Analysis
-
max time kernel
103s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-05-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
Resource
win7-20220414-en
General
-
Target
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
-
Size
383KB
-
MD5
56d9df4afbbaee34afb646e85fb4419d
-
SHA1
0ad215a57d93b70fa3a137060f5f5a3369d4f542
-
SHA256
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
-
SHA512
1178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
Malware Config
Extracted
amadey
3.08
179.43.154.147/d2VxjasuwS/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 1192 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
ftewk.exeftewk.exepid process 1944 ftewk.exe 1876 ftewk.exe -
Loads dropped DLL 6 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exerundll32.exepid process 1864 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1864 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1192 rundll32.exe 1192 rundll32.exe 1192 rundll32.exe 1192 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1192 rundll32.exe 1192 rundll32.exe 1192 rundll32.exe 1192 rundll32.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exeftewk.execmd.exetaskeng.exedescription pid process target process PID 1864 wrote to memory of 1944 1864 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1864 wrote to memory of 1944 1864 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1864 wrote to memory of 1944 1864 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1864 wrote to memory of 1944 1864 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1944 wrote to memory of 1600 1944 ftewk.exe cmd.exe PID 1944 wrote to memory of 1600 1944 ftewk.exe cmd.exe PID 1944 wrote to memory of 1600 1944 ftewk.exe cmd.exe PID 1944 wrote to memory of 1600 1944 ftewk.exe cmd.exe PID 1944 wrote to memory of 1708 1944 ftewk.exe schtasks.exe PID 1944 wrote to memory of 1708 1944 ftewk.exe schtasks.exe PID 1944 wrote to memory of 1708 1944 ftewk.exe schtasks.exe PID 1944 wrote to memory of 1708 1944 ftewk.exe schtasks.exe PID 1600 wrote to memory of 1552 1600 cmd.exe reg.exe PID 1600 wrote to memory of 1552 1600 cmd.exe reg.exe PID 1600 wrote to memory of 1552 1600 cmd.exe reg.exe PID 1600 wrote to memory of 1552 1600 cmd.exe reg.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1944 wrote to memory of 1192 1944 ftewk.exe rundll32.exe PID 1568 wrote to memory of 1876 1568 taskeng.exe ftewk.exe PID 1568 wrote to memory of 1876 1568 taskeng.exe ftewk.exe PID 1568 wrote to memory of 1876 1568 taskeng.exe ftewk.exe PID 1568 wrote to memory of 1876 1568 taskeng.exe ftewk.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\system32\taskeng.exetaskeng.exe {1AA27760-EEB6-4FE5-8E50-D237CC4F74AA} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
memory/1192-75-0x0000000000130000-0x0000000000154000-memory.dmpFilesize
144KB
-
memory/1192-68-0x0000000000000000-mapping.dmp
-
memory/1552-65-0x0000000000000000-mapping.dmp
-
memory/1600-63-0x0000000000000000-mapping.dmp
-
memory/1708-64-0x0000000000000000-mapping.dmp
-
memory/1864-61-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1864-60-0x00000000002B0000-0x00000000002E8000-memory.dmpFilesize
224KB
-
memory/1864-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1864-59-0x000000000054E000-0x000000000056C000-memory.dmpFilesize
120KB
-
memory/1876-77-0x0000000000000000-mapping.dmp
-
memory/1876-80-0x000000000054E000-0x000000000056C000-memory.dmpFilesize
120KB
-
memory/1876-81-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1944-67-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1944-66-0x000000000065E000-0x000000000067C000-memory.dmpFilesize
120KB
-
memory/1944-57-0x0000000000000000-mapping.dmp