Analysis
-
max time kernel
126s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-04-2021 05:11
Static task
static1
Behavioral task
behavioral1
Sample
EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe
Resource
win7v20210410
General
-
Target
EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe
-
Size
313KB
-
MD5
1994c7dd431c88e7b71bfeec3f51d493
-
SHA1
6c151e09cf1ef8db8c19aee22f22f1686cf77288
-
SHA256
afe81576e019af203a3b4548dcebe0ed5f9719719821fe570ef6eb31cae6cd0b
-
SHA512
36f4cb0c5f78645c948ba2f2445b23bcc836ebf083e628b25360954bb30d6baa074087535906192d561004b5b008b0e519301a8eb3e313fec6c282b62d0b32d3
Malware Config
Extracted
amadey
2.11
176.111.174.67/7Ndd3SnW/index.php
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 8 668 rundll32.exe 11 1924 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
rween.exepid process 1472 rween.exe -
Loads dropped DLL 10 IoCs
Processes:
EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exerundll32.exerundll32.exepid process 1944 EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe 1944 EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exerween.execmd.exedescription pid process target process PID 1944 wrote to memory of 1472 1944 EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe rween.exe PID 1944 wrote to memory of 1472 1944 EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe rween.exe PID 1944 wrote to memory of 1472 1944 EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe rween.exe PID 1944 wrote to memory of 1472 1944 EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe rween.exe PID 1472 wrote to memory of 1760 1472 rween.exe cmd.exe PID 1472 wrote to memory of 1760 1472 rween.exe cmd.exe PID 1472 wrote to memory of 1760 1472 rween.exe cmd.exe PID 1472 wrote to memory of 1760 1472 rween.exe cmd.exe PID 1760 wrote to memory of 1604 1760 cmd.exe reg.exe PID 1760 wrote to memory of 1604 1760 cmd.exe reg.exe PID 1760 wrote to memory of 1604 1760 cmd.exe reg.exe PID 1760 wrote to memory of 1604 1760 cmd.exe reg.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 668 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe PID 1472 wrote to memory of 1924 1472 rween.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe"C:\Users\Admin\AppData\Local\Temp\EMBARGO4256849329879411585432540766765501385339236289538201557523121773003558482222197917262.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\011ab573a3\rween.exe"C:\ProgramData\011ab573a3\rween.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\011ab573a3\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\011ab573a3\4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\5eba991cccd123\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\5eba991cccd123\scr.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\011ab573a3\rween.exeMD5
1994c7dd431c88e7b71bfeec3f51d493
SHA16c151e09cf1ef8db8c19aee22f22f1686cf77288
SHA256afe81576e019af203a3b4548dcebe0ed5f9719719821fe570ef6eb31cae6cd0b
SHA51236f4cb0c5f78645c948ba2f2445b23bcc836ebf083e628b25360954bb30d6baa074087535906192d561004b5b008b0e519301a8eb3e313fec6c282b62d0b32d3
-
C:\ProgramData\152125132832309319232775MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\5eba991cccd123\cred.dllMD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
C:\ProgramData\5eba991cccd123\scr.dllMD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
\ProgramData\011ab573a3\rween.exeMD5
1994c7dd431c88e7b71bfeec3f51d493
SHA16c151e09cf1ef8db8c19aee22f22f1686cf77288
SHA256afe81576e019af203a3b4548dcebe0ed5f9719719821fe570ef6eb31cae6cd0b
SHA51236f4cb0c5f78645c948ba2f2445b23bcc836ebf083e628b25360954bb30d6baa074087535906192d561004b5b008b0e519301a8eb3e313fec6c282b62d0b32d3
-
\ProgramData\011ab573a3\rween.exeMD5
1994c7dd431c88e7b71bfeec3f51d493
SHA16c151e09cf1ef8db8c19aee22f22f1686cf77288
SHA256afe81576e019af203a3b4548dcebe0ed5f9719719821fe570ef6eb31cae6cd0b
SHA51236f4cb0c5f78645c948ba2f2445b23bcc836ebf083e628b25360954bb30d6baa074087535906192d561004b5b008b0e519301a8eb3e313fec6c282b62d0b32d3
-
\ProgramData\5eba991cccd123\cred.dllMD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
\ProgramData\5eba991cccd123\cred.dllMD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
\ProgramData\5eba991cccd123\cred.dllMD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
\ProgramData\5eba991cccd123\cred.dllMD5
69b7615f2767c3435f2479efdca30177
SHA1a6d8c6d2bdef56a7197fef6fe79774338df50531
SHA2566f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64
SHA512749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee
-
\ProgramData\5eba991cccd123\scr.dllMD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
\ProgramData\5eba991cccd123\scr.dllMD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
\ProgramData\5eba991cccd123\scr.dllMD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
\ProgramData\5eba991cccd123\scr.dllMD5
f1c71bbc5b99ab01a8ec7c63a2e12242
SHA1ad9b2fd325fff790b732be40d3b2182daa43cfa2
SHA2563d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644
SHA51250b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2
-
memory/668-73-0x0000000000000000-mapping.dmp
-
memory/1472-72-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1472-63-0x0000000000000000-mapping.dmp
-
memory/1604-70-0x0000000000000000-mapping.dmp
-
memory/1760-69-0x0000000000000000-mapping.dmp
-
memory/1924-80-0x0000000000000000-mapping.dmp
-
memory/1944-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1944-66-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1944-65-0x0000000000220000-0x000000000024C000-memory.dmpFilesize
176KB