Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 18:47

General

  • Target

    file.exe

  • Size

    250KB

  • MD5

    bd3f73a24710730bbddc2a3c24ba1592

  • SHA1

    017ffc6f740deb20578b48953455ff425d1221f0

  • SHA256

    1500c038f6411d68fa23df8a674d43eafc12f925690cdc4d826b51a3eec583d6

  • SHA512

    7d57482415d31557468e34d2ebd54d8d8e20c0d9528c37672fe927792d673634a5c232a2b670066cbddbe332159aa0fd9260de6ab60157c5b83bb8199ca4d4e0

  • SSDEEP

    3072:UPmPW+V6ggAc5LhBXuZrYOy7KJx1TSDCSwpXBJzIdf/q8t56uKS2DAbEaatTE:v36ggnFCQKJ+CSGXBEVt56iEa4

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.167/v7eWcjs/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4460
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:764
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:1176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1144
      2⤵
      • Program crash
      PID:5000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4588 -ip 4588
    1⤵
      PID:4952
    • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
      1⤵
      • Executes dropped EXE
      PID:32
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 416
        2⤵
        • Program crash
        PID:4252
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 32 -ip 32
      1⤵
        PID:2352
      • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
        C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
        1⤵
        • Executes dropped EXE
        PID:1056
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 216
          2⤵
          • Program crash
          PID:4560
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1056 -ip 1056
        1⤵
          PID:420

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
          Filesize

          250KB

          MD5

          bd3f73a24710730bbddc2a3c24ba1592

          SHA1

          017ffc6f740deb20578b48953455ff425d1221f0

          SHA256

          1500c038f6411d68fa23df8a674d43eafc12f925690cdc4d826b51a3eec583d6

          SHA512

          7d57482415d31557468e34d2ebd54d8d8e20c0d9528c37672fe927792d673634a5c232a2b670066cbddbe332159aa0fd9260de6ab60157c5b83bb8199ca4d4e0

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
          Filesize

          250KB

          MD5

          bd3f73a24710730bbddc2a3c24ba1592

          SHA1

          017ffc6f740deb20578b48953455ff425d1221f0

          SHA256

          1500c038f6411d68fa23df8a674d43eafc12f925690cdc4d826b51a3eec583d6

          SHA512

          7d57482415d31557468e34d2ebd54d8d8e20c0d9528c37672fe927792d673634a5c232a2b670066cbddbe332159aa0fd9260de6ab60157c5b83bb8199ca4d4e0

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
          Filesize

          250KB

          MD5

          bd3f73a24710730bbddc2a3c24ba1592

          SHA1

          017ffc6f740deb20578b48953455ff425d1221f0

          SHA256

          1500c038f6411d68fa23df8a674d43eafc12f925690cdc4d826b51a3eec583d6

          SHA512

          7d57482415d31557468e34d2ebd54d8d8e20c0d9528c37672fe927792d673634a5c232a2b670066cbddbe332159aa0fd9260de6ab60157c5b83bb8199ca4d4e0

        • C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
          Filesize

          250KB

          MD5

          bd3f73a24710730bbddc2a3c24ba1592

          SHA1

          017ffc6f740deb20578b48953455ff425d1221f0

          SHA256

          1500c038f6411d68fa23df8a674d43eafc12f925690cdc4d826b51a3eec583d6

          SHA512

          7d57482415d31557468e34d2ebd54d8d8e20c0d9528c37672fe927792d673634a5c232a2b670066cbddbe332159aa0fd9260de6ab60157c5b83bb8199ca4d4e0

        • C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
          Filesize

          126KB

          MD5

          aebf8cd9ea982decded5ee6f3777c6d7

          SHA1

          406e723158cd5697503d1d04839d3bc7a5051603

          SHA256

          104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62

          SHA512

          f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981

        • C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll
          Filesize

          126KB

          MD5

          aebf8cd9ea982decded5ee6f3777c6d7

          SHA1

          406e723158cd5697503d1d04839d3bc7a5051603

          SHA256

          104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62

          SHA512

          f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981

        • memory/32-148-0x00000000007EC000-0x000000000080A000-memory.dmp
          Filesize

          120KB

        • memory/32-149-0x0000000000400000-0x0000000000474000-memory.dmp
          Filesize

          464KB

        • memory/764-143-0x0000000000000000-mapping.dmp
        • memory/1056-152-0x0000000000400000-0x0000000000474000-memory.dmp
          Filesize

          464KB

        • memory/1056-151-0x000000000077C000-0x000000000079A000-memory.dmp
          Filesize

          120KB

        • memory/1176-145-0x0000000000000000-mapping.dmp
        • memory/4460-139-0x00000000020C0000-0x00000000020FE000-memory.dmp
          Filesize

          248KB

        • memory/4460-140-0x0000000000400000-0x0000000000474000-memory.dmp
          Filesize

          464KB

        • memory/4460-138-0x0000000000518000-0x0000000000537000-memory.dmp
          Filesize

          124KB

        • memory/4460-135-0x0000000000000000-mapping.dmp
        • memory/4588-141-0x00000000005F9000-0x0000000000618000-memory.dmp
          Filesize

          124KB

        • memory/4588-132-0x00000000005F9000-0x0000000000618000-memory.dmp
          Filesize

          124KB

        • memory/4588-133-0x0000000002080000-0x00000000020BE000-memory.dmp
          Filesize

          248KB

        • memory/4588-134-0x0000000000400000-0x0000000000474000-memory.dmp
          Filesize

          464KB

        • memory/4588-142-0x0000000000400000-0x0000000000474000-memory.dmp
          Filesize

          464KB