Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 00:05
Static task
static1
Behavioral task
behavioral1
Sample
a26595e04bbad90731a04c1195c34d92.exe
Resource
win7v20210408
General
-
Target
a26595e04bbad90731a04c1195c34d92.exe
-
Size
1.4MB
-
MD5
a26595e04bbad90731a04c1195c34d92
-
SHA1
0b295fa12e6bd596ba0071a58370966c6a4551c3
-
SHA256
c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
-
SHA512
ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
Malware Config
Extracted
amadey
2.61
185.215.113.33/hBF6ds2D/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Executes dropped EXE 6 IoCs
Processes:
sqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exepid process 836 sqtvvs.exe 1116 sqtvvs.exe 1432 sqtvvs.exe 1768 sqtvvs.exe 1784 sqtvvs.exe 1416 sqtvvs.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
a26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.exesqtvvs.exedescription pid process target process PID 648 set thread context of 668 648 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 836 set thread context of 1116 836 sqtvvs.exe sqtvvs.exe PID 1432 set thread context of 1768 1432 sqtvvs.exe sqtvvs.exe PID 1784 set thread context of 1416 1784 sqtvvs.exe sqtvvs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.execmd.exesqtvvs.exesqtvvs.exedescription pid process target process PID 648 wrote to memory of 668 648 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 648 wrote to memory of 668 648 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 648 wrote to memory of 668 648 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 648 wrote to memory of 668 648 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 648 wrote to memory of 668 648 a26595e04bbad90731a04c1195c34d92.exe a26595e04bbad90731a04c1195c34d92.exe PID 668 wrote to memory of 836 668 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 668 wrote to memory of 836 668 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 668 wrote to memory of 836 668 a26595e04bbad90731a04c1195c34d92.exe sqtvvs.exe PID 836 wrote to memory of 1116 836 sqtvvs.exe sqtvvs.exe PID 836 wrote to memory of 1116 836 sqtvvs.exe sqtvvs.exe PID 836 wrote to memory of 1116 836 sqtvvs.exe sqtvvs.exe PID 836 wrote to memory of 1116 836 sqtvvs.exe sqtvvs.exe PID 836 wrote to memory of 1116 836 sqtvvs.exe sqtvvs.exe PID 1116 wrote to memory of 1416 1116 sqtvvs.exe cmd.exe PID 1116 wrote to memory of 1416 1116 sqtvvs.exe cmd.exe PID 1116 wrote to memory of 1416 1116 sqtvvs.exe cmd.exe PID 1116 wrote to memory of 1508 1116 sqtvvs.exe schtasks.exe PID 1116 wrote to memory of 1508 1116 sqtvvs.exe schtasks.exe PID 1116 wrote to memory of 1508 1116 sqtvvs.exe schtasks.exe PID 1416 wrote to memory of 2144 1416 cmd.exe reg.exe PID 1416 wrote to memory of 2144 1416 cmd.exe reg.exe PID 1416 wrote to memory of 2144 1416 cmd.exe reg.exe PID 1432 wrote to memory of 1768 1432 sqtvvs.exe sqtvvs.exe PID 1432 wrote to memory of 1768 1432 sqtvvs.exe sqtvvs.exe PID 1432 wrote to memory of 1768 1432 sqtvvs.exe sqtvvs.exe PID 1432 wrote to memory of 1768 1432 sqtvvs.exe sqtvvs.exe PID 1432 wrote to memory of 1768 1432 sqtvvs.exe sqtvvs.exe PID 1784 wrote to memory of 1416 1784 sqtvvs.exe sqtvvs.exe PID 1784 wrote to memory of 1416 1784 sqtvvs.exe sqtvvs.exe PID 1784 wrote to memory of 1416 1784 sqtvvs.exe sqtvvs.exe PID 1784 wrote to memory of 1416 1784 sqtvvs.exe sqtvvs.exe PID 1784 wrote to memory of 1416 1784 sqtvvs.exe sqtvvs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\6⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\15211594587808204709MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15211594587808204709MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15211594587808204709MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exeMD5
a26595e04bbad90731a04c1195c34d92
SHA10b295fa12e6bd596ba0071a58370966c6a4551c3
SHA256c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573
SHA512ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934
-
memory/668-115-0x00000000004105EF-mapping.dmp
-
memory/668-114-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/668-116-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/836-117-0x0000000000000000-mapping.dmp
-
memory/1116-127-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1116-121-0x00000000004105EF-mapping.dmp
-
memory/1416-124-0x0000000000000000-mapping.dmp
-
memory/1416-139-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1416-136-0x00000000004105EF-mapping.dmp
-
memory/1508-125-0x0000000000000000-mapping.dmp
-
memory/1768-133-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1768-130-0x00000000004105EF-mapping.dmp
-
memory/2144-126-0x0000000000000000-mapping.dmp