Analysis
-
max time kernel
296s -
max time network
332s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:45
Static task
static1
Behavioral task
behavioral1
Sample
620abb937a0416d334115f64f47800e6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
620abb937a0416d334115f64f47800e6.exe
Resource
win10v2004-20221111-en
General
-
Target
620abb937a0416d334115f64f47800e6.exe
-
Size
248KB
-
MD5
620abb937a0416d334115f64f47800e6
-
SHA1
f1021c51b93595134693137b5b5895cb2493ee49
-
SHA256
3fc60c0a4262d3c138b685f4bbb66dc9433c06c16354c209043b4151ec62c8ea
-
SHA512
927af2c71d434256df4445d372bd720e2bda8a1430cb8009f979a58b23fbfbcfd5e133698aa446065f8599afaf4bc04493f23c2a571298028380dbc496aceec8
-
SSDEEP
3072:hDpLTb3wW4q1f2LTFo6JHn9D5rENA1xH0txYougIsNYDF2g/M8ZkY9fTJI1R6FLv:ppN8LJo65oaxEYrgfi/n9LJ4R69
Malware Config
Extracted
amadey
3.50
193.56.146.174/g84kvj4jck/index.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
rovwer.exerovwer.exe236.exepid process 776 rovwer.exe 4256 rovwer.exe 2960 236.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
620abb937a0416d334115f64f47800e6.exerovwer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 620abb937a0416d334115f64f47800e6.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation rovwer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\236.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000221001\\236.exe" rovwer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4224 2808 WerFault.exe 620abb937a0416d334115f64f47800e6.exe 1960 4256 WerFault.exe rovwer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
620abb937a0416d334115f64f47800e6.exerovwer.execmd.exedescription pid process target process PID 2808 wrote to memory of 776 2808 620abb937a0416d334115f64f47800e6.exe rovwer.exe PID 2808 wrote to memory of 776 2808 620abb937a0416d334115f64f47800e6.exe rovwer.exe PID 2808 wrote to memory of 776 2808 620abb937a0416d334115f64f47800e6.exe rovwer.exe PID 776 wrote to memory of 852 776 rovwer.exe schtasks.exe PID 776 wrote to memory of 852 776 rovwer.exe schtasks.exe PID 776 wrote to memory of 852 776 rovwer.exe schtasks.exe PID 776 wrote to memory of 3740 776 rovwer.exe cmd.exe PID 776 wrote to memory of 3740 776 rovwer.exe cmd.exe PID 776 wrote to memory of 3740 776 rovwer.exe cmd.exe PID 3740 wrote to memory of 2392 3740 cmd.exe cmd.exe PID 3740 wrote to memory of 2392 3740 cmd.exe cmd.exe PID 3740 wrote to memory of 2392 3740 cmd.exe cmd.exe PID 3740 wrote to memory of 2184 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 2184 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 2184 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 1112 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 1112 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 1112 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 2936 3740 cmd.exe cmd.exe PID 3740 wrote to memory of 2936 3740 cmd.exe cmd.exe PID 3740 wrote to memory of 2936 3740 cmd.exe cmd.exe PID 3740 wrote to memory of 4616 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 4616 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 4616 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 1124 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 1124 3740 cmd.exe cacls.exe PID 3740 wrote to memory of 1124 3740 cmd.exe cacls.exe PID 776 wrote to memory of 2960 776 rovwer.exe 236.exe PID 776 wrote to memory of 2960 776 rovwer.exe 236.exe PID 776 wrote to memory of 2960 776 rovwer.exe 236.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\620abb937a0416d334115f64f47800e6.exe"C:\Users\Admin\AppData\Local\Temp\620abb937a0416d334115f64f47800e6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2392
