Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 12:49

General

  • Target

    69758ac2e6a786879dc40c3b2ffb3a9f192a5452083a17674bb0c9d26b38be04.exe

  • Size

    1.1MB

  • MD5

    25b5c225a2270f70e107244dc40f4cee

  • SHA1

    9e222371096187546dbb0278a20b27e2db6369a0

  • SHA256

    69758ac2e6a786879dc40c3b2ffb3a9f192a5452083a17674bb0c9d26b38be04

  • SHA512

    a836a25a688d81e24c68133883724250053d1580d9c53460299b16eb86562f34269c0bd2600933a12d4183670c5e9459212ddbf92ba84296874b343b56760820

  • SSDEEP

    24576:1yzXJyDbgrx9Zx3pP5aobPB+z+25QDws7XIv9b:Q9y3grLZrVTg+h3XIv1

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

C2

http://193.3.19.154

Attributes
  • install_dir

    cb7ae701b3

  • install_file

    oneetx.exe

  • strings_key

    23b27c80db2465a8e1dc15491b69b82f

  • url_paths

    /store/games/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69758ac2e6a786879dc40c3b2ffb3a9f192a5452083a17674bb0c9d26b38be04.exe
    "C:\Users\Admin\AppData\Local\Temp\69758ac2e6a786879dc40c3b2ffb3a9f192a5452083a17674bb0c9d26b38be04.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lE463987.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lE463987.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yq921698.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yq921698.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc946437.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc946437.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\118395989.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\118395989.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2624
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\271344771.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\271344771.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1420
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1080
              6⤵
              • Program crash
              PID:4108
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389032196.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389032196.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2836
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4528
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4152
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2992
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1720
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4128
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4416
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:N"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1360
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\cb7ae701b3" /P "Admin:R" /E
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4408
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\457795192.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\457795192.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1420 -ip 1420
    1⤵
      PID:4936
    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:2560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lE463987.exe

      Filesize

      930KB

      MD5

      9134e97c10376dbaecb017cba9dcebd8

      SHA1

      13b1e520fa80c6c5d670aa54e703feb3868f94aa

      SHA256

      9f642b8b0ad10524e66fc7bcd9e2a9ba07baf759512f4ff2b424203653960a6d

      SHA512

      a9ba88684ec64275f0dab8b2662ad676109422a1d79af0b8ddd6dd80dceb15bea87651c1ef2c5114323034c67c48acebc9850d4c0f6ff09380ef564e3a7ade5f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\457795192.exe

      Filesize

      340KB

      MD5

      e043d37680bc40db6ea0ec3afe90222e

      SHA1

      dd5ab7c337df82cfa095b8fead11c46d407a26e1

      SHA256

      1d5c2ceaa9b746dfd2007f8fdca055e0d0eddec8cc2a4737137845f237579cee

      SHA512

      1c8b5084b9d27bb0255157cd34f882537dd5662ac45a59beadac709791482f0d1adb1504ef0ddc3de3d30801b8c73adc98f68fc362357543300e01f35fe8f737

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yq921698.exe

      Filesize

      577KB

      MD5

      c2d156b3fad01ce1e45fb5a9b0ce065e

      SHA1

      312fafd6d3ffee2130352198de1d0d29c8d862f3

      SHA256

      1b485e5957a33a8a5c4c161773868984a02e70154b675f658b4f103bac40a700

      SHA512

      0718723f3004f21da010c05427844f75066a7256a77eb65d9b76387e34f143adb833622700c4918f610328adb293adc93e8ba609727c7ee7594e981c38d586c1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389032196.exe

      Filesize

      204KB

      MD5

      1304f384653e08ae497008ff13498608

      SHA1

      d9a76ed63d74d4217c5027757cb9a7a0d0093080

      SHA256

      2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

      SHA512

      4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc946437.exe

      Filesize

      406KB

      MD5

      28a11052997c41b8a18e5f684cff1a5c

      SHA1

      128d666bb0771cbc456ac9f942479cb32fe4a489

      SHA256

      883919f59167190292ed446b525547c1807d136ef06c6b5f6e176bfea550a8e3

      SHA512

      eda2aef896f2bde6367aacd563c40e4feb97c8c19a968ca2f7adc66b305ff9d9636ada4960c4494fdc376e90b9be2eebb19579aab49936043cea919afe4f7c0f

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\118395989.exe

      Filesize

      176KB

      MD5

      2b71f4b18ac8214a2bff547b6ce2f64f

      SHA1

      b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

      SHA256

      f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

      SHA512

      33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\271344771.exe

      Filesize

      258KB

      MD5

      6a04a9a72c33a118a6b9a3a5d4876f8c

      SHA1

      88f52b1107ed4c88a160316dfd04b155ba86bc40

      SHA256

      df087f174cf6ebebd1d35e2d4f5de08e366603509d5bccf6f2e4c88f99003ec4

      SHA512

      70793dd01e32d0517c8d95c8884f74ef45e479bfde65b72140b4a2f6ccc2e8e6d2239fd7b5d803499c69341c0a494678b2f1c293630866840beb11aba15b6ef2

    • memory/1420-94-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/1420-92-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/2624-36-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-30-0x00000000022F0000-0x0000000002308000-memory.dmp

      Filesize

      96KB

    • memory/2624-53-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-50-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-48-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-46-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-44-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-42-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-40-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-56-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-32-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-31-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-34-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-58-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-38-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-54-0x00000000022F0000-0x0000000002303000-memory.dmp

      Filesize

      76KB

    • memory/2624-29-0x0000000004AA0000-0x0000000005044000-memory.dmp

      Filesize

      5.6MB

    • memory/2624-28-0x0000000002240000-0x000000000225A000-memory.dmp

      Filesize

      104KB

    • memory/4628-112-0x0000000004C80000-0x0000000004CBC000-memory.dmp

      Filesize

      240KB

    • memory/4628-114-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/4628-113-0x0000000007730000-0x000000000776A000-memory.dmp

      Filesize

      232KB

    • memory/4628-119-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/4628-117-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/4628-115-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/4628-906-0x0000000009C60000-0x000000000A278000-memory.dmp

      Filesize

      6.1MB

    • memory/4628-907-0x000000000A320000-0x000000000A332000-memory.dmp

      Filesize

      72KB

    • memory/4628-908-0x000000000A340000-0x000000000A44A000-memory.dmp

      Filesize

      1.0MB

    • memory/4628-909-0x000000000A460000-0x000000000A49C000-memory.dmp

      Filesize

      240KB

    • memory/4628-910-0x0000000004BF0000-0x0000000004C3C000-memory.dmp

      Filesize

      304KB