Analysis
-
max time kernel
117s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 07:55
Static task
static1
Behavioral task
behavioral1
Sample
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
Resource
win7-20220414-en
General
-
Target
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
-
Size
336KB
-
MD5
53f54f7688b7becf3f68ca1ac3cb3565
-
SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136
-
SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
-
SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
Malware Config
Extracted
amadey
3.10
185.215.113.35/d2VxjasuwS_old/index.php
Signatures
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Executes dropped EXE 3 IoCs
Processes:
orxds.exeorxds.exeorxds.exepid process 4752 orxds.exe 4556 orxds.exe 4484 orxds.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exeorxds.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation orxds.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1168 2060 WerFault.exe 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe 1816 4556 WerFault.exe orxds.exe 3668 4484 WerFault.exe orxds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exeorxds.execmd.exedescription pid process target process PID 2060 wrote to memory of 4752 2060 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 2060 wrote to memory of 4752 2060 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 2060 wrote to memory of 4752 2060 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe orxds.exe PID 4752 wrote to memory of 3952 4752 orxds.exe cmd.exe PID 4752 wrote to memory of 3952 4752 orxds.exe cmd.exe PID 4752 wrote to memory of 3952 4752 orxds.exe cmd.exe PID 4752 wrote to memory of 1220 4752 orxds.exe schtasks.exe PID 4752 wrote to memory of 1220 4752 orxds.exe schtasks.exe PID 4752 wrote to memory of 1220 4752 orxds.exe schtasks.exe PID 3952 wrote to memory of 4620 3952 cmd.exe reg.exe PID 3952 wrote to memory of 4620 3952 cmd.exe reg.exe PID 3952 wrote to memory of 4620 3952 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe"C:\Users\Admin\AppData\Local\Temp\74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\d273120da5\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\d273120da5\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 11122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2060 -ip 20601⤵
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeC:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4556 -ip 45561⤵
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeC:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4484 -ip 44841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exeFilesize
336KB
MD553f54f7688b7becf3f68ca1ac3cb3565
SHA1b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA25674e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad
-
memory/1220-137-0x0000000000000000-mapping.dmp
-
memory/2060-130-0x0000000002D0E000-0x0000000002D2C000-memory.dmpFilesize
120KB
-
memory/2060-132-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/2060-131-0x00000000048D0000-0x0000000004908000-memory.dmpFilesize
224KB
-
memory/3952-136-0x0000000000000000-mapping.dmp
-
memory/4484-146-0x0000000002CE1000-0x0000000002CFF000-memory.dmpFilesize
120KB
-
memory/4484-147-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/4556-143-0x0000000002DE1000-0x0000000002DFF000-memory.dmpFilesize
120KB
-
memory/4556-144-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/4620-138-0x0000000000000000-mapping.dmp
-
memory/4752-139-0x0000000002BDD000-0x0000000002BFB000-memory.dmpFilesize
120KB
-
memory/4752-140-0x0000000004670000-0x00000000046A8000-memory.dmpFilesize
224KB
-
memory/4752-141-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/4752-133-0x0000000000000000-mapping.dmp