Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 08:14 UTC

General

  • Target

    ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe

  • Size

    315KB

  • MD5

    c9cbf1f177667f0014030f672039324f

  • SHA1

    6f3b56ec75cf87d16e1cdbfffb44e447019acb1a

  • SHA256

    ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c

  • SHA512

    c539d9dfe3803b280ef5d46458528e8a838faca02267fee1c975d9cdb30b16952f07ced3f842af796266b93d61534b6ef149adc47f70a0682e92beb96bf8f052

  • SSDEEP

    6144:Ksy+bnr+0p0yN90QEodDN8qBJsofBI05FVFR6I/98WExAH3dIclptA+ZQ:oMroy90S3BW0I0h6IFAmXdBptU

Malware Config

Extracted

Family

amadey

Version

3.70

Botnet

b50502

C2

http://77.91.124.207

Attributes
  • install_dir

    595f021478

  • install_file

    oneetx.exe

  • strings_key

    6e3d32d239380a49b6f83128fe71ea01

  • url_paths

    /plays/chapter/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 28 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe
    "C:\Users\Admin\AppData\Local\Temp\ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\az244752.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\az244752.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bu269993.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bu269993.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 696
        3⤵
        • Program crash
        PID:1080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 780
        3⤵
        • Program crash
        PID:2372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 856
        3⤵
        • Program crash
        PID:1772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 972
        3⤵
        • Program crash
        PID:1680
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1008
        3⤵
        • Program crash
        PID:1460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1000
        3⤵
        • Program crash
        PID:3448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1216
        3⤵
        • Program crash
        PID:2176
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1236
        3⤵
        • Program crash
        PID:3500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1316
        3⤵
        • Program crash
        PID:2236
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 692
          4⤵
          • Program crash
          PID:3116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1016
          4⤵
          • Program crash
          PID:4956
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1072
          4⤵
          • Program crash
          PID:3272
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1096
          4⤵
          • Program crash
          PID:1600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 728
          4⤵
          • Program crash
          PID:1100
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1116
          4⤵
          • Program crash
          PID:4416
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1100
          4⤵
          • Program crash
          PID:1880
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:952
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1004
          4⤵
          • Program crash
          PID:2004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1296
          4⤵
          • Program crash
          PID:1948
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 720
          4⤵
          • Program crash
          PID:1656
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 784
          4⤵
          • Program crash
          PID:3808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1420
          4⤵
          • Program crash
          PID:2192
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1136
          4⤵
          • Program crash
          PID:3040
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1388
          4⤵
          • Program crash
          PID:5016
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1720
        3⤵
        • Program crash
        PID:980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1740
        3⤵
        • Program crash
        PID:1564
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
    1⤵
      PID:2468
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1400 -ip 1400
      1⤵
        PID:2276
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1400 -ip 1400
        1⤵
          PID:3492
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1400 -ip 1400
          1⤵
            PID:2156
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1400 -ip 1400
            1⤵
              PID:4400
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1400 -ip 1400
              1⤵
                PID:5040
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1400 -ip 1400
                1⤵
                  PID:932
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1400 -ip 1400
                  1⤵
                    PID:4928
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1400 -ip 1400
                    1⤵
                      PID:4628
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1400 -ip 1400
                      1⤵
                        PID:4228
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2736 -ip 2736
                        1⤵
                          PID:2084
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1400 -ip 1400
                          1⤵
                            PID:2792
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2736 -ip 2736
                            1⤵
                              PID:5044
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2736 -ip 2736
                              1⤵
                                PID:4412
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2736 -ip 2736
                                1⤵
                                  PID:2204
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2736 -ip 2736
                                  1⤵
                                    PID:368
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2736 -ip 2736
                                    1⤵
                                      PID:2620
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2736 -ip 2736
                                      1⤵
                                        PID:1768
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2736 -ip 2736
                                        1⤵
                                          PID:3104
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2736 -ip 2736
                                          1⤵
                                            PID:3000
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2736 -ip 2736
                                            1⤵
                                              PID:3256
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2736 -ip 2736
                                              1⤵
                                                PID:3972
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2736 -ip 2736
                                                1⤵
                                                  PID:3692
                                                • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                  C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:4536
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 216
                                                    2⤵
                                                    • Program crash
                                                    PID:4280
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4536 -ip 4536
                                                  1⤵
                                                    PID:968
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2736 -ip 2736
                                                    1⤵
                                                      PID:32
                                                    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                      C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:1228
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 320
                                                        2⤵
                                                        • Program crash
                                                        PID:548
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1228 -ip 1228
                                                      1⤵
                                                        PID:2732
                                                      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2084
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 216
                                                          2⤵
                                                          • Program crash
                                                          PID:5068
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2084 -ip 2084
                                                        1⤵
                                                          PID:4712
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2736 -ip 2736
                                                          1⤵
                                                            PID:1792

