Analysis

  • max time kernel
    215s
  • max time network
    238s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 18:27

General

  • Target

    file.exe

  • Size

    226KB

  • MD5

    dedd5c0ac85096e282d51b4784ca2aa4

  • SHA1

    18caac5cb1d4d084fa2654477af97c58e95c1281

  • SHA256

    6fd43674da08e9cb4e4a6945c2ac41ae6ec1042cc177343797937465da74e263

  • SHA512

    554c046c124cb6a1b1538ee1037d36ef5617753743f6199d8192563dc38de777e92775198ba3bce1b49ebcd24092c40b767ca9e16e6c96889fddfb146ad492b4

  • SSDEEP

    6144:LFQ9jysBHl7PnsmNF9OlRYf9E0Bx4mklpZZT+p51:iMsBHlDGYPVklp7+N

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.17/hfk3vK9/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:3424
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:1456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 896
      2⤵
      • Program crash
      PID:1244
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1344 -ip 1344
    1⤵
      PID:4496
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      1⤵
      • Executes dropped EXE
      PID:3472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 416
        2⤵
        • Program crash
        PID:2268
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3472 -ip 3472
      1⤵
        PID:4220
      • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
        C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
        1⤵
        • Executes dropped EXE
        PID:2436
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 416
          2⤵
          • Program crash
          PID:1124
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2436 -ip 2436
        1⤵
          PID:4844

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

          Filesize

          226KB

          MD5

          dedd5c0ac85096e282d51b4784ca2aa4

          SHA1

          18caac5cb1d4d084fa2654477af97c58e95c1281

          SHA256

          6fd43674da08e9cb4e4a6945c2ac41ae6ec1042cc177343797937465da74e263

          SHA512

          554c046c124cb6a1b1538ee1037d36ef5617753743f6199d8192563dc38de777e92775198ba3bce1b49ebcd24092c40b767ca9e16e6c96889fddfb146ad492b4

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

          Filesize

          226KB

          MD5

          dedd5c0ac85096e282d51b4784ca2aa4

          SHA1

          18caac5cb1d4d084fa2654477af97c58e95c1281

          SHA256

          6fd43674da08e9cb4e4a6945c2ac41ae6ec1042cc177343797937465da74e263

          SHA512

          554c046c124cb6a1b1538ee1037d36ef5617753743f6199d8192563dc38de777e92775198ba3bce1b49ebcd24092c40b767ca9e16e6c96889fddfb146ad492b4

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

          Filesize

          226KB

          MD5

          dedd5c0ac85096e282d51b4784ca2aa4

          SHA1

          18caac5cb1d4d084fa2654477af97c58e95c1281

          SHA256

          6fd43674da08e9cb4e4a6945c2ac41ae6ec1042cc177343797937465da74e263

          SHA512

          554c046c124cb6a1b1538ee1037d36ef5617753743f6199d8192563dc38de777e92775198ba3bce1b49ebcd24092c40b767ca9e16e6c96889fddfb146ad492b4

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

          Filesize

          226KB

          MD5

          dedd5c0ac85096e282d51b4784ca2aa4

          SHA1

          18caac5cb1d4d084fa2654477af97c58e95c1281

          SHA256

          6fd43674da08e9cb4e4a6945c2ac41ae6ec1042cc177343797937465da74e263

          SHA512

          554c046c124cb6a1b1538ee1037d36ef5617753743f6199d8192563dc38de777e92775198ba3bce1b49ebcd24092c40b767ca9e16e6c96889fddfb146ad492b4

        • C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

          Filesize

          126KB

          MD5

          adbaf286228c46522e50371c4be31a03

          SHA1

          a29d644c4663b2e2b2bd92046ba0df629537c297

          SHA256

          d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

          SHA512

          74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

        • C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll

          Filesize

          126KB

          MD5

          adbaf286228c46522e50371c4be31a03

          SHA1

          a29d644c4663b2e2b2bd92046ba0df629537c297

          SHA256

          d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

          SHA512

          74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

        • memory/220-143-0x00000000008AC000-0x00000000008CB000-memory.dmp

          Filesize

          124KB

        • memory/220-135-0x0000000000000000-mapping.dmp

        • memory/220-139-0x00000000008AC000-0x00000000008CB000-memory.dmp

          Filesize

          124KB

        • memory/220-140-0x0000000000400000-0x000000000071A000-memory.dmp

          Filesize

          3.1MB

        • memory/220-144-0x0000000000400000-0x000000000071A000-memory.dmp

          Filesize

          3.1MB

        • memory/1344-142-0x0000000000400000-0x000000000071A000-memory.dmp

          Filesize

          3.1MB

        • memory/1344-132-0x0000000000A5D000-0x0000000000A7C000-memory.dmp

          Filesize

          124KB

        • memory/1344-141-0x0000000000A5D000-0x0000000000A7C000-memory.dmp

          Filesize

          124KB

        • memory/1344-134-0x0000000000400000-0x000000000071A000-memory.dmp

          Filesize

          3.1MB

        • memory/1344-133-0x0000000002310000-0x000000000234E000-memory.dmp

          Filesize

          248KB

        • memory/1456-149-0x0000000000000000-mapping.dmp

        • memory/3424-138-0x0000000000000000-mapping.dmp

        • memory/3472-146-0x0000000000A39000-0x0000000000A58000-memory.dmp

          Filesize

          124KB

        • memory/3472-147-0x0000000000A39000-0x0000000000A58000-memory.dmp

          Filesize

          124KB

        • memory/3472-148-0x0000000000400000-0x000000000071A000-memory.dmp

          Filesize

          3.1MB