Analysis
- max time kernel
173s - max time network
219s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
01/12/2022, 16:30
General
- Target 31a7e9f97d1cebed3690ddf540c10abf29e907d30ccd4d9900bed12d3a3d25c9.exe
- Size 250KB
- Sample221201-tz1nbabc41
- SHA256 31a7e9f97d1cebed3690ddf540c10abf29e907d30ccd4d9900bed12d3a3d25c9
Malware Config
Extracted
-
amadey
-
3.50
-
31.41.244.167/v7eWcjs/index.php
Extracted
-
redline
-
doza
-
31.41.244.14:4694
-
auth_value
3e6a3c5da2002ab5e737f7f2fc6e0cad
Extracted
-
laplas
-
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Amadey credential stealer module 2 IoCs
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 3 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a7e9f97d1cebed3690ddf540c10abf29e907d30ccd4d9900bed12d3a3d25c9.exe"C:\Users\Admin\AppData\Local\Temp\31a7e9f97d1cebed3690ddf540c10abf29e907d30ccd4d9900bed12d3a3d25c9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000002001\doza.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\doza.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
-
C:\Users\Admin\AppData\Local\Temp\1000003001\anon.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\anon.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 9122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1548 -ip 15481⤵
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 4242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4432 -ip 44321⤵
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 4242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5028 -ip 50281⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
doza.exe
doza.exe
anon.exe
anon.exe
gala.exe
gala.exe
gntuud.exe
gntuud.exe
gntuud.exe
gntuud.exe
cred64.dll
cred64.dll
memory/528-139-0x00000000020A0000-0x00000000020DE000-memory.dmp
memory/528-138-0x0000000000618000-0x0000000000637000-memory.dmp
memory/528-140-0x0000000000400000-0x0000000000475000-memory.dmp
memory/528-144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1548-142-0x0000000000709000-0x0000000000728000-memory.dmp
memory/1548-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1548-134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1548-132-0x0000000000709000-0x0000000000728000-memory.dmp
memory/1548-133-0x0000000002090000-0x00000000020CE000-memory.dmp
memory/3640-171-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/3640-169-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/3640-168-0x0000000002830000-0x0000000002CC9000-memory.dmp
memory/3640-167-0x000000000260A000-0x0000000002829000-memory.dmp
memory/4432-147-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4432-146-0x000000000067C000-0x000000000069B000-memory.dmp
memory/4436-165-0x0000000000C70000-0x0000000000C98000-memory.dmp
memory/4436-172-0x0000000005BF0000-0x0000000006208000-memory.dmp
memory/4436-174-0x0000000005620000-0x0000000005632000-memory.dmp
memory/5012-170-0x0000000004AC0000-0x0000000004B52000-memory.dmp
memory/5012-158-0x0000000000600000-0x000000000063E000-memory.dmp
memory/5012-157-0x000000000068C000-0x00000000006BD000-memory.dmp
memory/5012-161-0x0000000000400000-0x0000000000484000-memory.dmp
memory/5012-159-0x0000000000400000-0x0000000000484000-memory.dmp
memory/5012-173-0x0000000005200000-0x000000000530A000-memory.dmp
memory/5012-166-0x0000000004C50000-0x00000000051F4000-memory.dmp
memory/5012-175-0x0000000005310000-0x000000000534C000-memory.dmp
memory/5012-160-0x000000000068C000-0x00000000006BD000-memory.dmp
memory/5028-177-0x00000000005FC000-0x000000000061B000-memory.dmp
memory/5028-178-0x0000000000400000-0x0000000000475000-memory.dmp