Analysis
-
max time kernel
153s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-05-2022 07:47
Static task
static1
Behavioral task
behavioral1
Sample
69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe
Resource
win7-20220414-en
General
-
Target
69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe
-
Size
319KB
-
MD5
00abc3cdf40d724b3bbaf8cb2de12d95
-
SHA1
529cfe8010a6541a0c7accd33ae02a5237f58301
-
SHA256
69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
-
SHA512
414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
Malware Config
Extracted
amadey
3.10
199.188.204.245/f8dfksdj3/index.php
Extracted
vidar
52.2
1376
https://t.me/netflixaccsfree
https://mastodon.social/@ronxik12
-
profile_id
1376
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4804-148-0x0000000000920000-0x000000000096E000-memory.dmp family_vidar behavioral2/memory/4804-149-0x0000000000400000-0x00000000004B1000-memory.dmp family_vidar -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 47 8 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
orxds.exeorxds.exeorxds.exeorxds.exeorxds.exepid process 4736 orxds.exe 4804 orxds.exe 4180 orxds.exe 4596 orxds.exe 736 orxds.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exeorxds.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation orxds.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 8 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
orxds.exedescription pid process target process PID 4736 set thread context of 4804 4736 orxds.exe orxds.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3580 2212 WerFault.exe 69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe 2960 4180 WerFault.exe orxds.exe 2240 4596 WerFault.exe orxds.exe 1152 736 WerFault.exe orxds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 8 rundll32.exe 8 rundll32.exe 8 rundll32.exe 8 rundll32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exeorxds.execmd.exedescription pid process target process PID 2212 wrote to memory of 4736 2212 69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe orxds.exe PID 2212 wrote to memory of 4736 2212 69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe orxds.exe PID 2212 wrote to memory of 4736 2212 69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe orxds.exe PID 4736 wrote to memory of 2812 4736 orxds.exe cmd.exe PID 4736 wrote to memory of 2812 4736 orxds.exe cmd.exe PID 4736 wrote to memory of 2812 4736 orxds.exe cmd.exe PID 4736 wrote to memory of 5112 4736 orxds.exe schtasks.exe PID 4736 wrote to memory of 5112 4736 orxds.exe schtasks.exe PID 4736 wrote to memory of 5112 4736 orxds.exe schtasks.exe PID 2812 wrote to memory of 2820 2812 cmd.exe reg.exe PID 2812 wrote to memory of 2820 2812 cmd.exe reg.exe PID 2812 wrote to memory of 2820 2812 cmd.exe reg.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 4804 4736 orxds.exe orxds.exe PID 4736 wrote to memory of 8 4736 orxds.exe rundll32.exe PID 4736 wrote to memory of 8 4736 orxds.exe rundll32.exe PID 4736 wrote to memory of 8 4736 orxds.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe"C:\Users\Admin\AppData\Local\Temp\69db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe"C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\70d66d8271\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\70d66d8271\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe"C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 12522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2212 -ip 22121⤵
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeC:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 4922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4180 -ip 41801⤵
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeC:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 4962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4596 -ip 45961⤵
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeC:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 736 -ip 7361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Local\Temp\70d66d8271\orxds.exeFilesize
319KB
MD500abc3cdf40d724b3bbaf8cb2de12d95
SHA1529cfe8010a6541a0c7accd33ae02a5237f58301
SHA25669db771b992adb89ed17465f8c448b1a44c5f99ef7e73fe1dae45982790cae5e
SHA512414218603c46f6a8e0fe27dc8ec9c83979dd7be8ebc4c89cfd1d795dadaaf3466ef6d0ef953b3ce0d660dfa6b615b31e878ccd57c21aedb1b09f886e7dfb830e
-
C:\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
C:\Users\Admin\AppData\Roaming\95ae2649e6d72d\cred.dllFilesize
126KB
MD5210d9d14509f0bc2c26c87ba5fef4108
SHA18f4443a8cdfe1ff2156c3a1abd3371e778a2806f
SHA256993c8664fac2e9aefc6cd25b3b435d6358fccc98119faedadbd68679281c0b77
SHA51268250b674fff40870d5102760b9064e3483850f91d64a2fe395bea0058559b79daa5ad867d7578fe875d7ead415801eb99b49718912799e69683df66036c8095
-
memory/8-153-0x0000000000000000-mapping.dmp
-
memory/736-161-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/736-160-0x00000000007B0000-0x00000000007CE000-memory.dmpFilesize
120KB
-
memory/2212-130-0x000000000074C000-0x000000000076A000-memory.dmpFilesize
120KB
-
memory/2212-132-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/2212-131-0x0000000000630000-0x0000000000668000-memory.dmpFilesize
224KB
-
memory/2812-136-0x0000000000000000-mapping.dmp
-
memory/2820-138-0x0000000000000000-mapping.dmp
-
memory/4180-151-0x00000000006D0000-0x00000000006EE000-memory.dmpFilesize
120KB
-
memory/4180-152-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/4596-158-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/4596-157-0x00000000007B0000-0x00000000007CE000-memory.dmpFilesize
120KB
-
memory/4736-140-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/4736-133-0x0000000000000000-mapping.dmp
-
memory/4736-139-0x00000000006AC000-0x00000000006CA000-memory.dmpFilesize
120KB
-
memory/4804-145-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4804-142-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4804-141-0x0000000000000000-mapping.dmp
-
memory/4804-144-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4804-146-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4804-149-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4804-148-0x0000000000920000-0x000000000096E000-memory.dmpFilesize
312KB
-
memory/4804-147-0x000000000050A000-0x0000000000538000-memory.dmpFilesize
184KB
-
memory/5112-137-0x0000000000000000-mapping.dmp