Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe
Resource
win7-20241010-en
General
-
Target
addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe
-
Size
256KB
-
MD5
3a15a9ffa2fa9c4b2814a7c0c450be1e
-
SHA1
4eb3e39a74848a67bb1f6e195a6e1de8b55661e7
-
SHA256
addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57
-
SHA512
8302d89fae84cfc6201c4bbdf45bf27d85a5d90f124de8c91142af92b599e5cee51cbd37237544c2e67e9394e82427c76ea0a3df6df1c01d4611dd59767d3fb5
-
SSDEEP
3072:f/MnwnqSiQunb5x8BAG8nweqXnzIL6qvUsbqC6N25/jAtwYPDpJKJRfyIh:naJSvMjwjwDw8MqYPDWJv
Malware Config
Extracted
amadey
3.80
8c4642
http://193.201.9.240
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
c7c0f24aa6d8f611f5533809029a4795
-
url_paths
/live/games/index.php
Signatures
-
Amadey family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 4 IoCs
pid Process 1676 oneetx.exe 2572 oneetx.exe 4868 oneetx.exe 1892 oneetx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 29 IoCs
pid pid_target Process procid_target 2884 4324 WerFault.exe 82 3120 4324 WerFault.exe 82 2348 4324 WerFault.exe 82 2920 4324 WerFault.exe 82 4364 4324 WerFault.exe 82 2244 4324 WerFault.exe 82 4768 4324 WerFault.exe 82 3988 4324 WerFault.exe 82 3588 4324 WerFault.exe 82 4944 4324 WerFault.exe 82 1316 1676 WerFault.exe 112 3964 1676 WerFault.exe 112 4296 1676 WerFault.exe 112 1604 1676 WerFault.exe 112 5088 1676 WerFault.exe 112 512 1676 WerFault.exe 112 2448 1676 WerFault.exe 112 3848 1676 WerFault.exe 112 1664 1676 WerFault.exe 112 400 1676 WerFault.exe 112 4100 1676 WerFault.exe 112 1140 1676 WerFault.exe 112 4520 1676 WerFault.exe 112 1520 2572 WerFault.exe 157 228 1676 WerFault.exe 112 1664 4868 WerFault.exe 166 3024 1676 WerFault.exe 112 2640 1892 WerFault.exe 172 812 1676 WerFault.exe 112 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3352 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4324 addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4324 wrote to memory of 1676 4324 addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe 112 PID 4324 wrote to memory of 1676 4324 addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe 112 PID 4324 wrote to memory of 1676 4324 addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe 112 PID 1676 wrote to memory of 3352 1676 oneetx.exe 131 PID 1676 wrote to memory of 3352 1676 oneetx.exe 131 PID 1676 wrote to memory of 3352 1676 oneetx.exe 131 PID 1676 wrote to memory of 3120 1676 oneetx.exe 138 PID 1676 wrote to memory of 3120 1676 oneetx.exe 138 PID 1676 wrote to memory of 3120 1676 oneetx.exe 138 PID 3120 wrote to memory of 5036 3120 cmd.exe 143 PID 3120 wrote to memory of 5036 3120 cmd.exe 143 PID 3120 wrote to memory of 5036 3120 cmd.exe 143 PID 3120 wrote to memory of 952 3120 cmd.exe 144 PID 3120 wrote to memory of 952 3120 cmd.exe 144 PID 3120 wrote to memory of 952 3120 cmd.exe 144 PID 3120 wrote to memory of 4188 3120 cmd.exe 145 PID 3120 wrote to memory of 4188 3120 cmd.exe 145 PID 3120 wrote to memory of 4188 3120 cmd.exe 145 PID 3120 wrote to memory of 4828 3120 cmd.exe 146 PID 3120 wrote to memory of 4828 3120 cmd.exe 146 PID 3120 wrote to memory of 4828 3120 cmd.exe 146 PID 3120 wrote to memory of 2952 3120 cmd.exe 147 PID 3120 wrote to memory of 2952 3120 cmd.exe 147 PID 3120 wrote to memory of 2952 3120 cmd.exe 147 PID 3120 wrote to memory of 2320 3120 cmd.exe 148 PID 3120 wrote to memory of 2320 3120 cmd.exe 148 PID 3120 wrote to memory of 2320 3120 cmd.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe"C:\Users\Admin\AppData\Local\Temp\addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 5882⤵
- Program crash
PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 6602⤵
- Program crash
PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 7282⤵
- Program crash
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 7362⤵
- Program crash
PID:2920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 7282⤵
- Program crash
PID:4364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 8562⤵
- Program crash
PID:2244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 11042⤵
- Program crash
PID:4768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 11082⤵
- Program crash
PID:3988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 12242⤵
- Program crash
PID:3588
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 6003⤵
- Program crash
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 7963⤵
- Program crash
PID:3964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9123⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 10043⤵
- Program crash
PID:1604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 10203⤵
- Program crash
PID:5088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 10043⤵
- Program crash
PID:512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9163⤵
- Program crash
PID:2448
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9003⤵
- Program crash
PID:3848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 6723⤵
- Program crash
PID:1664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:5036
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:952
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:4188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:4828
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:2320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12563⤵
- Program crash
PID:400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1363⤵
- Program crash
PID:4100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 11843⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12403⤵
- Program crash
PID:4520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9883⤵
- Program crash
PID:228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 14123⤵
- Program crash
PID:3024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 14643⤵
- Program crash
PID:812
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 14722⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4324 -ip 43241⤵PID:4256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4324 -ip 43241⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4324 -ip 43241⤵PID:3348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4324 -ip 43241⤵PID:952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4324 -ip 43241⤵PID:4956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4324 -ip 43241⤵PID:2316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4324 -ip 43241⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4324 -ip 43241⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4324 -ip 43241⤵PID:1140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4324 -ip 43241⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1676 -ip 16761⤵PID:2796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1676 -ip 16761⤵PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1676 -ip 16761⤵PID:4200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1676 -ip 16761⤵PID:4300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1676 -ip 16761⤵PID:556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1676 -ip 16761⤵PID:2104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1676 -ip 16761⤵PID:2844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1676 -ip 16761⤵PID:2000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1676 -ip 16761⤵PID:2908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1676 -ip 16761⤵PID:1584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1676 -ip 16761⤵PID:4340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1676 -ip 16761⤵PID:1924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1676 -ip 16761⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 4242⤵
- Program crash
PID:1520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2572 -ip 25721⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1676 -ip 16761⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 4242⤵
- Program crash
PID:1664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4868 -ip 48681⤵PID:1740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1676 -ip 16761⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 4242⤵
- Program crash
PID:2640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1892 -ip 18921⤵PID:816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1676 -ip 16761⤵PID:4792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD53a15a9ffa2fa9c4b2814a7c0c450be1e
SHA14eb3e39a74848a67bb1f6e195a6e1de8b55661e7
SHA256addff231dabadf04b62011b1494a13e81b6171e1f566dbae1ee7afa56239dd57
SHA5128302d89fae84cfc6201c4bbdf45bf27d85a5d90f124de8c91142af92b599e5cee51cbd37237544c2e67e9394e82427c76ea0a3df6df1c01d4611dd59767d3fb5