Analysis
-
max time kernel
122s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-05-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
Resource
win7-20220414-en
General
-
Target
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
-
Size
383KB
-
MD5
56d9df4afbbaee34afb646e85fb4419d
-
SHA1
0ad215a57d93b70fa3a137060f5f5a3369d4f542
-
SHA256
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
-
SHA512
1178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
Malware Config
Extracted
amadey
3.08
179.43.154.147/d2VxjasuwS/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 66 3172 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
ftewk.exeftewk.exeftewk.exepid process 4568 ftewk.exe 2452 ftewk.exe 1844 ftewk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exeftewk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation ftewk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3172 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4424 3308 WerFault.exe 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1700 2452 WerFault.exe ftewk.exe 2336 1844 WerFault.exe ftewk.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exeftewk.execmd.exedescription pid process target process PID 3308 wrote to memory of 4568 3308 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 3308 wrote to memory of 4568 3308 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 3308 wrote to memory of 4568 3308 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 4568 wrote to memory of 4184 4568 ftewk.exe cmd.exe PID 4568 wrote to memory of 4184 4568 ftewk.exe cmd.exe PID 4568 wrote to memory of 4184 4568 ftewk.exe cmd.exe PID 4568 wrote to memory of 660 4568 ftewk.exe schtasks.exe PID 4568 wrote to memory of 660 4568 ftewk.exe schtasks.exe PID 4568 wrote to memory of 660 4568 ftewk.exe schtasks.exe PID 4184 wrote to memory of 4912 4184 cmd.exe reg.exe PID 4184 wrote to memory of 4912 4184 cmd.exe reg.exe PID 4184 wrote to memory of 4912 4184 cmd.exe reg.exe PID 4568 wrote to memory of 3172 4568 ftewk.exe rundll32.exe PID 4568 wrote to memory of 3172 4568 ftewk.exe rundll32.exe PID 4568 wrote to memory of 3172 4568 ftewk.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 8762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3308 -ip 33081⤵
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2452 -ip 24521⤵
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 5082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1844 -ip 18441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
memory/660-137-0x0000000000000000-mapping.dmp
-
memory/1844-149-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1844-148-0x00000000007F4000-0x0000000000812000-memory.dmpFilesize
120KB
-
memory/2452-142-0x0000000000524000-0x0000000000542000-memory.dmpFilesize
120KB
-
memory/2452-143-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/3172-144-0x0000000000000000-mapping.dmp
-
memory/3308-132-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/3308-130-0x00000000005FE000-0x000000000061C000-memory.dmpFilesize
120KB
-
memory/3308-131-0x0000000000580000-0x00000000005B8000-memory.dmpFilesize
224KB
-
memory/4184-136-0x0000000000000000-mapping.dmp
-
memory/4568-133-0x0000000000000000-mapping.dmp
-
memory/4568-140-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4568-139-0x00000000005EE000-0x000000000060C000-memory.dmpFilesize
120KB
-
memory/4912-138-0x0000000000000000-mapping.dmp