Analysis
-
max time kernel
182s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 21:40
Static task
static1
Behavioral task
behavioral1
Sample
d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe
Resource
win10v2004-20221111-en
General
-
Target
d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe
-
Size
206KB
-
MD5
95389597337f305453c1fc8e26ca6f67
-
SHA1
4aff389ca70f4c03764e556972469f9a5a1cbd6d
-
SHA256
d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf
-
SHA512
e7118f2710bc1ebbaffe7c16645d60bc4a6ab688ba452270fb5b213fd69108efd1c967f96063c31c8564c0da66a3c7c5f0837f879a780ab0cf4d59275ce74ed1
-
SSDEEP
3072:LwPP0KE0klNia5pmpOVDF26BuQ9fcPu5VxZAqIerF9L3sg6nRR979O:us7lNCpuDBJcPujAqbPzeRj9O
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 90 4748 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
rovwer.exerovwer.exerovwer.exepid process 3584 rovwer.exe 1244 rovwer.exe 2052 rovwer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exerovwer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation rovwer.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4748 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4252 4020 WerFault.exe d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe 4820 1244 WerFault.exe rovwer.exe 1920 2052 WerFault.exe rovwer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4748 rundll32.exe 4748 rundll32.exe 4748 rundll32.exe 4748 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exerovwer.exedescription pid process target process PID 4020 wrote to memory of 3584 4020 d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe rovwer.exe PID 4020 wrote to memory of 3584 4020 d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe rovwer.exe PID 4020 wrote to memory of 3584 4020 d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe rovwer.exe PID 3584 wrote to memory of 4940 3584 rovwer.exe schtasks.exe PID 3584 wrote to memory of 4940 3584 rovwer.exe schtasks.exe PID 3584 wrote to memory of 4940 3584 rovwer.exe schtasks.exe PID 3584 wrote to memory of 4748 3584 rovwer.exe rundll32.exe PID 3584 wrote to memory of 4748 3584 rovwer.exe rundll32.exe PID 3584 wrote to memory of 4748 3584 rovwer.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe"C:\Users\Admin\AppData\Local\Temp\d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:4940 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:4748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 8682⤵
- Program crash
PID:4252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4020 -ip 40201⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeC:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe1⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 4162⤵
- Program crash
PID:4820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1244 -ip 12441⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeC:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe1⤵
- Executes dropped EXE
PID:2052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 4242⤵
- Program crash
PID:1920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2052 -ip 20521⤵PID:2596
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD595389597337f305453c1fc8e26ca6f67
SHA14aff389ca70f4c03764e556972469f9a5a1cbd6d
SHA256d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf
SHA512e7118f2710bc1ebbaffe7c16645d60bc4a6ab688ba452270fb5b213fd69108efd1c967f96063c31c8564c0da66a3c7c5f0837f879a780ab0cf4d59275ce74ed1
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD595389597337f305453c1fc8e26ca6f67
SHA14aff389ca70f4c03764e556972469f9a5a1cbd6d
SHA256d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf
SHA512e7118f2710bc1ebbaffe7c16645d60bc4a6ab688ba452270fb5b213fd69108efd1c967f96063c31c8564c0da66a3c7c5f0837f879a780ab0cf4d59275ce74ed1
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD595389597337f305453c1fc8e26ca6f67
SHA14aff389ca70f4c03764e556972469f9a5a1cbd6d
SHA256d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf
SHA512e7118f2710bc1ebbaffe7c16645d60bc4a6ab688ba452270fb5b213fd69108efd1c967f96063c31c8564c0da66a3c7c5f0837f879a780ab0cf4d59275ce74ed1
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD595389597337f305453c1fc8e26ca6f67
SHA14aff389ca70f4c03764e556972469f9a5a1cbd6d
SHA256d78bd42f2163d4f1558ddd194c3d21bf88347ad352d212076148805b8ae5e3cf
SHA512e7118f2710bc1ebbaffe7c16645d60bc4a6ab688ba452270fb5b213fd69108efd1c967f96063c31c8564c0da66a3c7c5f0837f879a780ab0cf4d59275ce74ed1
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5674cec24e36e0dfaec6290db96dda86e
SHA1581e3a7a541cc04641e751fc850d92e07236681f
SHA256de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded
SHA5126d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5674cec24e36e0dfaec6290db96dda86e
SHA1581e3a7a541cc04641e751fc850d92e07236681f
SHA256de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded
SHA5126d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029
-
memory/1244-149-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/1244-148-0x0000000000DCC000-0x0000000000DEB000-memory.dmpFilesize
124KB
-
memory/2052-152-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2052-151-0x0000000000BCC000-0x0000000000BEB000-memory.dmpFilesize
124KB
-
memory/3584-135-0x0000000000000000-mapping.dmp
-
memory/3584-143-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/3584-139-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/3584-138-0x0000000000C48000-0x0000000000C67000-memory.dmpFilesize
124KB
-
memory/4020-142-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/4020-141-0x0000000000B38000-0x0000000000B57000-memory.dmpFilesize
124KB
-
memory/4020-132-0x0000000000B38000-0x0000000000B57000-memory.dmpFilesize
124KB
-
memory/4020-134-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/4020-133-0x0000000000C60000-0x0000000000C9E000-memory.dmpFilesize
248KB
-
memory/4748-144-0x0000000000000000-mapping.dmp
-
memory/4940-140-0x0000000000000000-mapping.dmp