Analysis
-
max time kernel
151s -
max time network
179s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-09-2021 00:05
Static task
static1
Behavioral task
behavioral1
Sample
a26595e04bbad90731a04c1195c34d92.exe
Resource
win7v20210408
General
-
Target
a26595e04bbad90731a04c1195c34d92.exe
-
Size
1.4MB
-
MD5
a26595e04bbad90731a04c1195c34d92
-
SHA1
0b295fa12e6bd596ba0071a58370966c6a4551c3
-
SHA256
c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
-
SHA512
ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
Malware Config
Extracted
amadey
2.61
185.215.113.33/hBF6ds2D/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Executes dropped EXE 8 IoCs
Processes:
sqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exepid process 1524 sqtvvs.exe 464 sqtvvs.exe 1844 sqtvvs.exe 1068 sqtvvs.exe 1516 sqtvvs.exe 1528 sqtvvs.exe 1764 sqtvvs.exe 820 sqtvvs.exe -
Loads dropped DLL 6 IoCs
Processes:
a26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exepid process 1824 a26595e04bbad90731a04c1195c34d92.exe 1824 a26595e04bbad90731a04c1195c34d92.exe 1524 sqtvvs.exe 1844 sqtvvs.exe 1516 sqtvvs.exe 1764 sqtvvs.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
a26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exedescription pid process target process PID 1828 set thread context of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1524 set thread context of 464 1524 sqtvvs.exe sqtvvs.exe PID 1844 set thread context of 1068 1844 sqtvvs.exe sqtvvs.exe PID 1516 set thread context of 1528 1516 sqtvvs.exe sqtvvs.exe PID 1764 set thread context of 820 1764 sqtvvs.exe sqtvvs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.execmd.exetaskeng.exesqtvvs.exesqtvvs.exesqtvvs.exedescription pid process target process PID 1828 wrote to memory of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1828 wrote to memory of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1828 wrote to memory of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1828 wrote to memory of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1828 wrote to memory of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1828 wrote to memory of 1824 1828 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 1824 wrote to memory of 1524 1824 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 1824 wrote to memory of 1524 1824 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 1824 wrote to memory of 1524 1824 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 1824 wrote to memory of 1524 1824 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 1524 wrote to memory of 464 1524 sqtvvs.exe sqtvvs.exe PID 1524 wrote to memory of 464 1524 sqtvvs.exe sqtvvs.exe PID 1524 wrote to memory of 464 1524 sqtvvs.exe sqtvvs.exe PID 1524 wrote to memory of 464 1524 sqtvvs.exe sqtvvs.exe PID 1524 wrote to memory of 464 1524 sqtvvs.exe sqtvvs.exe PID 1524 wrote to memory of 464 1524 sqtvvs.exe sqtvvs.exe PID 464 wrote to memory of 1504 464 sqtvvs.exe cmd.exe PID 464 wrote to memory of 1504 464 sqtvvs.exe cmd.exe PID 464 wrote to memory of 1504 464 sqtvvs.exe cmd.exe PID 464 wrote to memory of 1504 464 sqtvvs.exe cmd.exe PID 464 wrote to memory of 1852 464 sqtvvs.exe schtasks.exe PID 464 wrote to memory of 1852 464 sqtvvs.exe schtasks.exe PID 464 wrote to memory of 1852 464 sqtvvs.exe schtasks.exe PID 464 wrote to memory of 1852 464 sqtvvs.exe schtasks.exe PID 1504 wrote to memory of 1860 1504 cmd.exe reg.exe PID 1504 wrote to memory of 1860 1504 cmd.exe reg.exe PID 1504 wrote to memory of 1860 1504 cmd.exe reg.exe PID 1504 wrote to memory of 1860 1504 cmd.exe reg.exe PID 784 wrote to memory of 1844 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1844 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1844 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1844 784 taskeng.exe sqtvvs.exe PID 1844 wrote to memory of 1068 1844 sqtvvs.exe sqtvvs.exe PID 1844 wrote to memory of 1068 1844 sqtvvs.exe sqtvvs.exe PID 1844 wrote to memory of 1068 1844 sqtvvs.exe sqtvvs.exe PID 1844 wrote to memory of 1068 1844 sqtvvs.exe sqtvvs.exe PID 1844 wrote to memory of 1068 1844 sqtvvs.exe sqtvvs.exe PID 1844 wrote to memory of 1068 1844 sqtvvs.exe sqtvvs.exe PID 784 wrote to memory of 1516 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1516 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1516 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1516 784 taskeng.exe sqtvvs.exe PID 1516 wrote to memory of 1528 1516 sqtvvs.exe sqtvvs.exe PID 1516 wrote to memory of 1528 1516 sqtvvs.exe sqtvvs.exe PID 1516 wrote to memory of 1528 1516 sqtvvs.exe sqtvvs.exe PID 1516 wrote to memory of 1528 1516 sqtvvs.exe sqtvvs.exe PID 1516 wrote to memory of 1528 1516 sqtvvs.exe sqtvvs.exe PID 1516 wrote to memory of 1528 1516 sqtvvs.exe sqtvvs.exe PID 784 wrote to memory of 1764 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1764 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1764 784 taskeng.exe sqtvvs.exe PID 784 wrote to memory of 1764 784 taskeng.exe sqtvvs.exe PID 1764 wrote to memory of 820 1764 sqtvvs.exe sqtvvs.exe PID 1764 wrote to memory of 820 1764 sqtvvs.exe sqtvvs.exe PID 1764 wrote to memory of 820 1764 sqtvvs.exe sqtvvs.exe PID 1764 wrote to memory of 820 1764 sqtvvs.exe sqtvvs.exe PID 1764 wrote to memory of 820 1764 sqtvvs.exe sqtvvs.exe PID 1764 wrote to memory of 820 1764 sqtvvs.exe sqtvvs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\6⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {511B91C2-23E9-435C-BD3C-517743D021CA} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\15212455352368107708MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15212455352368107708MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15212455352368107708MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15212455352368107708MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
memory/464-77-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/464-71-0x00000000004105EF-mapping.dmp
-
memory/820-99-0x00000000004105EF-mapping.dmp
-
memory/1068-83-0x00000000004105EF-mapping.dmp
-
memory/1504-75-0x0000000000000000-mapping.dmp
-
memory/1516-87-0x0000000000000000-mapping.dmp
-
memory/1524-66-0x0000000000000000-mapping.dmp
-
memory/1528-91-0x00000000004105EF-mapping.dmp
-
memory/1764-95-0x0000000000000000-mapping.dmp
-
memory/1824-63-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1824-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1824-62-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1824-61-0x00000000004105EF-mapping.dmp
-
memory/1844-79-0x0000000000000000-mapping.dmp
-
memory/1852-76-0x0000000000000000-mapping.dmp
-
memory/1860-78-0x0000000000000000-mapping.dmp