-memory.dmp

      Filesize

      240KB

    • memory/2256-910-0x0000000007C20000-0x0000000007D2A000-memory.dmp

      Filesize

      1.0MB

    • memory/2256-909-0x0000000007C00000-0x0000000007C12000-memory.dmp

      Filesize

      72KB

    • memory/2256-908-0x0000000007550000-0x0000000007B68000-memory.dmp

      Filesize

      6.1MB

    • memory/2256-116-0x0000000004A50000-0x0000000004A85000-memory.dmp

      Filesize

      212KB

    • memory/2256-117-0x0000000004A50000-0x0000000004A85000-memory.dmp

      Filesize

      212KB

    • memory/2256-121-0x0000000004A50000-0x0000000004A85000-memory.dmp

      Filesize

      212KB

    • memory/2256-119-0x0000000004A50000-0x0000000004A85000-memory.dmp

      Filesize

      212KB

    • memory/2868-31-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-50-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-42-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-40-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-38-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-36-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-34-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-32-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-48-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-28-0x00000000048C0000-0x00000000048DA000-memory.dmp

      Filesize

      104KB

    • memory/2868-46-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-29-0x00000000049E0000-0x0000000004F84000-memory.dmp

      Filesize

      5.6MB

    • memory/2868-30-0x0000000004980000-0x0000000004998000-memory.dmp

      Filesize

      96KB

    • memory/2868-44-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-58-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-56-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-54-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/2868-52-0x0000000004980000-0x0000000004993000-memory.dmp

      Filesize

      76KB

    • memory/4816-65-0x00000000049D0000-0x00000000049E8000-memory.dmp

      Filesize

      96KB

    • memory/4816-89-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-79-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-77-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-75-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-71-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-83-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-85-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-87-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-81-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-91-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-93-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-69-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-66-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-64-0x0000000002240000-0x000000000225A000-memory.dmp

      Filesize

      104KB

    • memory/4816-67-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-73-0x00000000049D0000-0x00000000049E2000-memory.dmp

      Filesize

      72KB

    • memory/4816-94-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

    • memory/4816-96-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB