Analysis
-
max time kernel
127s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-05-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
Resource
win7-20220414-en
General
-
Target
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
-
Size
383KB
-
MD5
56d9df4afbbaee34afb646e85fb4419d
-
SHA1
0ad215a57d93b70fa3a137060f5f5a3369d4f542
-
SHA256
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
-
SHA512
1178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
Malware Config
Extracted
amadey
3.08
179.43.154.147/d2VxjasuwS/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 5 1800 rundll32.exe -
Executes dropped EXE 3 IoCs
Processes:
ftewk.exeftewk.exeftewk.exepid process 624 ftewk.exe 2040 ftewk.exe 1348 ftewk.exe -
Loads dropped DLL 6 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exerundll32.exepid process 1564 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1564 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1800 rundll32.exe 1800 rundll32.exe 1800 rundll32.exe 1800 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1800 rundll32.exe 1800 rundll32.exe 1800 rundll32.exe 1800 rundll32.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exeftewk.execmd.exetaskeng.exedescription pid process target process PID 1564 wrote to memory of 624 1564 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1564 wrote to memory of 624 1564 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1564 wrote to memory of 624 1564 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1564 wrote to memory of 624 1564 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 624 wrote to memory of 2044 624 ftewk.exe cmd.exe PID 624 wrote to memory of 2044 624 ftewk.exe cmd.exe PID 624 wrote to memory of 2044 624 ftewk.exe cmd.exe PID 624 wrote to memory of 2044 624 ftewk.exe cmd.exe PID 624 wrote to memory of 1756 624 ftewk.exe schtasks.exe PID 624 wrote to memory of 1756 624 ftewk.exe schtasks.exe PID 624 wrote to memory of 1756 624 ftewk.exe schtasks.exe PID 624 wrote to memory of 1756 624 ftewk.exe schtasks.exe PID 2044 wrote to memory of 1968 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1968 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1968 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1968 2044 cmd.exe reg.exe PID 772 wrote to memory of 2040 772 taskeng.exe ftewk.exe PID 772 wrote to memory of 2040 772 taskeng.exe ftewk.exe PID 772 wrote to memory of 2040 772 taskeng.exe ftewk.exe PID 772 wrote to memory of 2040 772 taskeng.exe ftewk.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 624 wrote to memory of 1800 624 ftewk.exe rundll32.exe PID 772 wrote to memory of 1348 772 taskeng.exe ftewk.exe PID 772 wrote to memory of 1348 772 taskeng.exe ftewk.exe PID 772 wrote to memory of 1348 772 taskeng.exe ftewk.exe PID 772 wrote to memory of 1348 772 taskeng.exe ftewk.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\system32\taskeng.exetaskeng.exe {4A52CAAC-922D-4783-A94D-C9EA25FBC0F1} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
memory/624-58-0x0000000000000000-mapping.dmp
-
memory/624-66-0x000000000066E000-0x000000000068C000-memory.dmpFilesize
120KB
-
memory/624-67-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1348-85-0x000000000055E000-0x000000000057C000-memory.dmpFilesize
120KB
-
memory/1348-82-0x0000000000000000-mapping.dmp
-
memory/1348-86-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1564-57-0x00000000002AE000-0x00000000002CC000-memory.dmpFilesize
120KB
-
memory/1564-59-0x0000000000640000-0x0000000000678000-memory.dmpFilesize
224KB
-
memory/1564-60-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1564-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1756-64-0x0000000000000000-mapping.dmp
-
memory/1800-81-0x00000000001E0000-0x0000000000204000-memory.dmpFilesize
144KB
-
memory/1800-74-0x0000000000000000-mapping.dmp
-
memory/1968-65-0x0000000000000000-mapping.dmp
-
memory/2040-73-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2040-72-0x00000000005BE000-0x00000000005DC000-memory.dmpFilesize
120KB
-
memory/2040-69-0x0000000000000000-mapping.dmp
-
memory/2044-63-0x0000000000000000-mapping.dmp