Analysis
-
max time kernel
113s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
31/10/2022, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
268KB
-
MD5
5a5e87d1ca5b3b323a603ccef736119a
-
SHA1
a52a3d51df3ad463229bc2148d6767ba60199425
-
SHA256
e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
-
SHA512
03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
SSDEEP
6144:myNxdxQ0qLfl0H1R+4qzLR3Z69Zrsf3AKvAlx:myfdaZbS184o3Z69ZreMlx
Malware Config
Signatures
-
Detect Amadey credential stealer module 5 IoCs
resource yara_rule behavioral1/files/0x0008000000012330-75.dat amadey_cred_module behavioral1/files/0x0008000000012330-76.dat amadey_cred_module behavioral1/files/0x0008000000012330-79.dat amadey_cred_module behavioral1/files/0x0008000000012330-78.dat amadey_cred_module behavioral1/files/0x0008000000012330-77.dat amadey_cred_module -
Blocklisted process makes network request 1 IoCs
flow pid Process 5 860 rundll32.exe -
Executes dropped EXE 3 IoCs
pid Process 760 rovwer.exe 832 rovwer.exe 1980 rovwer.exe -
Loads dropped DLL 6 IoCs
pid Process 1436 file.exe 1436 file.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1436 wrote to memory of 760 1436 file.exe 27 PID 1436 wrote to memory of 760 1436 file.exe 27 PID 1436 wrote to memory of 760 1436 file.exe 27 PID 1436 wrote to memory of 760 1436 file.exe 27 PID 760 wrote to memory of 552 760 rovwer.exe 28 PID 760 wrote to memory of 552 760 rovwer.exe 28 PID 760 wrote to memory of 552 760 rovwer.exe 28 PID 760 wrote to memory of 552 760 rovwer.exe 28 PID 1260 wrote to memory of 832 1260 taskeng.exe 33 PID 1260 wrote to memory of 832 1260 taskeng.exe 33 PID 1260 wrote to memory of 832 1260 taskeng.exe 33 PID 1260 wrote to memory of 832 1260 taskeng.exe 33 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 760 wrote to memory of 860 760 rovwer.exe 34 PID 1260 wrote to memory of 1980 1260 taskeng.exe 35 PID 1260 wrote to memory of 1980 1260 taskeng.exe 35 PID 1260 wrote to memory of 1980 1260 taskeng.exe 35 PID 1260 wrote to memory of 1980 1260 taskeng.exe 35 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:552
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:860
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F02B6401-4CD8-44CA-8DF0-ABD4E98F6BA7} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exeC:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe2⤵
- Executes dropped EXE
PID:832
-
-
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exeC:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe2⤵
- Executes dropped EXE
PID:1980
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD55a5e87d1ca5b3b323a603ccef736119a
SHA1a52a3d51df3ad463229bc2148d6767ba60199425
SHA256e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
SHA51203b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
Filesize
268KB
MD55a5e87d1ca5b3b323a603ccef736119a
SHA1a52a3d51df3ad463229bc2148d6767ba60199425
SHA256e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
SHA51203b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
Filesize
268KB
MD55a5e87d1ca5b3b323a603ccef736119a
SHA1a52a3d51df3ad463229bc2148d6767ba60199425
SHA256e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
SHA51203b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
Filesize
268KB
MD55a5e87d1ca5b3b323a603ccef736119a
SHA1a52a3d51df3ad463229bc2148d6767ba60199425
SHA256e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
SHA51203b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
-
Filesize
268KB
MD55a5e87d1ca5b3b323a603ccef736119a
SHA1a52a3d51df3ad463229bc2148d6767ba60199425
SHA256e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
SHA51203b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
Filesize
268KB
MD55a5e87d1ca5b3b323a603ccef736119a
SHA1a52a3d51df3ad463229bc2148d6767ba60199425
SHA256e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80
SHA51203b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7