Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-02-2021 09:13
Static task
static1
Behavioral task
behavioral1
Sample
5522f4b9234aea8bbc17670cb1cfd322.exe
Resource
win7v20201028
General
-
Target
5522f4b9234aea8bbc17670cb1cfd322.exe
-
Size
295KB
-
MD5
5522f4b9234aea8bbc17670cb1cfd322
-
SHA1
cabd799a2db28208367acc365227f3916d4e0cd0
-
SHA256
3abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926
-
SHA512
589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365
Malware Config
Extracted
amadey
2.11
176.111.174.67/7Ndd3SnW/index.php
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 7 636 rundll32.exe 8 796 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
rween.exepid process 1984 rween.exe -
Loads dropped DLL 10 IoCs
Processes:
5522f4b9234aea8bbc17670cb1cfd322.exerundll32.exerundll32.exepid process 1684 5522f4b9234aea8bbc17670cb1cfd322.exe 1684 5522f4b9234aea8bbc17670cb1cfd322.exe 636 rundll32.exe 636 rundll32.exe 636 rundll32.exe 636 rundll32.exe 796 rundll32.exe 796 rundll32.exe 796 rundll32.exe 796 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 636 rundll32.exe 636 rundll32.exe 636 rundll32.exe 636 rundll32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
5522f4b9234aea8bbc17670cb1cfd322.exerween.execmd.exedescription pid process target process PID 1684 wrote to memory of 1984 1684 5522f4b9234aea8bbc17670cb1cfd322.exe rween.exe PID 1684 wrote to memory of 1984 1684 5522f4b9234aea8bbc17670cb1cfd322.exe rween.exe PID 1684 wrote to memory of 1984 1684 5522f4b9234aea8bbc17670cb1cfd322.exe rween.exe PID 1684 wrote to memory of 1984 1684 5522f4b9234aea8bbc17670cb1cfd322.exe rween.exe PID 1984 wrote to memory of 1936 1984 rween.exe cmd.exe PID 1984 wrote to memory of 1936 1984 rween.exe cmd.exe PID 1984 wrote to memory of 1936 1984 rween.exe cmd.exe PID 1984 wrote to memory of 1936 1984 rween.exe cmd.exe PID 1936 wrote to memory of 1728 1936 cmd.exe reg.exe PID 1936 wrote to memory of 1728 1936 cmd.exe reg.exe PID 1936 wrote to memory of 1728 1936 cmd.exe reg.exe PID 1936 wrote to memory of 1728 1936 cmd.exe reg.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 636 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe PID 1984 wrote to memory of 796 1984 rween.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5522f4b9234aea8bbc17670cb1cfd322.exe"C:\Users\Admin\AppData\Local\Temp\5522f4b9234aea8bbc17670cb1cfd322.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\ProgramData\011ab573a3\rween.exe"C:\ProgramData\011ab573a3\rween.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\011ab573a3\3⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\011ab573a3\4⤵PID:1728
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\5eba991cccd123\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:636
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\5eba991cccd123\scr.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:796
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
5522f4b9234aea8bbc17670cb1cfd322
SHA1cabd799a2db28208367acc365227f3916d4e0cd0
SHA2563abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926
SHA512589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
MD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
MD5
5522f4b9234aea8bbc17670cb1cfd322
SHA1cabd799a2db28208367acc365227f3916d4e0cd0
SHA2563abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926
SHA512589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365
-
MD5
5522f4b9234aea8bbc17670cb1cfd322
SHA1cabd799a2db28208367acc365227f3916d4e0cd0
SHA2563abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926
SHA512589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365
-
MD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
MD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
MD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
MD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
MD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
MD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
MD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
MD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2