Analysis
-
max time kernel
114s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2022 02:59
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
252KB
-
MD5
56cc19876a0f45d09f7f409289b254b6
-
SHA1
624dab4529371a4da07ed1c37be63184c037e859
-
SHA256
6afdfee605fea7f98b5be7fd4a50bc24181929a22530fdd01c2bc4f012ee4ba2
-
SHA512
5234e7f0145d03bed39483dfd58d060a9a831e5fa355f9516b96fb1c36cd75d802592c9974aa42c78e9be4255a4a0d0eebc44d676baeaeee9bfc0d97505bcef7
-
SSDEEP
6144:EZ0w6vThLZILheYji+H+0n3Tp9/TNzuLO7C:EZ0w6l9ILheYuXaTfNkg
Malware Config
Signatures
-
Detect Amadey credential stealer module 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module behavioral2/memory/1112-162-0x00000000009D0000-0x00000000009F4000-memory.dmp amadey_cred_module C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 82 1112 rundll32.exe 88 2564 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
rovwer.exelego.exerovwer.exerovwer.exerovwer.exepid process 4248 rovwer.exe 2212 lego.exe 1088 rovwer.exe 4736 rovwer.exe 4696 rovwer.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exerovwer.exelego.exerovwer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation rovwer.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation lego.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation rovwer.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exepid process 1112 rundll32.exe 1112 rundll32.exe 2564 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lego.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004001\\lego.exe" rovwer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3488 3352 WerFault.exe file.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4376 schtasks.exe 4856 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exerundll32.exepid process 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
file.exerovwer.exelego.exerovwer.execmd.exedescription pid process target process PID 3352 wrote to memory of 4248 3352 file.exe rovwer.exe PID 3352 wrote to memory of 4248 3352 file.exe rovwer.exe PID 3352 wrote to memory of 4248 3352 file.exe rovwer.exe PID 4248 wrote to memory of 4376 4248 rovwer.exe schtasks.exe PID 4248 wrote to memory of 4376 4248 rovwer.exe schtasks.exe PID 4248 wrote to memory of 4376 4248 rovwer.exe schtasks.exe PID 4248 wrote to memory of 2212 4248 rovwer.exe lego.exe PID 4248 wrote to memory of 2212 4248 rovwer.exe lego.exe PID 4248 wrote to memory of 2212 4248 rovwer.exe lego.exe PID 2212 wrote to memory of 1088 2212 lego.exe rovwer.exe PID 2212 wrote to memory of 1088 2212 lego.exe rovwer.exe PID 2212 wrote to memory of 1088 2212 lego.exe rovwer.exe PID 1088 wrote to memory of 4856 1088 rovwer.exe schtasks.exe PID 1088 wrote to memory of 4856 1088 rovwer.exe schtasks.exe PID 1088 wrote to memory of 4856 1088 rovwer.exe schtasks.exe PID 1088 wrote to memory of 2120 1088 rovwer.exe cmd.exe PID 1088 wrote to memory of 2120 1088 rovwer.exe cmd.exe PID 1088 wrote to memory of 2120 1088 rovwer.exe cmd.exe PID 2120 wrote to memory of 2748 2120 cmd.exe cmd.exe PID 2120 wrote to memory of 2748 2120 cmd.exe cmd.exe PID 2120 wrote to memory of 2748 2120 cmd.exe cmd.exe PID 2120 wrote to memory of 4120 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 4120 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 4120 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 1664 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 1664 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 1664 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 4316 2120 cmd.exe cmd.exe PID 2120 wrote to memory of 4316 2120 cmd.exe cmd.exe PID 2120 wrote to memory of 4316 2120 cmd.exe cmd.exe PID 2120 wrote to memory of 1492 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 1492 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 1492 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 5024 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 5024 2120 cmd.exe cacls.exe PID 2120 wrote to memory of 5024 2120 cmd.exe cacls.exe PID 4248 wrote to memory of 1112 4248 rovwer.exe rundll32.exe PID 4248 wrote to memory of 1112 4248 rovwer.exe rundll32.exe PID 4248 wrote to memory of 1112 4248 rovwer.exe rundll32.exe PID 1088 wrote to memory of 2564 1088 rovwer.exe rundll32.exe PID 1088 wrote to memory of 2564 1088 rovwer.exe rundll32.exe PID 1088 wrote to memory of 2564 1088 rovwer.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000004001\lego.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\lego.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 11362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3352 -ip 33521⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000004001\lego.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\1000004001\lego.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
252KB
MD556cc19876a0f45d09f7f409289b254b6
SHA1624dab4529371a4da07ed1c37be63184c037e859
SHA2566afdfee605fea7f98b5be7fd4a50bc24181929a22530fdd01c2bc4f012ee4ba2
SHA5125234e7f0145d03bed39483dfd58d060a9a831e5fa355f9516b96fb1c36cd75d802592c9974aa42c78e9be4255a4a0d0eebc44d676baeaeee9bfc0d97505bcef7
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
252KB
MD556cc19876a0f45d09f7f409289b254b6
SHA1624dab4529371a4da07ed1c37be63184c037e859
SHA2566afdfee605fea7f98b5be7fd4a50bc24181929a22530fdd01c2bc4f012ee4ba2
SHA5125234e7f0145d03bed39483dfd58d060a9a831e5fa355f9516b96fb1c36cd75d802592c9974aa42c78e9be4255a4a0d0eebc44d676baeaeee9bfc0d97505bcef7
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5b8d80046e28849a320a3dcd868b73d7c
SHA1f15bc4a4c5189e7aa845213469c6def5afd68186
SHA256d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a
SHA512b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5b8d80046e28849a320a3dcd868b73d7c
SHA1f15bc4a4c5189e7aa845213469c6def5afd68186
SHA256d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a
SHA512b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5b8d80046e28849a320a3dcd868b73d7c
SHA1f15bc4a4c5189e7aa845213469c6def5afd68186
SHA256d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a
SHA512b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e
-
memory/1088-146-0x0000000000000000-mapping.dmp
-
memory/1112-158-0x0000000000000000-mapping.dmp
-
memory/1112-162-0x00000000009D0000-0x00000000009F4000-memory.dmpFilesize
144KB
-
memory/1492-155-0x0000000000000000-mapping.dmp
-
memory/1664-153-0x0000000000000000-mapping.dmp
-
memory/2120-150-0x0000000000000000-mapping.dmp
-
memory/2212-143-0x0000000000000000-mapping.dmp
-
memory/2564-164-0x0000000000000000-mapping.dmp
-
memory/2748-151-0x0000000000000000-mapping.dmp
-
memory/3352-140-0x0000000000400000-0x000000000059A000-memory.dmpFilesize
1.6MB
-
memory/3352-132-0x0000000000749000-0x0000000000768000-memory.dmpFilesize
124KB
-
memory/3352-133-0x00000000022D0000-0x000000000230E000-memory.dmpFilesize
248KB
-
memory/3352-134-0x0000000000400000-0x000000000059A000-memory.dmpFilesize
1.6MB
-
memory/3352-139-0x0000000000749000-0x0000000000768000-memory.dmpFilesize
124KB
-
memory/4120-152-0x0000000000000000-mapping.dmp
-
memory/4248-141-0x00000000006B8000-0x00000000006D7000-memory.dmpFilesize
124KB
-
memory/4248-135-0x0000000000000000-mapping.dmp
-
memory/4248-142-0x0000000000400000-0x000000000059A000-memory.dmpFilesize
1.6MB
-
memory/4248-157-0x0000000000400000-0x000000000059A000-memory.dmpFilesize
1.6MB
-
memory/4316-154-0x0000000000000000-mapping.dmp
-
memory/4376-138-0x0000000000000000-mapping.dmp
-
memory/4856-149-0x0000000000000000-mapping.dmp
-
memory/5024-156-0x0000000000000000-mapping.dmp