Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 18:11
Behavioral task
behavioral1
Sample
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe
Resource
win10v2004-20241007-en
General
-
Target
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe
-
Size
209KB
-
MD5
4fe19c2fa04912e5f014563dfbc74800
-
SHA1
7b719de8a3cbf8a5dd0a4972d8b7b1a44bb56342
-
SHA256
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381
-
SHA512
8937e6451bc9b4680b772b1f278da1dd2d1bf04120773ddcea982942aafa345c2c575528c2c7d444342dc15c7147162553308b90abd4b0f8d1fb85853ae198dd
-
SSDEEP
3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq
Malware Config
Extracted
amadey
3.81
f9a925
http://77.91.124.20
-
install_dir
c3912af058
-
install_file
oneetx.exe
-
strings_key
0504ce46646b0dc397a3c30d6692ec75
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Executes dropped EXE 3 IoCs
Processes:
oneetx.exeoneetx.exeoneetx.exepid Process 2508 oneetx.exe 1264 oneetx.exe 2844 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exepid Process 2132 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
oneetx.execmd.execmd.execmd.execacls.exe3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exeschtasks.execacls.execacls.execacls.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exepid Process 2132 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exeoneetx.execmd.exetaskeng.exedescription pid Process procid_target PID 2132 wrote to memory of 2508 2132 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe 31 PID 2132 wrote to memory of 2508 2132 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe 31 PID 2132 wrote to memory of 2508 2132 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe 31 PID 2132 wrote to memory of 2508 2132 3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe 31 PID 2508 wrote to memory of 2940 2508 oneetx.exe 32 PID 2508 wrote to memory of 2940 2508 oneetx.exe 32 PID 2508 wrote to memory of 2940 2508 oneetx.exe 32 PID 2508 wrote to memory of 2940 2508 oneetx.exe 32 PID 2508 wrote to memory of 2056 2508 oneetx.exe 34 PID 2508 wrote to memory of 2056 2508 oneetx.exe 34 PID 2508 wrote to memory of 2056 2508 oneetx.exe 34 PID 2508 wrote to memory of 2056 2508 oneetx.exe 34 PID 2056 wrote to memory of 2764 2056 cmd.exe 36 PID 2056 wrote to memory of 2764 2056 cmd.exe 36 PID 2056 wrote to memory of 2764 2056 cmd.exe 36 PID 2056 wrote to memory of 2764 2056 cmd.exe 36 PID 2056 wrote to memory of 2904 2056 cmd.exe 37 PID 2056 wrote to memory of 2904 2056 cmd.exe 37 PID 2056 wrote to memory of 2904 2056 cmd.exe 37 PID 2056 wrote to memory of 2904 2056 cmd.exe 37 PID 2056 wrote to memory of 2900 2056 cmd.exe 38 PID 2056 wrote to memory of 2900 2056 cmd.exe 38 PID 2056 wrote to memory of 2900 2056 cmd.exe 38 PID 2056 wrote to memory of 2900 2056 cmd.exe 38 PID 2056 wrote to memory of 2924 2056 cmd.exe 39 PID 2056 wrote to memory of 2924 2056 cmd.exe 39 PID 2056 wrote to memory of 2924 2056 cmd.exe 39 PID 2056 wrote to memory of 2924 2056 cmd.exe 39 PID 2056 wrote to memory of 2864 2056 cmd.exe 40 PID 2056 wrote to memory of 2864 2056 cmd.exe 40 PID 2056 wrote to memory of 2864 2056 cmd.exe 40 PID 2056 wrote to memory of 2864 2056 cmd.exe 40 PID 2056 wrote to memory of 2756 2056 cmd.exe 41 PID 2056 wrote to memory of 2756 2056 cmd.exe 41 PID 2056 wrote to memory of 2756 2056 cmd.exe 41 PID 2056 wrote to memory of 2756 2056 cmd.exe 41 PID 1728 wrote to memory of 1264 1728 taskeng.exe 44 PID 1728 wrote to memory of 1264 1728 taskeng.exe 44 PID 1728 wrote to memory of 1264 1728 taskeng.exe 44 PID 1728 wrote to memory of 1264 1728 taskeng.exe 44 PID 1728 wrote to memory of 2844 1728 taskeng.exe 45 PID 1728 wrote to memory of 2844 1728 taskeng.exe 45 PID 1728 wrote to memory of 2844 1728 taskeng.exe 45 PID 1728 wrote to memory of 2844 1728 taskeng.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe"C:\Users\Admin\AppData\Local\Temp\3accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2940
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:2924
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:2864
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:2756
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EA45D6A2-0CB0-4DB9-858B-465A0D8763BC} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe2⤵
- Executes dropped EXE
PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe2⤵
- Executes dropped EXE
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD54fe19c2fa04912e5f014563dfbc74800
SHA17b719de8a3cbf8a5dd0a4972d8b7b1a44bb56342
SHA2563accafa6ef42df81f7735a885e3a767aef6ce33e21a56b1b88012120d0b1f381
SHA5128937e6451bc9b4680b772b1f278da1dd2d1bf04120773ddcea982942aafa345c2c575528c2c7d444342dc15c7147162553308b90abd4b0f8d1fb85853ae198dd