Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 06:01
Static task
static1
Behavioral task
behavioral1
Sample
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe
Resource
win7-en-20211208
General
-
Target
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe
-
Size
2.5MB
-
MD5
3d01438bfca0d5786c9e473f087c4c56
-
SHA1
ec905150408d52283b26c1b283fbf537d9423114
-
SHA256
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073
-
SHA512
ea236c2b5308345dbe49eab90615a0c9a7d53f6781b427d899de45e3a54236036d352079b7896101c8eea3ff6f1300e758857d8e86d2054a72219c2030c499a6
Malware Config
Extracted
amadey
2.50
depressionk1d.ug/k8FppT/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
rnyuf.exernyuf.exernyuf.exepid process 1100 rnyuf.exe 1856 rnyuf.exe 960 rnyuf.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rnyuf.exernyuf.exernyuf.execdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rnyuf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rnyuf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rnyuf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rnyuf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rnyuf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rnyuf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe -
Loads dropped DLL 1 IoCs
Processes:
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exepid process 1488 cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe -
Processes:
resource yara_rule behavioral1/memory/1488-57-0x0000000000360000-0x00000000009E8000-memory.dmp themida behavioral1/memory/1488-58-0x0000000000360000-0x00000000009E8000-memory.dmp themida behavioral1/memory/1488-59-0x0000000000360000-0x00000000009E8000-memory.dmp themida \Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe themida C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe themida behavioral1/memory/1100-63-0x00000000013B0000-0x0000000001A38000-memory.dmp themida behavioral1/memory/1100-64-0x00000000013B0000-0x0000000001A38000-memory.dmp themida behavioral1/memory/1100-65-0x00000000013B0000-0x0000000001A38000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe themida C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe themida behavioral1/memory/1856-71-0x00000000013B0000-0x0000000001A38000-memory.dmp themida behavioral1/memory/1856-70-0x00000000013B0000-0x0000000001A38000-memory.dmp themida behavioral1/memory/1856-72-0x00000000013B0000-0x0000000001A38000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe themida behavioral1/memory/960-76-0x00000000013B0000-0x0000000001A38000-memory.dmp themida behavioral1/memory/960-77-0x00000000013B0000-0x0000000001A38000-memory.dmp themida behavioral1/memory/960-78-0x00000000013B0000-0x0000000001A38000-memory.dmp themida -
Processes:
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exernyuf.exernyuf.exernyuf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rnyuf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rnyuf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rnyuf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exernyuf.exernyuf.exernyuf.exepid process 1488 cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe 1100 rnyuf.exe 1856 rnyuf.exe 960 rnyuf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exernyuf.execmd.exetaskeng.exedescription pid process target process PID 1488 wrote to memory of 1100 1488 cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe rnyuf.exe PID 1488 wrote to memory of 1100 1488 cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe rnyuf.exe PID 1488 wrote to memory of 1100 1488 cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe rnyuf.exe PID 1488 wrote to memory of 1100 1488 cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe rnyuf.exe PID 1100 wrote to memory of 1360 1100 rnyuf.exe cmd.exe PID 1100 wrote to memory of 1360 1100 rnyuf.exe cmd.exe PID 1100 wrote to memory of 1360 1100 rnyuf.exe cmd.exe PID 1100 wrote to memory of 1360 1100 rnyuf.exe cmd.exe PID 1100 wrote to memory of 368 1100 rnyuf.exe schtasks.exe PID 1100 wrote to memory of 368 1100 rnyuf.exe schtasks.exe PID 1100 wrote to memory of 368 1100 rnyuf.exe schtasks.exe PID 1100 wrote to memory of 368 1100 rnyuf.exe schtasks.exe PID 1360 wrote to memory of 1180 1360 cmd.exe reg.exe PID 1360 wrote to memory of 1180 1360 cmd.exe reg.exe PID 1360 wrote to memory of 1180 1360 cmd.exe reg.exe PID 1360 wrote to memory of 1180 1360 cmd.exe reg.exe PID 620 wrote to memory of 1856 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 1856 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 1856 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 1856 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 960 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 960 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 960 620 taskeng.exe rnyuf.exe PID 620 wrote to memory of 960 620 taskeng.exe rnyuf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe"C:\Users\Admin\AppData\Local\Temp\cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe"C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5c436eadc6\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5c436eadc6\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {3E7663B0-F2AD-411A-8DF6-7398497391A5} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeC:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeC:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\15212329389628406418MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15212329389628406418MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\15212329389628406418MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeMD5
3d01438bfca0d5786c9e473f087c4c56
SHA1ec905150408d52283b26c1b283fbf537d9423114
SHA256cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073
SHA512ea236c2b5308345dbe49eab90615a0c9a7d53f6781b427d899de45e3a54236036d352079b7896101c8eea3ff6f1300e758857d8e86d2054a72219c2030c499a6
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeMD5
3d01438bfca0d5786c9e473f087c4c56
SHA1ec905150408d52283b26c1b283fbf537d9423114
SHA256cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073
SHA512ea236c2b5308345dbe49eab90615a0c9a7d53f6781b427d899de45e3a54236036d352079b7896101c8eea3ff6f1300e758857d8e86d2054a72219c2030c499a6
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeMD5
3d01438bfca0d5786c9e473f087c4c56
SHA1ec905150408d52283b26c1b283fbf537d9423114
SHA256cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073
SHA512ea236c2b5308345dbe49eab90615a0c9a7d53f6781b427d899de45e3a54236036d352079b7896101c8eea3ff6f1300e758857d8e86d2054a72219c2030c499a6
-
C:\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeMD5
3d01438bfca0d5786c9e473f087c4c56
SHA1ec905150408d52283b26c1b283fbf537d9423114
SHA256cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073
SHA512ea236c2b5308345dbe49eab90615a0c9a7d53f6781b427d899de45e3a54236036d352079b7896101c8eea3ff6f1300e758857d8e86d2054a72219c2030c499a6
-
\Users\Admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeMD5
3d01438bfca0d5786c9e473f087c4c56
SHA1ec905150408d52283b26c1b283fbf537d9423114
SHA256cdeeb0f1b8c30d1e55998094064f46c523d637776a16fea2ef92aeefd79f7073
SHA512ea236c2b5308345dbe49eab90615a0c9a7d53f6781b427d899de45e3a54236036d352079b7896101c8eea3ff6f1300e758857d8e86d2054a72219c2030c499a6
-
memory/960-78-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/960-77-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/960-76-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/1100-64-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/1100-65-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/1100-63-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/1488-57-0x0000000000360000-0x00000000009E8000-memory.dmpFilesize
6.5MB
-
memory/1488-58-0x0000000000360000-0x00000000009E8000-memory.dmpFilesize
6.5MB
-
memory/1488-59-0x0000000000360000-0x00000000009E8000-memory.dmpFilesize
6.5MB
-
memory/1488-55-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1488-56-0x0000000077CE0000-0x0000000077CE2000-memory.dmpFilesize
8KB
-
memory/1856-72-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/1856-70-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB
-
memory/1856-71-0x00000000013B0000-0x0000000001A38000-memory.dmpFilesize
6.5MB