Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 12:08
Static task
static1
General
-
Target
1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe
-
Size
578KB
-
MD5
3c8c7a7204f2526c0c40f8b929d52506
-
SHA1
478d3bbf33a4c2d2d5e545a31084307f7595d871
-
SHA256
1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023
-
SHA512
36fcf91c5e922e29baaca9bebda225fe0dba603e22955bf0f4c29aee69d8320f72cc79864a546b88c4a29e89190eaf8425c7cc8938631d5377ef7fc7d7bd7404
-
SSDEEP
12288:gy90PcjI+Hdubtp1rGXA6Vmp79TAVlSusoKG:gyTEY+1rGXACIAVRsoKG
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4120-15-0x0000000002410000-0x000000000242A000-memory.dmp healer behavioral1/memory/4120-19-0x0000000004AD0000-0x0000000004AE8000-memory.dmp healer behavioral1/memory/4120-47-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-45-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-43-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-41-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-39-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-37-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-35-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-33-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-31-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-29-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-27-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-25-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-23-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-21-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer behavioral1/memory/4120-20-0x0000000004AD0000-0x0000000004AE3000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 200823871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 200823871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 200823871.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 200823871.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 200823871.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 360515814.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 2132 qV779626.exe 4120 144293384.exe 1544 200823871.exe 1148 360515814.exe 3360 oneetx.exe 2872 oneetx.exe 4340 oneetx.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 144293384.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 200823871.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" qV779626.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 924 1544 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200823871.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 144293384.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360515814.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qV779626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2996 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4120 144293384.exe 4120 144293384.exe 1544 200823871.exe 1544 200823871.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4120 144293384.exe Token: SeDebugPrivilege 1544 200823871.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1148 360515814.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 820 wrote to memory of 2132 820 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe 83 PID 820 wrote to memory of 2132 820 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe 83 PID 820 wrote to memory of 2132 820 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe 83 PID 2132 wrote to memory of 4120 2132 qV779626.exe 84 PID 2132 wrote to memory of 4120 2132 qV779626.exe 84 PID 2132 wrote to memory of 4120 2132 qV779626.exe 84 PID 2132 wrote to memory of 1544 2132 qV779626.exe 95 PID 2132 wrote to memory of 1544 2132 qV779626.exe 95 PID 2132 wrote to memory of 1544 2132 qV779626.exe 95 PID 820 wrote to memory of 1148 820 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe 100 PID 820 wrote to memory of 1148 820 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe 100 PID 820 wrote to memory of 1148 820 1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe 100 PID 1148 wrote to memory of 3360 1148 360515814.exe 101 PID 1148 wrote to memory of 3360 1148 360515814.exe 101 PID 1148 wrote to memory of 3360 1148 360515814.exe 101 PID 3360 wrote to memory of 2996 3360 oneetx.exe 102 PID 3360 wrote to memory of 2996 3360 oneetx.exe 102 PID 3360 wrote to memory of 2996 3360 oneetx.exe 102 PID 3360 wrote to memory of 908 3360 oneetx.exe 104 PID 3360 wrote to memory of 908 3360 oneetx.exe 104 PID 3360 wrote to memory of 908 3360 oneetx.exe 104 PID 908 wrote to memory of 4268 908 cmd.exe 106 PID 908 wrote to memory of 4268 908 cmd.exe 106 PID 908 wrote to memory of 4268 908 cmd.exe 106 PID 908 wrote to memory of 2348 908 cmd.exe 107 PID 908 wrote to memory of 2348 908 cmd.exe 107 PID 908 wrote to memory of 2348 908 cmd.exe 107 PID 908 wrote to memory of 216 908 cmd.exe 108 PID 908 wrote to memory of 216 908 cmd.exe 108 PID 908 wrote to memory of 216 908 cmd.exe 108 PID 908 wrote to memory of 2628 908 cmd.exe 109 PID 908 wrote to memory of 2628 908 cmd.exe 109 PID 908 wrote to memory of 2628 908 cmd.exe 109 PID 908 wrote to memory of 632 908 cmd.exe 110 PID 908 wrote to memory of 632 908 cmd.exe 110 PID 908 wrote to memory of 632 908 cmd.exe 110 PID 908 wrote to memory of 2632 908 cmd.exe 111 PID 908 wrote to memory of 2632 908 cmd.exe 111 PID 908 wrote to memory of 2632 908 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe"C:\Users\Admin\AppData\Local\Temp\1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qV779626.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qV779626.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\144293384.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\144293384.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\200823871.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\200823871.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 10884⤵
- Program crash
PID:924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\360515814.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\360515814.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
- System Location Discovery: System Language Discovery
PID:4268
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵
- System Location Discovery: System Language Discovery
PID:216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵
- System Location Discovery: System Language Discovery
PID:632
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵
- System Location Discovery: System Language Discovery
PID:2632
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1544 -ip 15441⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2872
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4340
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD51304f384653e08ae497008ff13498608
SHA1d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA2562a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA5124138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1
-
Filesize
407KB
MD5df895cb32fe522f9b4793b983ee11eda
SHA1927299fb5dfe09720ebd44c62979f8bb3373978f
SHA256ec4595203dcafb1c8ebd42ad99e8a4bc345145e8a0b74b525af3e754452004f2
SHA512be73198dea19d9a57dfb82d1df07291fb957cf45901e59a3d6e92feec8d945adcdd12df8ae9258332f379dd3f309e17b38393909a88b20ccec1a8cc000424a0c
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
265KB
MD513e2925f93ecb9dadcba13de8b61aaa9
SHA17a170b84b80a17ce2badf6c319edef48d7db2ff9
SHA2564f966e412c5e4f9335610d65b7affef485dd9d541e64415d7bdbe3b220c459c5
SHA51200d6c0b4f6baee76eead37e2fa73c8c42d812c2915a0612d03d0d20bd8809cfc1e4155306e54fb87a78a3fd636fce9b265a1c34cc6772e951146a5322de6e314