Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 05:54

General

  • Target

    8b39e6d4af311568d59944343f965b0fa192c1755ebd0e1b024f9663ab44f7aa.exe

  • Size

    1.5MB

  • MD5

    42b07a74e7d2693bdc1ea80b31eb5584

  • SHA1

    47fff4d53b091553a470f7cfb3737eafe2ba3b94

  • SHA256

    8b39e6d4af311568d59944343f965b0fa192c1755ebd0e1b024f9663ab44f7aa

  • SHA512

    e43c6a287bae6f9d59c5c97dc1eb9d05bf903ae2eda0529250b859744764b7c708a8fa408458bfbe25e092f9fc38faddcae32058a68133952a75024969040c09

  • SSDEEP

    24576:ZyjBwKXZF8thky1QBsAmrcV/GG0CHKfibSrze4vBYJC5Nwz36:MjBw4iLky16sLry/GG0CHbbV4JU8G3

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b39e6d4af311568d59944343f965b0fa192c1755ebd0e1b024f9663ab44f7aa.exe
    "C:\Users\Admin\AppData\Local\Temp\8b39e6d4af311568d59944343f965b0fa192c1755ebd0e1b024f9663ab44f7aa.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\py440955.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\py440955.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Mx436156.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Mx436156.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kl401557.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kl401557.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1772
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\172388869.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\172388869.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1728
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3888
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259020968.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259020968.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:6108
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 248
              6⤵
              • Program crash
              PID:5656
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\312999767.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\312999767.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6732
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3644
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5736
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5644
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4276
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5480
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3088
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:7112
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5316
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\408713290.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\408713290.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:6920
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6920 -s 1252
          4⤵
          • Program crash
          PID:6708
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\589904929.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\589904929.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:6412
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6108 -ip 6108
    1⤵
      PID:5196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6920 -ip 6920
      1⤵
        PID:1728
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:5396
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:3960

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\589904929.exe

              Filesize

              168KB

              MD5

              23bf8277fe81d432902a96d16906735b

              SHA1

              998bd641c8084bf425b2185419f3d91f4cf0dec4

              SHA256

              743b918aa649e9dfb54739b2ac00523fa048d1495dcf1ed3baf6afe5b10b106b

              SHA512

              cd0db15dd275d05d7156842ee3033fdd834c623a321ee476e53dfc400f6bf9f1a3df06e4e815071da554ba2e2b075bfc16ba2087ff92e84a29b55f501e3aadf2

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\py440955.exe

              Filesize

              1.4MB

              MD5

              a640f879c8f532169d47f1183775b687

              SHA1

              8c8c73cd9d4247da2b5584e2ec555daa4c8e1cf2

              SHA256

              fcdba74c828290491698bd849ed8dd95bcb120a6fc7f475cdf079adaa3cfdab8

              SHA512

              3e0e978e0d189d9e1571ef2d89b22e38b7d52b661be67b74303b7d9b3b1aa662b3807eee042a3db7fddd4ec8be4933b390368809d287a699121b4cc35854cf88

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\408713290.exe

              Filesize

              589KB

              MD5

              156aefbb87e5f0b90c8a5beecdff25c1

              SHA1

              5c9277f5da98696271784f1c19bb837815c067dd

              SHA256

              9df98b2d38ca3243a313401fc7da2351e61379e24c19acae43640b62f3074043

              SHA512

              7f5655ce146aaecdffd668c3b7597e26a8e3d0a5e549231e25c36c4ff2ffa321cd98de8f0ea8db6ce04084fc902eea90739809c32170b19484de145124976182

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Mx436156.exe

              Filesize

              888KB

              MD5

              03c6930d8f80cc1e2f7b1d2740414835

              SHA1

              4474a41878ee34da608d06146430fd81725e75cd

              SHA256

              0a6f256a36b61021a5f381cd20e6b098611b373c08640b3c38b8d83babe3324c

              SHA512

              e0bf308db56b3e8e7f13ff8644b4e7543bb0272894410cbb6acbb28de6913018c46734c7965a1950de62c6c43317c0c682d91a3c852d9fdc9a741f56efffe564

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\312999767.exe

              Filesize

              204KB

              MD5

              f9b20c19cc1c412b2b77f379fa037ce8

              SHA1

              b8a1a68d57141c5054fc3296a3c6470269a80e7d

              SHA256

              aea3550c0164e16aec74057964431308f3ad1a2551c9081b7d260b1a009d5237

              SHA512

              a64d83109151d59130081d484470fb0960187af6581fdbc3529f850005e09d56985aee9adad5de3db3f57fad28773d1452a59dfe36260f4bff8002d7f6fc1014

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kl401557.exe

              Filesize

              717KB

              MD5

              0132d7e960e1382e2bf2fc2a33d4431a

              SHA1

              d2d3db9c6e3292d30c8838c52b6a8a3aba6574f8

              SHA256

              1192180fe5b34291873f9a534d0f6683ca6bad70d1ea124ce07d75afaafcfcbd

              SHA512

              db430c8b4e18e126a42ff7cf6995f3efb642e87c8564259e07641fa70ba9916465cb70dc7fd3435e2ff901f64f3f17a6905e6040d4244d58469bb36853794732

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\172388869.exe

              Filesize

              299KB

              MD5

              93a3a0064aac63e2a133a03963bcec38

              SHA1

              0666198966309dfe6393f00938a4d653141171b4

              SHA256

              c4c3ead584394d048144acce5205cc784a9b5d5d11a872125c16606522dbd67a

              SHA512

              f9ea4b5c7ea8be258a5a7b0e34a120849490badf1c41b74f7c7134f63af4c955162179946cd1026e2b1400226e2758b5dd5c652e92a8e07bdb848fc52d851877

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259020968.exe

              Filesize

              528KB

              MD5

              a001a63868e4a433a08da53730f962b8

              SHA1

              cee516372abba590aed5f172e2f56b28591d99d6

              SHA256

              c9e07d1324203441153a4c2f64a8a4c21b1f257a0c0b72ced43bfd4f9b7d8187

              SHA512

              baf180fdfe398e5e25667e7f193f41ea2d14f6a259f27c5407f9e4b3ac5e823f5df57296c37fda5357561baa5a835fcc8b315de4ca2d905099f95bf4434dc68b

            • C:\Windows\Temp\1.exe

              Filesize

              11KB

              MD5

              7e93bacbbc33e6652e147e7fe07572a0

              SHA1

              421a7167da01c8da4dc4d5234ca3dd84e319e762

              SHA256

              850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

              SHA512

              250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

            • memory/1728-80-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-32-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-88-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-84-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-82-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-92-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-78-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-74-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-72-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-70-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-68-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-66-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-62-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-60-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-58-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-56-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-54-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-52-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-48-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-46-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-44-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-42-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-40-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-38-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-34-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-90-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-76-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-64-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-50-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-36-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-31-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-2159-0x00000000052F0000-0x00000000052FA000-memory.dmp

              Filesize

              40KB

            • memory/1728-94-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-86-0x0000000004A00000-0x0000000004A51000-memory.dmp

              Filesize

              324KB

            • memory/1728-28-0x0000000002200000-0x0000000002258000-memory.dmp

              Filesize

              352KB

            • memory/1728-29-0x0000000004BA0000-0x0000000005144000-memory.dmp

              Filesize

              5.6MB

            • memory/1728-30-0x0000000004A00000-0x0000000004A56000-memory.dmp

              Filesize

              344KB

            • memory/3888-2175-0x0000000000D30000-0x0000000000D3A000-memory.dmp

              Filesize

              40KB

            • memory/6108-4305-0x0000000005750000-0x00000000057E2000-memory.dmp

              Filesize

              584KB

            • memory/6412-6480-0x0000000000920000-0x0000000000950000-memory.dmp

              Filesize

              192KB

            • memory/6412-6481-0x0000000005240000-0x0000000005246000-memory.dmp

              Filesize

              24KB

            • memory/6412-6482-0x00000000058B0000-0x0000000005EC8000-memory.dmp

              Filesize

              6.1MB

            • memory/6412-6483-0x00000000053A0000-0x00000000054AA000-memory.dmp

              Filesize

              1.0MB

            • memory/6412-6484-0x00000000052B0000-0x00000000052C2000-memory.dmp

              Filesize

              72KB

            • memory/6412-6485-0x0000000005310000-0x000000000534C000-memory.dmp

              Filesize

              240KB

            • memory/6412-6486-0x0000000005350000-0x000000000539C000-memory.dmp

              Filesize

              304KB

            • memory/6920-4325-0x0000000004D50000-0x0000000004DB8000-memory.dmp

              Filesize

              416KB

            • memory/6920-4326-0x0000000005510000-0x0000000005576000-memory.dmp

              Filesize

              408KB

            • memory/6920-6473-0x0000000005760000-0x0000000005792000-memory.dmp

              Filesize

              200KB