Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:47

General

  • Target

    10dac7fe57ac8ad9bfdf5655b3b23bfdc37b33a484c4534ed0af427ed1eb694c.exe

  • Size

    1.1MB

  • MD5

    3581d516caa760da2b6e2d2f4dc42724

  • SHA1

    f0de9606239979e72e2267fb82ea26b52f079b9c

  • SHA256

    10dac7fe57ac8ad9bfdf5655b3b23bfdc37b33a484c4534ed0af427ed1eb694c

  • SHA512

    95328cc8a7bf13e29a6a7bc0d1e0bb629b90f549212f6765ac549a2df0f992c5e3a3480e982f3c0886ca21caf1b13ff25adce2307d6747d3ba5e796253d1ec77

  • SSDEEP

    24576:ByDSCn+PfxlJt7APNcXpaihEfHdjy3UPmxc2aIp8Np:0DSO+TJtsUpxEfY3fxcWON

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10dac7fe57ac8ad9bfdf5655b3b23bfdc37b33a484c4534ed0af427ed1eb694c.exe
    "C:\Users\Admin\AppData\Local\Temp\10dac7fe57ac8ad9bfdf5655b3b23bfdc37b33a484c4534ed0af427ed1eb694c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MU611382.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MU611382.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gb364083.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gb364083.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ys238415.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ys238415.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\125528890.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\125528890.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1172
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\212157644.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\212157644.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 1080
              6⤵
              • Program crash
              PID:4200
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\350580972.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\350580972.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2776
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4504
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2584
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2672
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3444
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2656
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3316
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1980
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1400
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2768
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\408128415.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\408128415.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4044 -ip 4044
    1⤵
      PID:3552
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:5312
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:5116

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MU611382.exe

            Filesize

            939KB

            MD5

            59d1181720e0e9965146f9e5df462108

            SHA1

            534840fd89a2907f99e94abca69e0416abace5d5

            SHA256

            c90f26157ed1941c88021231e060ed0b72d91b615eac9cfd5ffd0374c6702257

            SHA512

            bd0f28c2f135106a706e1158e4fb18bfc216131c63b7f357cbd7f1193ad7bdee3be16c818d299d58eeaff0560639fe6c3dd6230ad273aa1c218191e98cdb9d06

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\408128415.exe

            Filesize

            341KB

            MD5

            491c95b7501e5a46b83ae4fefeb1ddba

            SHA1

            43666d831baa487f717006b4aea71732adec97a5

            SHA256

            b752539d56b203ff29035a2ebcb1d94b82fbcc5a606a0158a8afee5ad89de2e4

            SHA512

            846749aa6cce5206e605e48b0e548aba9fb479aeb2738b0873dc01f17c1a7f2beced1286a409bbbac4116a7b5bf5258a6bbca9b062a24f99e0cffa484e795435

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gb364083.exe

            Filesize

            586KB

            MD5

            a60f832bf3d0443917ea1a368895b7bc

            SHA1

            f4ac687dad7a35d28804e71bf9aa4bc1d2af0cf6

            SHA256

            ba0ee5f1d290e6c0941397e25c53c0f4a170349a192451f2881ac1827881b33c

            SHA512

            e5e8e46d2a566926b9699941762584575be8011f11e87701358c686bb25a1606b2fd3ada03f55d0f5aa7d9bdba6d73a962c61cf53fce8d8f450d9d523dd336ec

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\350580972.exe

            Filesize

            204KB

            MD5

            1304f384653e08ae497008ff13498608

            SHA1

            d9a76ed63d74d4217c5027757cb9a7a0d0093080

            SHA256

            2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

            SHA512

            4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ys238415.exe

            Filesize

            414KB

            MD5

            cc05a6f5f93ace9169e7d924c6b48ad8

            SHA1

            d491703c1cfe1c1a533256215128de0c5bb4ff66

            SHA256

            49aec91677f5a640e72ea5535fa97cca2841722eba0c05d8ec7d5eb6579093ab

            SHA512

            10de92ef21ccc261bc175cf063d6125c82f4e9579c9384bcea0a0b50fbd79fca31c1ff0ccff1a5ada3b43e72e4d0402c564ff85c9726b22128ad373a89bbb169

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\125528890.exe

            Filesize

            175KB

            MD5

            a165b5f6b0a4bdf808b71de57bf9347d

            SHA1

            39a7b301e819e386c162a47e046fa384bb5ab437

            SHA256

            68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

            SHA512

            3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\212157644.exe

            Filesize

            259KB

            MD5

            2c05755d85151c282a93eae23ec9968f

            SHA1

            5e06c98abddb97abfbef43fd7a87710644d3b215

            SHA256

            a236b142cb0c80cfff5c446be139cc15166f27d82d13151ade14a77e30381626

            SHA512

            4bf93da62d734af608df603df840d5c82386ad75cceeb16fd10089dd12cc18672f0091a51d371e313e6ea5a5fc6d2b1cc8f6294b690c6ade23f68e4d8c5166fe

          • memory/1172-36-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-30-0x0000000002320000-0x0000000002338000-memory.dmp

            Filesize

            96KB

          • memory/1172-54-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-52-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-50-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-48-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-46-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-44-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-42-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-40-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-38-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-31-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-34-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-32-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-57-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-58-0x0000000002320000-0x0000000002333000-memory.dmp

            Filesize

            76KB

          • memory/1172-28-0x0000000002180000-0x000000000219A000-memory.dmp

            Filesize

            104KB

          • memory/1172-29-0x0000000004B20000-0x00000000050C4000-memory.dmp

            Filesize

            5.6MB

          • memory/3992-115-0x0000000004A40000-0x0000000004A75000-memory.dmp

            Filesize

            212KB

          • memory/3992-112-0x0000000002560000-0x000000000259C000-memory.dmp

            Filesize

            240KB

          • memory/3992-113-0x0000000004A40000-0x0000000004A7A000-memory.dmp

            Filesize

            232KB

          • memory/3992-119-0x0000000004A40000-0x0000000004A75000-memory.dmp

            Filesize

            212KB

          • memory/3992-117-0x0000000004A40000-0x0000000004A75000-memory.dmp

            Filesize

            212KB

          • memory/3992-114-0x0000000004A40000-0x0000000004A75000-memory.dmp

            Filesize

            212KB

          • memory/3992-906-0x0000000007560000-0x0000000007B78000-memory.dmp

            Filesize

            6.1MB

          • memory/3992-907-0x0000000007BF0000-0x0000000007C02000-memory.dmp

            Filesize

            72KB

          • memory/3992-908-0x0000000007C10000-0x0000000007D1A000-memory.dmp

            Filesize

            1.0MB

          • memory/3992-909-0x0000000007D30000-0x0000000007D6C000-memory.dmp

            Filesize

            240KB

          • memory/3992-910-0x00000000024D0000-0x000000000251C000-memory.dmp

            Filesize

            304KB

          • memory/4044-92-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/4044-94-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB