Analysis

  • max time kernel
    110s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 22:46

General

  • Target

    file.exe

  • Size

    237KB

  • MD5

    0460990761ea0b12df9d8133fb116bd7

  • SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

  • SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

  • SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • SSDEEP

    3072:rEW2zikDTjDqowd5u/NGVQUYocEKc0YTdfPOB4aHHQG70W8BVvFCEu:UDTjDR5Ub1Rm4IB7cBVNCE

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.17/hfk3vK9/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:1688
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:1784
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {134D8988-152A-45A5-B8C0-A9C8DCFE67B2} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      2⤵
      • Executes dropped EXE
      PID:1912

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

    Filesize

    237KB

    MD5

    0460990761ea0b12df9d8133fb116bd7

    SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

    SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

    SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

    Filesize

    237KB

    MD5

    0460990761ea0b12df9d8133fb116bd7

    SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

    SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

    SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

    Filesize

    237KB

    MD5

    0460990761ea0b12df9d8133fb116bd7

    SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

    SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

    SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

    Filesize

    237KB

    MD5

    0460990761ea0b12df9d8133fb116bd7

    SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

    SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

    SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

    Filesize

    237KB

    MD5

    0460990761ea0b12df9d8133fb116bd7

    SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

    SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

    SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • \Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

    Filesize

    237KB

    MD5

    0460990761ea0b12df9d8133fb116bd7

    SHA1

    16d234e218b4d7963e94d5a8c1b6b273fc538f19

    SHA256

    8d436a881302c1767ef5a1d9573779a2196fb105ad9f3b29439d648c77b08f8e

    SHA512

    0aad95f916b1f07cdd2be965292fee772fd420f111f969823875a4c4952df4f3aa380d00eb53ce67572027464bce139d41deae17656fbecf1b6f04d3db764a32

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • memory/1148-64-0x0000000000230000-0x0000000000330000-memory.dmp

    Filesize

    1024KB

  • memory/1148-68-0x0000000000230000-0x0000000000330000-memory.dmp

    Filesize

    1024KB

  • memory/1148-69-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/1148-65-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/1148-57-0x0000000000000000-mapping.dmp

  • memory/1688-66-0x0000000000000000-mapping.dmp

  • memory/1724-61-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/1724-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

    Filesize

    8KB

  • memory/1724-59-0x000000000081B000-0x000000000083A000-memory.dmp

    Filesize

    124KB

  • memory/1724-60-0x0000000000220000-0x000000000025E000-memory.dmp

    Filesize

    248KB

  • memory/1784-75-0x0000000000000000-mapping.dmp

  • memory/1912-82-0x0000000000000000-mapping.dmp

  • memory/1912-85-0x00000000002EB000-0x000000000030A000-memory.dmp

    Filesize

    124KB

  • memory/1912-86-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/1920-74-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/1920-73-0x000000000084B000-0x000000000086A000-memory.dmp

    Filesize

    124KB

  • memory/1920-70-0x0000000000000000-mapping.dmp