                                                          Network

                                                          • flag-us
                                                            DNS
                                                            97.17.167.52.in-addr.arpa
                                                            Remote address:
                                                            8.8.8.8:53
                                                            Request
                                                            97.17.167.52.in-addr.arpa
                                                            IN PTR
                                                            Response
                                                          • flag-us
                                                            DNS
                                                            69.31.126.40.in-addr.arpa
                                                            Remote address:
                                                            8.8.8.8:53
                                                            Request
                                                            69.31.126.40.in-addr.arpa
                                                            IN PTR
                                                            Response
                                                          • flag-us
                                                            DNS
                                                            95.221.229.192.in-addr.arpa
                                                            Remote address:
                                                            8.8.8.8:53
                                                            Request
                                                            95.221.229.192.in-addr.arpa
                                                            IN PTR
                                                            Response
                                                          • flag-us
                                                            DNS
                                                            19.229.111.52.in-addr.arpa
                                                            Remote address:
                                                            8.8.8.8:53
                                                            Request
                                                            19.229.111.52.in-addr.arpa
                                                            IN PTR
                                                            Response
                                                          • 77.91.124.207:80
                                                            oneetx.exe
                                                            260 B
                                                            5
                                                          • 77.91.124.207:80
                                                            oneetx.exe
                                                            260 B
                                                            5
                                                          • 77.91.124.207:80
                                                            oneetx.exe
                                                            260 B
                                                            5
                                                          • 77.91.124.207:80
                                                            oneetx.exe
                                                            260 B
                                                            5
                                                          • 77.91.124.207:80
                                                            oneetx.exe
                                                            156 B
                                                            3
                                                          • 8.8.8.8:53
                                                            97.17.167.52.in-addr.arpa
                                                            dns
                                                            71 B
                                                            145 B
                                                            1
                                                            1

                                                            DNS Request

                                                            97.17.167.52.in-addr.arpa

                                                          • 8.8.8.8:53
                                                            69.31.126.40.in-addr.arpa
                                                            dns
                                                            71 B
                                                            157 B
                                                            1
                                                            1

                                                            DNS Request

                                                            69.31.126.40.in-addr.arpa

                                                          • 8.8.8.8:53
                                                            95.221.229.192.in-addr.arpa
                                                            dns
                                                            73 B
                                                            144 B
                                                            1
                                                            1

                                                            DNS Request

                                                            95.221.229.192.in-addr.arpa

                                                          • 8.8.8.8:53
                                                            19.229.111.52.in-addr.arpa
                                                            dns
                                                            72 B
                                                            158 B
                                                            1
                                                            1

                                                            DNS Request

                                                            19.229.111.52.in-addr.arpa

                                                          • 8.8.8.8:53

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\az244752.exe

                                                            Filesize

                                                            14KB

                                                            MD5

                                                            4db0d7e2dc0421230ca375d55cf1ba2e

                                                            SHA1

                                                            874ebf98e6d99df6be36499acd07c42058ebf6bb

                                                            SHA256

                                                            e228fa0375b00c7c6495d76cd64fd3fb235472a0eef3f668ef4d44d9bf98e407

                                                            SHA512

                                                            dfd5479bfcc25155a55bece60a90a17e8ad2cab8d045d4061ca7d99c1e3f762ab571246cb69c3fd7b5e1b6269405adc963dc54a79e7e83d79d55cef43acdff76

                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bu269993.exe

                                                            Filesize

                                                            234KB

                                                            MD5

                                                            eb198959c1a980a1d594f7d71838a9c6

                                                            SHA1

                                                            bab362d42a57ccdf9e86d914398ece711b87a51a

                                                            SHA256

                                                            d9c3d74379bd1c876079be6cac5eac2ce57c33d83341e96a976aa5c50e16dd2d

                                                            SHA512

                                                            b8cd8bf324fb4bc678e51104bdcc2658ce95392bee7ead766490922c867e45de484dcf8db84966f00353d0574f2320f284016311a2a0ca9f1ed4f9d3647b816c

                                                          • memory/1096-7-0x00007FFC4F523000-0x00007FFC4F525000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/1096-8-0x0000000000F80000-0x0000000000F8A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/1096-9-0x00007FFC4F523000-0x00007FFC4F525000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/1228-47-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          • memory/1400-34-0x0000000000400000-0x000000000043E000-memory.dmp

                                                            Filesize

                                                            248KB

                                                          • memory/1400-17-0x0000000000400000-0x000000000043E000-memory.dmp

                                                            Filesize

                                                            248KB

                                                          • memory/1400-16-0x00000000004B0000-0x00000000004EB000-memory.dmp

                                                            Filesize

                                                            236KB

                                                          • memory/1400-33-0x00000000004B0000-0x00000000004EB000-memory.dmp

                                                            Filesize

                                                            236KB

                                                          • memory/1400-32-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          • memory/1400-15-0x0000000000610000-0x0000000000710000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                          • memory/2084-56-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          • memory/2736-35-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          • memory/2736-43-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          • memory/2736-48-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          • memory/4536-38-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                            Filesize

                                                            672KB

                                                          We care about your privacy.

                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.