Analysis
-
max time kernel
261s -
max time network
256s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-11-2022 22:19
Static task
static1
Behavioral task
behavioral1
Sample
a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe
Resource
win10-20220812-en
General
-
Target
a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe
-
Size
207KB
-
MD5
37b1a93e7c74982a942dc0ba6a95b933
-
SHA1
4c2ca7b2c7c542c32595ff57fef38f4763d158d6
-
SHA256
a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
-
SHA512
ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
SSDEEP
3072:mvDEuqliTm54A/MEzTyBSSLQ9RaBe8pqjuPv3YMmA57M29PFAHqfdhAqbF6J:YEbi/kiy487jun1pAENQqrrx6
Malware Config
Extracted
amadey
3.50
77.73.134.66/o7Vsjd3a2f/index.php
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\a96bf39c2ed186\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\a96bf39c2ed186\cred64.dll amadey_cred_module -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 8 3940 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
gntuud.exegntuud.exegntuud.exegntuud.exegntuud.exepid process 4904 gntuud.exe 5072 gntuud.exe 4708 gntuud.exe 660 gntuud.exe 580 gntuud.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3940 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exegntuud.exedescription pid process target process PID 3068 wrote to memory of 4904 3068 a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe gntuud.exe PID 3068 wrote to memory of 4904 3068 a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe gntuud.exe PID 3068 wrote to memory of 4904 3068 a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe gntuud.exe PID 4904 wrote to memory of 4352 4904 gntuud.exe schtasks.exe PID 4904 wrote to memory of 4352 4904 gntuud.exe schtasks.exe PID 4904 wrote to memory of 4352 4904 gntuud.exe schtasks.exe PID 4904 wrote to memory of 3940 4904 gntuud.exe rundll32.exe PID 4904 wrote to memory of 3940 4904 gntuud.exe rundll32.exe PID 4904 wrote to memory of 3940 4904 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe"C:\Users\Admin\AppData\Local\Temp\a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe" /F3⤵
- Creates scheduled task(s)
PID:4352 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a96bf39c2ed186\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:3940
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeC:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe1⤵
- Executes dropped EXE
PID:5072
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeC:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe1⤵
- Executes dropped EXE
PID:4708
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeC:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe1⤵
- Executes dropped EXE
PID:660
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeC:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exe1⤵
- Executes dropped EXE
PID:580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeFilesize
207KB
MD537b1a93e7c74982a942dc0ba6a95b933
SHA14c2ca7b2c7c542c32595ff57fef38f4763d158d6
SHA256a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
SHA512ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeFilesize
207KB
MD537b1a93e7c74982a942dc0ba6a95b933
SHA14c2ca7b2c7c542c32595ff57fef38f4763d158d6
SHA256a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
SHA512ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeFilesize
207KB
MD537b1a93e7c74982a942dc0ba6a95b933
SHA14c2ca7b2c7c542c32595ff57fef38f4763d158d6
SHA256a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
SHA512ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeFilesize
207KB
MD537b1a93e7c74982a942dc0ba6a95b933
SHA14c2ca7b2c7c542c32595ff57fef38f4763d158d6
SHA256a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
SHA512ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeFilesize
207KB
MD537b1a93e7c74982a942dc0ba6a95b933
SHA14c2ca7b2c7c542c32595ff57fef38f4763d158d6
SHA256a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
SHA512ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
C:\Users\Admin\AppData\Local\Temp\94f59ca423\gntuud.exeFilesize
207KB
MD537b1a93e7c74982a942dc0ba6a95b933
SHA14c2ca7b2c7c542c32595ff57fef38f4763d158d6
SHA256a4e975408bb6197b94f44aa761bf20af6180a16393a61e6608d006d3adebd448
SHA512ed79835f00430b6cd165e4065bef9d1cd21cd91c2ff614364aa7c59754306b415acb46058a4c211508c5c196f7e6ab02aace9dcb160cc0ee3bb38df2d5ded875
-
C:\Users\Admin\AppData\Roaming\a96bf39c2ed186\cred64.dllFilesize
126KB
MD5a41414b91894680bb64eca81a3a54f9e
SHA1f0ce8614cc2c3ae1fcba93bc4a8b82196e7139f7
SHA2565980b313371ff25867c38c2c2a4d60f77d79d106fd267c9084b370805bfb63d1
SHA512f5b3154a6b18d2a3d4fed9f367d4273a63cd5dc5f919f1b4727fdb90e865a32585932734f4e4f9306cfb8d89dd6b8e4e28fa1ca808fbfc0363684d82cfc16c0a
-
\Users\Admin\AppData\Roaming\a96bf39c2ed186\cred64.dllFilesize
126KB
MD5a41414b91894680bb64eca81a3a54f9e
SHA1f0ce8614cc2c3ae1fcba93bc4a8b82196e7139f7
SHA2565980b313371ff25867c38c2c2a4d60f77d79d106fd267c9084b370805bfb63d1
SHA512f5b3154a6b18d2a3d4fed9f367d4273a63cd5dc5f919f1b4727fdb90e865a32585932734f4e4f9306cfb8d89dd6b8e4e28fa1ca808fbfc0363684d82cfc16c0a
-
memory/580-480-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/660-444-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/3068-160-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-155-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-126-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-127-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-164-0x0000000000DC6000-0x0000000000DE5000-memory.dmpFilesize
124KB
-
memory/3068-129-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-130-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-131-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-132-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-133-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-134-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-135-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-136-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-137-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-138-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-139-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-140-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-141-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-142-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-143-0x0000000000DC6000-0x0000000000DE5000-memory.dmpFilesize
124KB
-
memory/3068-144-0x0000000000C50000-0x0000000000C8E000-memory.dmpFilesize
248KB
-
memory/3068-145-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-147-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-146-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-148-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-149-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-150-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-151-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-152-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-153-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-154-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-165-0x0000000000C50000-0x0000000000C8E000-memory.dmpFilesize
248KB
-
memory/3068-156-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-157-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-158-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/3068-159-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-124-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-161-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-162-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-163-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-128-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-125-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-120-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-167-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-172-0x0000000000DC6000-0x0000000000DE5000-memory.dmpFilesize
124KB
-
memory/3068-174-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/3068-116-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-117-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-118-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-119-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-166-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-121-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-122-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3068-123-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/3940-253-0x0000000000000000-mapping.dmp
-
memory/4352-223-0x0000000000000000-mapping.dmp
-
memory/4708-408-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/4904-183-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-177-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-184-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-185-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-187-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-186-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-189-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-252-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/4904-214-0x0000000000AF0000-0x0000000000B9E000-memory.dmpFilesize
696KB
-
memory/4904-215-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/4904-181-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-180-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-190-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-178-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-176-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-175-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-251-0x0000000000AF0000-0x0000000000B9E000-memory.dmpFilesize
696KB
-
memory/4904-168-0x0000000000000000-mapping.dmp
-
memory/4904-171-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-173-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-182-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/4904-170-0x0000000076FE0000-0x000000007716E000-memory.dmpFilesize
1.6MB
-
memory/5072-372-0x0000000000400000-0x0000000000AE6000-memory.dmpFilesize
6.9MB
-
memory/5072-371-0x0000000000EAC000-0x0000000000ECB000-memory.dmpFilesize
124KB
-
memory/5072-357-0x0000000000EAC000-0x0000000000ECB000-memory.dmpFilesize
124KB