Analysis
-
max time kernel
296s -
max time network
354s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 22:22
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
206KB
-
MD5
5adb220606ca7c0f8db7f3ab8f4776d1
-
SHA1
d8b39a0f06c5082207fe3dea0fa8159ee06fd2e7
-
SHA256
85e29295d954a13c544b56aa377460e3064de6b10d525ceabb87a7c4a6279714
-
SHA512
43cd7775eb07658bf7714a0e08059473eb14e9fd7129a5ca997d0c3475214f2c03f42db91deb2cf05942c5aa5fdf9d4841281b1f81469db8aefe33cf1df686c1
-
SSDEEP
3072:5XPsEh8PGx1B5i+zq6yUr/J+UAhS2Gm86w9CKSMoCl+Xfs:5i+xLio+6mJCCUgf
Malware Config
Extracted
amadey
3.50
31.41.244.17/hfk3vK9/index.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
gntuud.exepid process 1308 gntuud.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
gntuud.exefile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation gntuud.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
file.exegntuud.exedescription pid process target process PID 1608 wrote to memory of 1308 1608 file.exe gntuud.exe PID 1608 wrote to memory of 1308 1608 file.exe gntuud.exe PID 1608 wrote to memory of 1308 1608 file.exe gntuud.exe PID 1308 wrote to memory of 3396 1308 gntuud.exe schtasks.exe PID 1308 wrote to memory of 3396 1308 gntuud.exe schtasks.exe PID 1308 wrote to memory of 3396 1308 gntuud.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
PID:3396
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD55adb220606ca7c0f8db7f3ab8f4776d1
SHA1d8b39a0f06c5082207fe3dea0fa8159ee06fd2e7
SHA25685e29295d954a13c544b56aa377460e3064de6b10d525ceabb87a7c4a6279714
SHA51243cd7775eb07658bf7714a0e08059473eb14e9fd7129a5ca997d0c3475214f2c03f42db91deb2cf05942c5aa5fdf9d4841281b1f81469db8aefe33cf1df686c1
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD55adb220606ca7c0f8db7f3ab8f4776d1
SHA1d8b39a0f06c5082207fe3dea0fa8159ee06fd2e7
SHA25685e29295d954a13c544b56aa377460e3064de6b10d525ceabb87a7c4a6279714
SHA51243cd7775eb07658bf7714a0e08059473eb14e9fd7129a5ca997d0c3475214f2c03f42db91deb2cf05942c5aa5fdf9d4841281b1f81469db8aefe33cf1df686c1
-
memory/1308-136-0x0000000000000000-mapping.dmp
-
memory/1308-139-0x000000000072D000-0x000000000074C000-memory.dmpFilesize
124KB
-
memory/1308-140-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1608-132-0x00000000007AD000-0x00000000007CC000-memory.dmpFilesize
124KB
-
memory/1608-133-0x00000000006C0000-0x00000000006FE000-memory.dmpFilesize
248KB
-
memory/1608-134-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1608-135-0x00000000007AD000-0x00000000007CC000-memory.dmpFilesize
124KB
-
memory/1608-141-0x00000000007AD000-0x00000000007CC000-memory.dmpFilesize
124KB
-
memory/1608-142-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3396-143-0x0000000000000000-mapping.dmp