Analysis
-
max time kernel
335s -
max time network
349s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 12:46
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
318KB
-
MD5
9f0a4cd3f3f569f7cc68726c080b180d
-
SHA1
205246356ed0197848099e2782b0fb87aa620a74
-
SHA256
f7322e9a9c8c782bad8065a0b54994b459f0bc965a4d4c344db9559aab8225a4
-
SHA512
c1e24fae51a4b0f90f94b7703d4af3f0d77e4ce824a3e4ef8c2ba33137bde83a984262398fa8fa6f02a4a6e3709fcacce0e1c405910fa0bf113e4f4e37fad8b3
-
SSDEEP
6144:mlMGofSBduJKCUBasCwqNpVmTX02sesnP9e2U:mWGRsJKCUUsCBNpYXPVmsd
Malware Config
Extracted
amadey
3.50
31.41.244.167/v7eWcjs/index.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
gntuud.exegntuud.exelinda5.exeanon.exepid process 4212 gntuud.exe 3640 gntuud.exe 780 linda5.exe 3988 anon.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exegntuud.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation gntuud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2416 2208 WerFault.exe file.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
file.exegntuud.exedescription pid process target process PID 2208 wrote to memory of 4212 2208 file.exe gntuud.exe PID 2208 wrote to memory of 4212 2208 file.exe gntuud.exe PID 2208 wrote to memory of 4212 2208 file.exe gntuud.exe PID 4212 wrote to memory of 3128 4212 gntuud.exe schtasks.exe PID 4212 wrote to memory of 3128 4212 gntuud.exe schtasks.exe PID 4212 wrote to memory of 3128 4212 gntuud.exe schtasks.exe PID 4212 wrote to memory of 780 4212 gntuud.exe linda5.exe PID 4212 wrote to memory of 780 4212 gntuud.exe linda5.exe PID 4212 wrote to memory of 780 4212 gntuud.exe linda5.exe PID 4212 wrote to memory of 3988 4212 gntuud.exe anon.exe PID 4212 wrote to memory of 3988 4212 gntuud.exe anon.exe PID 4212 wrote to memory of 3988 4212 gntuud.exe anon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000009001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\linda5.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000010001\anon.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\anon.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2208 -ip 22081⤵
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000009001\linda5.exeFilesize
1.6MB
MD5f8c535b84177949c3261aaba892b3dfa
SHA11cb9ae11307af712829e3e5623852c353fd559b2
SHA25665a70e70aead3c8769418f964e88b2fe2e7cd6061140c5abc5aaca8dc8639c04
SHA5125a6fa3d2a714bfa47de2331515ef715e693046f2f37ef928431f7b48b3ba14a7fb9330e8b5942b826f7b60441b98a392a4e58234d4c38895fe07660989fff4a9
-
C:\Users\Admin\AppData\Local\Temp\1000009001\linda5.exeFilesize
1.6MB
MD5f8c535b84177949c3261aaba892b3dfa
SHA11cb9ae11307af712829e3e5623852c353fd559b2
SHA25665a70e70aead3c8769418f964e88b2fe2e7cd6061140c5abc5aaca8dc8639c04
SHA5125a6fa3d2a714bfa47de2331515ef715e693046f2f37ef928431f7b48b3ba14a7fb9330e8b5942b826f7b60441b98a392a4e58234d4c38895fe07660989fff4a9
-
C:\Users\Admin\AppData\Local\Temp\1000010001\anon.exeFilesize
330KB
MD50da15cc2749e7117722946f24f941a52
SHA1466f5d7208af46d10a33efb50235099024ba9d8b
SHA256d510a346e59953f8015eb4f8f014896f25255f28a924a749d54152ebb6cfe4df
SHA512e2af593a8babe932d62b2b8f83f55037f31d8650d140b4b839ff3a5f2220d243e4a5e526065f90b8516db73f7fce6ae53f6c76083c4bdf6335c1ec527fea8000
-
C:\Users\Admin\AppData\Local\Temp\1000010001\anon.exeFilesize
330KB
MD50da15cc2749e7117722946f24f941a52
SHA1466f5d7208af46d10a33efb50235099024ba9d8b
SHA256d510a346e59953f8015eb4f8f014896f25255f28a924a749d54152ebb6cfe4df
SHA512e2af593a8babe932d62b2b8f83f55037f31d8650d140b4b839ff3a5f2220d243e4a5e526065f90b8516db73f7fce6ae53f6c76083c4bdf6335c1ec527fea8000
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
318KB
MD59f0a4cd3f3f569f7cc68726c080b180d
SHA1205246356ed0197848099e2782b0fb87aa620a74
SHA256f7322e9a9c8c782bad8065a0b54994b459f0bc965a4d4c344db9559aab8225a4
SHA512c1e24fae51a4b0f90f94b7703d4af3f0d77e4ce824a3e4ef8c2ba33137bde83a984262398fa8fa6f02a4a6e3709fcacce0e1c405910fa0bf113e4f4e37fad8b3
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
318KB
MD59f0a4cd3f3f569f7cc68726c080b180d
SHA1205246356ed0197848099e2782b0fb87aa620a74
SHA256f7322e9a9c8c782bad8065a0b54994b459f0bc965a4d4c344db9559aab8225a4
SHA512c1e24fae51a4b0f90f94b7703d4af3f0d77e4ce824a3e4ef8c2ba33137bde83a984262398fa8fa6f02a4a6e3709fcacce0e1c405910fa0bf113e4f4e37fad8b3
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
318KB
MD59f0a4cd3f3f569f7cc68726c080b180d
SHA1205246356ed0197848099e2782b0fb87aa620a74
SHA256f7322e9a9c8c782bad8065a0b54994b459f0bc965a4d4c344db9559aab8225a4
SHA512c1e24fae51a4b0f90f94b7703d4af3f0d77e4ce824a3e4ef8c2ba33137bde83a984262398fa8fa6f02a4a6e3709fcacce0e1c405910fa0bf113e4f4e37fad8b3
-
memory/780-143-0x0000000000000000-mapping.dmp
-
memory/2208-133-0x0000000000660000-0x000000000069E000-memory.dmpFilesize
248KB
-
memory/2208-134-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2208-132-0x00000000004A9000-0x00000000004C8000-memory.dmpFilesize
124KB
-
memory/3128-141-0x0000000000000000-mapping.dmp
-
memory/3640-149-0x00000000004CC000-0x00000000004EB000-memory.dmpFilesize
124KB
-
memory/3988-144-0x0000000000000000-mapping.dmp
-
memory/3988-150-0x0000000000528000-0x0000000000559000-memory.dmpFilesize
196KB
-
memory/3988-151-0x00000000020E0000-0x000000000211E000-memory.dmpFilesize
248KB
-
memory/3988-152-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/4212-138-0x0000000000798000-0x00000000007B7000-memory.dmpFilesize
124KB
-
memory/4212-135-0x0000000000000000-mapping.dmp
-
memory/4212-140-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4212-139-0x00000000006D0000-0x000000000070E000-memory.dmpFilesize
248KB