Analysis
-
max time kernel
112s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-05-2022 16:37
Static task
static1
Behavioral task
behavioral1
Sample
00abc3cdf40d724b3bbaf8cb2de12d95.exe
Resource
win7-20220414-en
General
-
Target
00abc3cdf40d724b3bbaf8cb2de12d95.exe
-
Size
319KB
-
MD5
00abc3cdf40d724b3bbaf8cb2de12d95
-
SHA1
529cfe8010a6541a0c7accd33ae02a5237f58301
-
SHA256
69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
-
SHA512
414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
Malware Config
Extracted
amadey
3.10
199.188.204.245/f8dfksdj3/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 1944 rundll32.exe -
Executes dropped EXE 3 IoCs
Processes:
orxds.exeorxds.exeorxds.exepid process 948 orxds.exe 1856 orxds.exe 2032 orxds.exe -
Loads dropped DLL 6 IoCs
Processes:
00abc3cdf40d724b3bbaf8cb2de12d95.exerundll32.exepid process 904 00abc3cdf40d724b3bbaf8cb2de12d95.exe 904 00abc3cdf40d724b3bbaf8cb2de12d95.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
00abc3cdf40d724b3bbaf8cb2de12d95.exeorxds.execmd.exetaskeng.exedescription pid process target process PID 904 wrote to memory of 948 904 00abc3cdf40d724b3bbaf8cb2de12d95.exe orxds.exe PID 904 wrote to memory of 948 904 00abc3cdf40d724b3bbaf8cb2de12d95.exe orxds.exe PID 904 wrote to memory of 948 904 00abc3cdf40d724b3bbaf8cb2de12d95.exe orxds.exe PID 904 wrote to memory of 948 904 00abc3cdf40d724b3bbaf8cb2de12d95.exe orxds.exe PID 948 wrote to memory of 1836 948 orxds.exe cmd.exe PID 948 wrote to memory of 1836 948 orxds.exe cmd.exe PID 948 wrote to memory of 1836 948 orxds.exe cmd.exe PID 948 wrote to memory of 1836 948 orxds.exe cmd.exe PID 948 wrote to memory of 1636 948 orxds.exe schtasks.exe PID 948 wrote to memory of 1636 948 orxds.exe schtasks.exe PID 948 wrote to memory of 1636 948 orxds.exe schtasks.exe PID 948 wrote to memory of 1636 948 orxds.exe schtasks.exe PID 1836 wrote to memory of 1828 1836 cmd.exe reg.exe PID 1836 wrote to memory of 1828 1836 cmd.exe reg.exe PID 1836 wrote to memory of 1828 1836 cmd.exe reg.exe PID 1836 wrote to memory of 1828 1836 cmd.exe reg.exe PID 896 wrote to memory of 1856 896 taskeng.exe orxds.exe PID 896 wrote to memory of 1856 896 taskeng.exe orxds.exe PID 896 wrote to memory of 1856 896 taskeng.exe orxds.exe PID 896 wrote to memory of 1856 896 taskeng.exe orxds.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 948 wrote to memory of 1944 948 orxds.exe rundll32.exe PID 896 wrote to memory of 2032 896 taskeng.exe orxds.exe PID 896 wrote to memory of 2032 896 taskeng.exe orxds.exe PID 896 wrote to memory of 2032 896 taskeng.exe orxds.exe PID 896 wrote to memory of 2032 896 taskeng.exe orxds.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00abc3cdf40d724b3bbaf8cb2de12d95.exe"C:\Users\Admin\AppData\Local\Temp\00abc3cdf40d724b3bbaf8cb2de12d95.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe"C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\70d66d8271\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\70d66d8271\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\system32\taskeng.exetaskeng.exe {F9A92814-BB8B-49A9-BCF5-8932A280C06D} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeC:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeC:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
memory/904-61-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/904-54-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB
-
memory/904-59-0x000000000058E000-0x00000000005AC000-memory.dmpFilesize
120KB
-
memory/904-60-0x00000000002B0000-0x00000000002E8000-memory.dmpFilesize
224KB
-
memory/948-66-0x00000000002CE000-0x00000000002EC000-memory.dmpFilesize
120KB
-
memory/948-57-0x0000000000000000-mapping.dmp
-
memory/948-67-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/1636-64-0x0000000000000000-mapping.dmp
-
memory/1828-65-0x0000000000000000-mapping.dmp
-
memory/1836-63-0x0000000000000000-mapping.dmp
-
memory/1856-72-0x00000000005BE000-0x00000000005DC000-memory.dmpFilesize
120KB
-
memory/1856-73-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/1856-69-0x0000000000000000-mapping.dmp
-
memory/1944-74-0x0000000000000000-mapping.dmp
-
memory/1944-81-0x00000000001E0000-0x0000000000204000-memory.dmpFilesize
144KB
-
memory/2032-82-0x0000000000000000-mapping.dmp
-
memory/2032-85-0x000000000096E000-0x000000000098C000-memory.dmpFilesize
120KB
-
memory/2032-86-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB