Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe
Resource
win10v2004-20220812-en
General
-
Target
a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe
-
Size
244KB
-
MD5
c8f046db4ece8e5bc2654c7037267b96
-
SHA1
f21cca0c799bfcb3d9ee3e0b511188a10b0b1327
-
SHA256
a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819
-
SHA512
bcec736ef727605fbe5a3b26fdaf4d13902e3f59d6c7d54262cf11bc3e1bb6d16b280e96600cca83f1564310bc8ea25aee982f770db6a7c3aaea787648037231
-
SSDEEP
6144:OWzEq1LqpOlwKhQB98/HLnOMOvWtIC8EeSL3WnV:OWzE+upOxhQBq/HLOMfZWV
Malware Config
Extracted
amadey
3.50
193.56.146.174/g84kvj4jck/index.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
rovwer.exerovwer.exe3000.exerovwer.exerovwer.exepid process 1968 rovwer.exe 892 rovwer.exe 4344 3000.exe 4316 rovwer.exe 4496 rovwer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exerovwer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation rovwer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3000.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000212001\\3000.exe" rovwer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4564 4708 WerFault.exe a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe 2388 892 WerFault.exe rovwer.exe 772 4316 WerFault.exe rovwer.exe 3376 4496 WerFault.exe rovwer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exerovwer.execmd.exedescription pid process target process PID 4708 wrote to memory of 1968 4708 a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe rovwer.exe PID 4708 wrote to memory of 1968 4708 a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe rovwer.exe PID 4708 wrote to memory of 1968 4708 a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe rovwer.exe PID 1968 wrote to memory of 5008 1968 rovwer.exe schtasks.exe PID 1968 wrote to memory of 5008 1968 rovwer.exe schtasks.exe PID 1968 wrote to memory of 5008 1968 rovwer.exe schtasks.exe PID 1968 wrote to memory of 1340 1968 rovwer.exe cmd.exe PID 1968 wrote to memory of 1340 1968 rovwer.exe cmd.exe PID 1968 wrote to memory of 1340 1968 rovwer.exe cmd.exe PID 1340 wrote to memory of 1272 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 1272 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 1272 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 1052 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 1052 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 1052 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 4228 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 4228 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 4228 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 2356 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 2356 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 2356 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 4812 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 4812 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 4812 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 1256 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 1256 1340 cmd.exe cacls.exe PID 1340 wrote to memory of 1256 1340 cmd.exe cacls.exe PID 1968 wrote to memory of 4344 1968 rovwer.exe 3000.exe PID 1968 wrote to memory of 4344 1968 rovwer.exe 3000.exe PID 1968 wrote to memory of 4344 1968 rovwer.exe 3000.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe"C:\Users\Admin\AppData\Local\Temp\a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:5008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1272
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵PID:1052
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵PID:4228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2356
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵PID:4812
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\1000212001\3000.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\3000.exe"3⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 11362⤵
- Program crash
PID:4564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4708 -ip 47081⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 4202⤵
- Program crash
PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 892 -ip 8921⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 4162⤵
- Program crash
PID:772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4316 -ip 43161⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 4162⤵
- Program crash
PID:3376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4496 -ip 44961⤵PID:776
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000212001\3000.exeFilesize
2.4MB
MD577181eb9385b899f4bce3387a2efe18c
SHA168488c2d2aae96c6f552bcddb81e198b0390312a
SHA256e18597f8343d2752ecfea69c4615ea58f37d948ee5d0741791410fb2a4827b1b
SHA5123d034f0b238ad5da850d38f3f247693415ca1773aab84f25c32d500864d7a11b8385d2c5da45a19950c5cdad9664963af85ae13d48da7fceee895d847f94eeb9
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD5c8f046db4ece8e5bc2654c7037267b96
SHA1f21cca0c799bfcb3d9ee3e0b511188a10b0b1327
SHA256a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819
SHA512bcec736ef727605fbe5a3b26fdaf4d13902e3f59d6c7d54262cf11bc3e1bb6d16b280e96600cca83f1564310bc8ea25aee982f770db6a7c3aaea787648037231
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD5c8f046db4ece8e5bc2654c7037267b96
SHA1f21cca0c799bfcb3d9ee3e0b511188a10b0b1327
SHA256a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819
SHA512bcec736ef727605fbe5a3b26fdaf4d13902e3f59d6c7d54262cf11bc3e1bb6d16b280e96600cca83f1564310bc8ea25aee982f770db6a7c3aaea787648037231
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD5c8f046db4ece8e5bc2654c7037267b96
SHA1f21cca0c799bfcb3d9ee3e0b511188a10b0b1327
SHA256a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819
SHA512bcec736ef727605fbe5a3b26fdaf4d13902e3f59d6c7d54262cf11bc3e1bb6d16b280e96600cca83f1564310bc8ea25aee982f770db6a7c3aaea787648037231
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD5c8f046db4ece8e5bc2654c7037267b96
SHA1f21cca0c799bfcb3d9ee3e0b511188a10b0b1327
SHA256a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819
SHA512bcec736ef727605fbe5a3b26fdaf4d13902e3f59d6c7d54262cf11bc3e1bb6d16b280e96600cca83f1564310bc8ea25aee982f770db6a7c3aaea787648037231
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD5c8f046db4ece8e5bc2654c7037267b96
SHA1f21cca0c799bfcb3d9ee3e0b511188a10b0b1327
SHA256a3ab76b17b04ccbaff41b72ed665bf28e6c5586a4f715e43b1100820acdfd819
SHA512bcec736ef727605fbe5a3b26fdaf4d13902e3f59d6c7d54262cf11bc3e1bb6d16b280e96600cca83f1564310bc8ea25aee982f770db6a7c3aaea787648037231
-
memory/892-153-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/892-152-0x0000000000900000-0x000000000091F000-memory.dmpFilesize
124KB
-
memory/1052-142-0x0000000000000000-mapping.dmp
-
memory/1256-146-0x0000000000000000-mapping.dmp
-
memory/1272-141-0x0000000000000000-mapping.dmp
-
memory/1340-140-0x0000000000000000-mapping.dmp
-
memory/1968-135-0x0000000000000000-mapping.dmp
-
memory/1968-147-0x00000000007FC000-0x000000000081B000-memory.dmpFilesize
124KB
-
memory/1968-148-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/1968-149-0x00000000007FC000-0x000000000081B000-memory.dmpFilesize
124KB
-
memory/1968-150-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/2356-144-0x0000000000000000-mapping.dmp
-
memory/4228-143-0x0000000000000000-mapping.dmp
-
memory/4316-157-0x0000000000880000-0x000000000089F000-memory.dmpFilesize
124KB
-
memory/4316-158-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4344-154-0x0000000000000000-mapping.dmp
-
memory/4496-160-0x00000000009B0000-0x00000000009CF000-memory.dmpFilesize
124KB
-
memory/4496-161-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4708-138-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4708-132-0x000000000081E000-0x000000000083D000-memory.dmpFilesize
124KB
-
memory/4708-134-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4708-133-0x00000000023A0000-0x00000000023DE000-memory.dmpFilesize
248KB
-
memory/4812-145-0x0000000000000000-mapping.dmp
-
memory/5008-139-0x0000000000000000-mapping.dmp