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵PID:2184
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵PID:1112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2936
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵PID:4616
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\1000221001\236.exe"C:\Users\Admin\AppData\Local\Temp\1000221001\236.exe"3⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 8802⤵
- Program crash
PID:4224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2808 -ip 28081⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:4256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 4282⤵
- Program crash
PID:1960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4256 -ip 42561⤵PID:3928
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000221001\236.exeFilesize
929KB
MD5f159a709fd4cd800d0a1f766089c4318
SHA1e2335ecebfc16d030d36183a5a1f1f61853dfea8
SHA256f4dc5eedf8dd119d3b84eae34493e0b09e3bf2ff15d45e5f67266cf146f06d74
SHA5124abb21862da9d34edb8a1827d5c19f050c6a7bb45a10fa81baa169703c2a914c6123313199292bc684ab098c7cab279680233fbc3446a100874ad68774adc354
-
C:\Users\Admin\AppData\Local\Temp\1000221001\236.exeFilesize
929KB
MD5f159a709fd4cd800d0a1f766089c4318
SHA1e2335ecebfc16d030d36183a5a1f1f61853dfea8
SHA256f4dc5eedf8dd119d3b84eae34493e0b09e3bf2ff15d45e5f67266cf146f06d74
SHA5124abb21862da9d34edb8a1827d5c19f050c6a7bb45a10fa81baa169703c2a914c6123313199292bc684ab098c7cab279680233fbc3446a100874ad68774adc354
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
248KB
MD5620abb937a0416d334115f64f47800e6
SHA1f1021c51b93595134693137b5b5895cb2493ee49
SHA2563fc60c0a4262d3c138b685f4bbb66dc9433c06c16354c209043b4151ec62c8ea
SHA512927af2c71d434256df4445d372bd720e2bda8a1430cb8009f979a58b23fbfbcfd5e133698aa446065f8599afaf4bc04493f23c2a571298028380dbc496aceec8
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
248KB
MD5620abb937a0416d334115f64f47800e6
SHA1f1021c51b93595134693137b5b5895cb2493ee49
SHA2563fc60c0a4262d3c138b685f4bbb66dc9433c06c16354c209043b4151ec62c8ea
SHA512927af2c71d434256df4445d372bd720e2bda8a1430cb8009f979a58b23fbfbcfd5e133698aa446065f8599afaf4bc04493f23c2a571298028380dbc496aceec8
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
248KB
MD5620abb937a0416d334115f64f47800e6
SHA1f1021c51b93595134693137b5b5895cb2493ee49
SHA2563fc60c0a4262d3c138b685f4bbb66dc9433c06c16354c209043b4151ec62c8ea
SHA512927af2c71d434256df4445d372bd720e2bda8a1430cb8009f979a58b23fbfbcfd5e133698aa446065f8599afaf4bc04493f23c2a571298028380dbc496aceec8
-
memory/776-137-0x0000000000000000-mapping.dmp
-
memory/776-140-0x0000000000778000-0x0000000000797000-memory.dmpFilesize
124KB
-
memory/776-141-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/852-142-0x0000000000000000-mapping.dmp
-
memory/1112-146-0x0000000000000000-mapping.dmp
-
memory/1124-149-0x0000000000000000-mapping.dmp
-
memory/2184-145-0x0000000000000000-mapping.dmp
-
memory/2392-144-0x0000000000000000-mapping.dmp
-
memory/2808-136-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/2808-135-0x00000000008B8000-0x00000000008D7000-memory.dmpFilesize
124KB
-
memory/2808-132-0x00000000008B8000-0x00000000008D7000-memory.dmpFilesize
124KB
-
memory/2808-134-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/2808-133-0x0000000002390000-0x00000000023CE000-memory.dmpFilesize
248KB
-
memory/2936-147-0x0000000000000000-mapping.dmp
-
memory/2960-153-0x0000000000000000-mapping.dmp
-
memory/3740-143-0x0000000000000000-mapping.dmp
-
memory/4256-151-0x000000000089C000-0x00000000008BB000-memory.dmpFilesize
124KB
-
memory/4256-152-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/4616-148-0x0000000000000000-mapping.dmp