Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:04
Behavioral task
behavioral1
Sample
adbaf286228c46522e50371c4be31a03.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
adbaf286228c46522e50371c4be31a03.dll
Resource
win10v2004-20221111-en
General
-
Target
adbaf286228c46522e50371c4be31a03.dll
-
Size
126KB
-
MD5
adbaf286228c46522e50371c4be31a03
-
SHA1
a29d644c4663b2e2b2bd92046ba0df629537c297
-
SHA256
d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
-
SHA512
74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
SSDEEP
3072:ox7pOYzBekBmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnm9:ox7ZNhB/dMq6AO0a7vVlT
Malware Config
Signatures
-
Detect Amadey credential stealer module 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1284-56-0x00000000001D0000-0x00000000001F4000-memory.dmp amadey_cred_module -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1296 1284 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1284 rundll32.exe 1284 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1284 1768 rundll32.exe rundll32.exe PID 1284 wrote to memory of 1296 1284 rundll32.exe WerFault.exe PID 1284 wrote to memory of 1296 1284 rundll32.exe WerFault.exe PID 1284 wrote to memory of 1296 1284 rundll32.exe WerFault.exe PID 1284 wrote to memory of 1296 1284 rundll32.exe WerFault.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adbaf286228c46522e50371c4be31a03.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adbaf286228c46522e50371c4be31a03.dll,#12⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 4563⤵
- Program crash