Analysis
-
max time kernel
116s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe
Resource
win7-20241010-en
General
-
Target
775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe
-
Size
256KB
-
MD5
cfe5ed118de0a77354eb9d32dea630f0
-
SHA1
747526790e5a9e725d7eeaf67a6b2189ad3447d9
-
SHA256
775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8
-
SHA512
179ba6613b627512475a301a74962d65628bbe00e8bc26bd3eb24d2c32032aa2951e19859ed02087d0717aad7acfe4dab04a15bb2509f58d04910287cde03410
-
SSDEEP
6144:YZkFRbXfb7wzY1FJRRBx5oUsWW5W8g4/ve7:YZcpXGY1FJRTtsWWj
Malware Config
Extracted
amadey
3.80
8c4642
http://193.201.9.240
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
c7c0f24aa6d8f611f5533809029a4795
-
url_paths
/live/games/index.php
Signatures
-
Amadey family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 2 IoCs
pid Process 2368 oneetx.exe 2188 oneetx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 26 IoCs
pid pid_target Process procid_target 2672 2160 WerFault.exe 82 4916 2160 WerFault.exe 82 3840 2160 WerFault.exe 82 100 2160 WerFault.exe 82 3020 2160 WerFault.exe 82 3924 2160 WerFault.exe 82 4064 2160 WerFault.exe 82 1712 2160 WerFault.exe 82 4156 2160 WerFault.exe 82 924 2160 WerFault.exe 82 2220 2368 WerFault.exe 110 396 2368 WerFault.exe 110 908 2368 WerFault.exe 110 4500 2368 WerFault.exe 110 1796 2368 WerFault.exe 110 3432 2368 WerFault.exe 110 2360 2368 WerFault.exe 110 5024 2368 WerFault.exe 110 2948 2368 WerFault.exe 110 4288 2368 WerFault.exe 110 2300 2368 WerFault.exe 110 3468 2368 WerFault.exe 110 3752 2368 WerFault.exe 110 3988 2368 WerFault.exe 110 1380 2368 WerFault.exe 110 1236 2188 WerFault.exe 162 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3652 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2368 2160 775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe 110 PID 2160 wrote to memory of 2368 2160 775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe 110 PID 2160 wrote to memory of 2368 2160 775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe 110 PID 2368 wrote to memory of 3652 2368 oneetx.exe 132 PID 2368 wrote to memory of 3652 2368 oneetx.exe 132 PID 2368 wrote to memory of 3652 2368 oneetx.exe 132 PID 2368 wrote to memory of 2776 2368 oneetx.exe 138 PID 2368 wrote to memory of 2776 2368 oneetx.exe 138 PID 2368 wrote to memory of 2776 2368 oneetx.exe 138 PID 2776 wrote to memory of 2744 2776 cmd.exe 142 PID 2776 wrote to memory of 2744 2776 cmd.exe 142 PID 2776 wrote to memory of 2744 2776 cmd.exe 142 PID 2776 wrote to memory of 1492 2776 cmd.exe 143 PID 2776 wrote to memory of 1492 2776 cmd.exe 143 PID 2776 wrote to memory of 1492 2776 cmd.exe 143 PID 2776 wrote to memory of 4572 2776 cmd.exe 144 PID 2776 wrote to memory of 4572 2776 cmd.exe 144 PID 2776 wrote to memory of 4572 2776 cmd.exe 144 PID 2776 wrote to memory of 1640 2776 cmd.exe 145 PID 2776 wrote to memory of 1640 2776 cmd.exe 145 PID 2776 wrote to memory of 1640 2776 cmd.exe 145 PID 2776 wrote to memory of 3020 2776 cmd.exe 146 PID 2776 wrote to memory of 3020 2776 cmd.exe 146 PID 2776 wrote to memory of 3020 2776 cmd.exe 146 PID 2776 wrote to memory of 1364 2776 cmd.exe 147 PID 2776 wrote to memory of 1364 2776 cmd.exe 147 PID 2776 wrote to memory of 1364 2776 cmd.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe"C:\Users\Admin\AppData\Local\Temp\775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 5602⤵
- Program crash
PID:2672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 6442⤵
- Program crash
PID:4916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 7202⤵
- Program crash
PID:3840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 8362⤵
- Program crash
PID:100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 8442⤵
- Program crash
PID:3020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 8442⤵
- Program crash
PID:3924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 10962⤵
- Program crash
PID:4064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 11562⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 12402⤵
- Program crash
PID:4156
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 5843⤵
- Program crash
PID:2220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 7203⤵
- Program crash
PID:396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 9123⤵
- Program crash
PID:908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 9203⤵
- Program crash
PID:4500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 9123⤵
- Program crash
PID:1796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 9843⤵
- Program crash
PID:3432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 9923⤵
- Program crash
PID:2360
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 8843⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 5843⤵
- Program crash
PID:2948
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:4572
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:1640
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:3020
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:1364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 7203⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 6683⤵
- Program crash
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 5843⤵
- Program crash
PID:3468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 11803⤵
- Program crash
PID:3752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 13283⤵
- Program crash
PID:3988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 10123⤵
- Program crash
PID:1380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 12562⤵
- Program crash
PID:924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2160 -ip 21601⤵PID:4700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2160 -ip 21601⤵PID:4000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2160 -ip 21601⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2160 -ip 21601⤵PID:2396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2160 -ip 21601⤵PID:2400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2160 -ip 21601⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2160 -ip 21601⤵PID:956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2160 -ip 21601⤵PID:3396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2160 -ip 21601⤵PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2160 -ip 21601⤵PID:1688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2368 -ip 23681⤵PID:860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2368 -ip 23681⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2368 -ip 23681⤵PID:1400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2368 -ip 23681⤵PID:3264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2368 -ip 23681⤵PID:216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2368 -ip 23681⤵PID:2636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2368 -ip 23681⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2368 -ip 23681⤵PID:1236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2368 -ip 23681⤵PID:2376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2368 -ip 23681⤵PID:3588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2368 -ip 23681⤵PID:940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2368 -ip 23681⤵PID:1604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2368 -ip 23681⤵PID:3088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2368 -ip 23681⤵PID:1876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2368 -ip 23681⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 3162⤵
- Program crash
PID:1236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2188 -ip 21881⤵PID:4112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5cfe5ed118de0a77354eb9d32dea630f0
SHA1747526790e5a9e725d7eeaf67a6b2189ad3447d9
SHA256775f1ea2afdc4a8d9944ed7523257edcd4487aaf443c92848b39614b30f310a8
SHA512179ba6613b627512475a301a74962d65628bbe00e8bc26bd3eb24d2c32032aa2951e19859ed02087d0717aad7acfe4dab04a15bb2509f58d04910287cde03410