Analysis
-
max time kernel
301s -
max time network
343s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 05:12
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
206KB
-
MD5
5d3b91499683a2c3e3b9f6580cf3adb9
-
SHA1
c1c98a7dbe00d80c585574172805f9e52ef62d31
-
SHA256
0dcfc3b930032d262d92ea5aa282ea1c331e6228f6aebba2b45e54fbe2098cad
-
SHA512
bc971eeab1cdc7673813eba80ed53ba79435df3bad4bcfb4358f9b2a155a380e2072a23fcd6d7bce9496afe29e6f575d7033517fcddb86e22fd41de50f2496ed
-
SSDEEP
6144:B635xbr9ecaaYRpugcgRp0Qi+DRj74buFeN:B6H0caZ7DCuFu
Malware Config
Extracted
amadey
3.50
31.41.244.17/hfk3vK9/index.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
gntuud.exepid process 2472 gntuud.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4928 5004 WerFault.exe file.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
file.exedescription pid process target process PID 5004 wrote to memory of 2472 5004 file.exe gntuud.exe PID 5004 wrote to memory of 2472 5004 file.exe gntuud.exe PID 5004 wrote to memory of 2472 5004 file.exe gntuud.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 11362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5004 -ip 50041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD55d3b91499683a2c3e3b9f6580cf3adb9
SHA1c1c98a7dbe00d80c585574172805f9e52ef62d31
SHA2560dcfc3b930032d262d92ea5aa282ea1c331e6228f6aebba2b45e54fbe2098cad
SHA512bc971eeab1cdc7673813eba80ed53ba79435df3bad4bcfb4358f9b2a155a380e2072a23fcd6d7bce9496afe29e6f575d7033517fcddb86e22fd41de50f2496ed
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD55d3b91499683a2c3e3b9f6580cf3adb9
SHA1c1c98a7dbe00d80c585574172805f9e52ef62d31
SHA2560dcfc3b930032d262d92ea5aa282ea1c331e6228f6aebba2b45e54fbe2098cad
SHA512bc971eeab1cdc7673813eba80ed53ba79435df3bad4bcfb4358f9b2a155a380e2072a23fcd6d7bce9496afe29e6f575d7033517fcddb86e22fd41de50f2496ed
-
memory/2472-135-0x0000000000000000-mapping.dmp
-
memory/2472-138-0x0000000000E9C000-0x0000000000EBB000-memory.dmpFilesize
124KB
-
memory/2472-139-0x00000000025E0000-0x000000000261E000-memory.dmpFilesize
248KB
-
memory/2472-140-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/5004-132-0x0000000000E3D000-0x0000000000E5C000-memory.dmpFilesize
124KB
-
memory/5004-133-0x0000000000D80000-0x0000000000DBE000-memory.dmpFilesize
248KB
-
memory/5004-134-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/5004-141-0x0000000000E3D000-0x0000000000E5C000-memory.dmpFilesize
124KB
-
memory/5004-142-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB