Analysis

  • max time kernel
    136s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 08:56

General

  • Target

    file.exe

  • Size

    204KB

  • MD5

    eac9d7d0af5f683503ec603650d352cd

  • SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

  • SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

  • SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • SSDEEP

    3072:wsmfIr2yEHXl65J7pZuSCCZyTJhx5N2mWNEss3swQTgluUyQBBjkZdEVEWsmI:Mg2yEIfuyyTnxr2jNRwQTgDdmdbW

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.17/hfk3vK9/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:848
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:1064
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {2E72BCE7-0E89-4A03-A90E-0D27AA0CC561} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      2⤵
      • Executes dropped EXE
      PID:1276
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      2⤵
      • Executes dropped EXE
      PID:1588

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
    Filesize

    204KB

    MD5

    eac9d7d0af5f683503ec603650d352cd

    SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

    SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

    SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
    Filesize

    204KB

    MD5

    eac9d7d0af5f683503ec603650d352cd

    SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

    SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

    SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
    Filesize

    204KB

    MD5

    eac9d7d0af5f683503ec603650d352cd

    SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

    SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

    SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
    Filesize

    204KB

    MD5

    eac9d7d0af5f683503ec603650d352cd

    SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

    SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

    SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
    Filesize

    204KB

    MD5

    eac9d7d0af5f683503ec603650d352cd

    SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

    SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

    SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • \Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
    Filesize

    204KB

    MD5

    eac9d7d0af5f683503ec603650d352cd

    SHA1

    eecd0104a3c40b85d2cd75d4814e40a0a8d694ea

    SHA256

    6f98e53c34fb0ac52edf9c82ca710191a59c8f52bf0bc4defabe2cc6e884d0bd

    SHA512

    f6eaa3c3145974c56b939e29f92fdd7f1d32ff053679951f921c51413e3a93956ea840ee4aa872c1a944e20fd9dbb7ee3a5712b114c367fdfc1cbaf111bf363f

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
    Filesize

    126KB

    MD5

    adbaf286228c46522e50371c4be31a03

    SHA1

    a29d644c4663b2e2b2bd92046ba0df629537c297

    SHA256

    d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0

    SHA512

    74a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d

  • memory/848-63-0x0000000000000000-mapping.dmp
  • memory/1064-68-0x0000000000000000-mapping.dmp
  • memory/1276-75-0x0000000000000000-mapping.dmp
  • memory/1276-78-0x00000000002CB000-0x00000000002EA000-memory.dmp
    Filesize

    124KB

  • memory/1276-79-0x0000000000400000-0x0000000000AE5000-memory.dmp
    Filesize

    6.9MB

  • memory/1280-59-0x00000000002AB000-0x00000000002CA000-memory.dmp
    Filesize

    124KB

  • memory/1280-60-0x0000000002220000-0x000000000225E000-memory.dmp
    Filesize

    248KB

  • memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmp
    Filesize

    8KB

  • memory/1280-61-0x0000000000400000-0x0000000000AE5000-memory.dmp
    Filesize

    6.9MB

  • memory/1588-80-0x0000000000000000-mapping.dmp
  • memory/1588-83-0x0000000000F6B000-0x0000000000F8A000-memory.dmp
    Filesize

    124KB

  • memory/1588-84-0x0000000000400000-0x0000000000AE5000-memory.dmp
    Filesize

    6.9MB

  • memory/1888-66-0x0000000000400000-0x0000000000AE5000-memory.dmp
    Filesize

    6.9MB

  • memory/1888-65-0x0000000000C4B000-0x0000000000C6A000-memory.dmp
    Filesize

    124KB

  • memory/1888-67-0x0000000000C4B000-0x0000000000C6A000-memory.dmp
    Filesize

    124KB

  • memory/1888-57-0x0000000000000000-mapping.dmp