Analysis
-
max time kernel
109s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-11-2022 15:28
Static task
static1
Behavioral task
behavioral1
Sample
8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe
Resource
win10-20220812-en
General
-
Target
8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe
-
Size
849KB
-
MD5
9fe473c71b3f7acc6677d557004dadfd
-
SHA1
534e2ba15c6773d788943684eb5389a056f9bf6b
-
SHA256
8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd
-
SHA512
6a0b5c6128ead760aaebd94f48cc7353def2d2fb82d75bf2a52af644e7af09d6ec0a6d1e3ac36fa367502f1984d4b3e2e87d6a55c7fabd4e277371bfa8c6cef7
-
SSDEEP
24576:/8KYcg2tm+VynCzAlk5154AKF7fBaXDbn5fj91NjjzU0o4:UKKCz3a0bVlv
Malware Config
Extracted
amadey
3.50
77.73.134.65/o7VsjdSa2f/index.php
Signatures
-
Detect Amadey credential stealer module 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll amadey_cred_module -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 7 4592 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
gntuud.exegntuud.exepid process 4880 gntuud.exe 3648 gntuud.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 4592 rundll32.exe 4592 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4592 rundll32.exe 4592 rundll32.exe 4592 rundll32.exe 4592 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exegntuud.exedescription pid process target process PID 2704 wrote to memory of 4880 2704 8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe gntuud.exe PID 2704 wrote to memory of 4880 2704 8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe gntuud.exe PID 2704 wrote to memory of 4880 2704 8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe gntuud.exe PID 4880 wrote to memory of 3040 4880 gntuud.exe schtasks.exe PID 4880 wrote to memory of 3040 4880 gntuud.exe schtasks.exe PID 4880 wrote to memory of 3040 4880 gntuud.exe schtasks.exe PID 4880 wrote to memory of 4592 4880 gntuud.exe rundll32.exe PID 4880 wrote to memory of 4592 4880 gntuud.exe rundll32.exe PID 4880 wrote to memory of 4592 4880 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe"C:\Users\Admin\AppData\Local\Temp\8ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exeC:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exeFilesize
849KB
MD59fe473c71b3f7acc6677d557004dadfd
SHA1534e2ba15c6773d788943684eb5389a056f9bf6b
SHA2568ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd
SHA5126a0b5c6128ead760aaebd94f48cc7353def2d2fb82d75bf2a52af644e7af09d6ec0a6d1e3ac36fa367502f1984d4b3e2e87d6a55c7fabd4e277371bfa8c6cef7
-
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exeFilesize
849KB
MD59fe473c71b3f7acc6677d557004dadfd
SHA1534e2ba15c6773d788943684eb5389a056f9bf6b
SHA2568ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd
SHA5126a0b5c6128ead760aaebd94f48cc7353def2d2fb82d75bf2a52af644e7af09d6ec0a6d1e3ac36fa367502f1984d4b3e2e87d6a55c7fabd4e277371bfa8c6cef7
-
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exeFilesize
849KB
MD59fe473c71b3f7acc6677d557004dadfd
SHA1534e2ba15c6773d788943684eb5389a056f9bf6b
SHA2568ba0ad85eed648d18d57fb344215e72718cdc21f067e7d94e990db858c1c74fd
SHA5126a0b5c6128ead760aaebd94f48cc7353def2d2fb82d75bf2a52af644e7af09d6ec0a6d1e3ac36fa367502f1984d4b3e2e87d6a55c7fabd4e277371bfa8c6cef7
-
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dllFilesize
126KB
MD5f6d14701e7c568254151e153f7763672
SHA14501ffb7284f29cca51b06deba0262b8d33f93f6
SHA256e246c844a272e80f2819e754e79a394e0fc964ad583ae90110dc38a01100b44d
SHA51262c1d6cbe6531a6b5d2a9fcdddd91cc3971dd81f1f5208e88c02d97d066e1b04665122817acb228894937279c49ac627bdb3c42cb32e130e39201f3108cde8f2
-
\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dllFilesize
126KB
MD5f6d14701e7c568254151e153f7763672
SHA14501ffb7284f29cca51b06deba0262b8d33f93f6
SHA256e246c844a272e80f2819e754e79a394e0fc964ad583ae90110dc38a01100b44d
SHA51262c1d6cbe6531a6b5d2a9fcdddd91cc3971dd81f1f5208e88c02d97d066e1b04665122817acb228894937279c49ac627bdb3c42cb32e130e39201f3108cde8f2
-
\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dllFilesize
126KB
MD5f6d14701e7c568254151e153f7763672
SHA14501ffb7284f29cca51b06deba0262b8d33f93f6
SHA256e246c844a272e80f2819e754e79a394e0fc964ad583ae90110dc38a01100b44d
SHA51262c1d6cbe6531a6b5d2a9fcdddd91cc3971dd81f1f5208e88c02d97d066e1b04665122817acb228894937279c49ac627bdb3c42cb32e130e39201f3108cde8f2
-
memory/2704-151-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-118-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-121-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-122-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-123-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-155-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-125-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-126-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-127-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-128-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-129-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-130-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-131-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-133-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-134-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-135-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-137-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-138-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-140-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-143-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-144-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-147-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-149-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-150-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-148-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-146-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-145-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-142-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-141-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-139-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-136-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-132-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-119-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-152-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-153-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-154-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-124-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-120-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-160-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-158-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-159-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-157-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-161-0x00000000023F0000-0x000000000242F000-memory.dmpFilesize
252KB
-
memory/2704-162-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/2704-163-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-164-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-165-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-166-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-167-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-168-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-173-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/2704-116-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-117-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2704-156-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/3040-224-0x0000000000000000-mapping.dmp
-
memory/3648-295-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/4592-296-0x0000000000000000-mapping.dmp
-
memory/4880-169-0x0000000000000000-mapping.dmp
-
memory/4880-184-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-177-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-183-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-251-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/4880-172-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-180-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-178-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-185-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-223-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/4880-176-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-175-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-171-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-182-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-174-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/4880-181-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB