Analysis
-
max time kernel
241s -
max time network
254s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 03:20
Static task
static1
Behavioral task
behavioral1
Sample
976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe
Resource
win7-20220901-en
General
-
Target
976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe
-
Size
332KB
-
MD5
933a85f92647e1d6ebc124fabb767475
-
SHA1
cd5683be2cdcd5bab25b9eb2ce90a6926ced96f3
-
SHA256
976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b
-
SHA512
5f18a1f0261266e91ebbd88407397c8968302d683e92d4fdf420b65817f41003dc8df896ab8f7caa3e36916b1de7e516b12426fee34315920f62ec6151c77922
-
SSDEEP
6144:ZQve+k+JZnNEfnxMQFUBVDl42is8Gs3fxSHdbqoWJzRIDceNVS:ZQWf+J/Ux/y542FVoo9GoWJaDceNVS
Malware Config
Extracted
amadey
3.50
62.204.41.6/p9cWxH/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
gntuud.exegntuud.exegntuud.exepid process 3616 gntuud.exe 5116 gntuud.exe 3608 gntuud.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exegntuud.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation gntuud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2172 4936 WerFault.exe 976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe 1056 5116 WerFault.exe gntuud.exe 2504 3608 WerFault.exe gntuud.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exegntuud.exedescription pid process target process PID 4936 wrote to memory of 3616 4936 976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe gntuud.exe PID 4936 wrote to memory of 3616 4936 976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe gntuud.exe PID 4936 wrote to memory of 3616 4936 976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe gntuud.exe PID 3616 wrote to memory of 4908 3616 gntuud.exe schtasks.exe PID 3616 wrote to memory of 4908 3616 gntuud.exe schtasks.exe PID 3616 wrote to memory of 4908 3616 gntuud.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe"C:\Users\Admin\AppData\Local\Temp\976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 9082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4936 -ip 49361⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 2162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5116 -ip 51161⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 4162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3608 -ip 36081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
332KB
MD5933a85f92647e1d6ebc124fabb767475
SHA1cd5683be2cdcd5bab25b9eb2ce90a6926ced96f3
SHA256976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b
SHA5125f18a1f0261266e91ebbd88407397c8968302d683e92d4fdf420b65817f41003dc8df896ab8f7caa3e36916b1de7e516b12426fee34315920f62ec6151c77922
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
332KB
MD5933a85f92647e1d6ebc124fabb767475
SHA1cd5683be2cdcd5bab25b9eb2ce90a6926ced96f3
SHA256976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b
SHA5125f18a1f0261266e91ebbd88407397c8968302d683e92d4fdf420b65817f41003dc8df896ab8f7caa3e36916b1de7e516b12426fee34315920f62ec6151c77922
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
332KB
MD5933a85f92647e1d6ebc124fabb767475
SHA1cd5683be2cdcd5bab25b9eb2ce90a6926ced96f3
SHA256976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b
SHA5125f18a1f0261266e91ebbd88407397c8968302d683e92d4fdf420b65817f41003dc8df896ab8f7caa3e36916b1de7e516b12426fee34315920f62ec6151c77922
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
332KB
MD5933a85f92647e1d6ebc124fabb767475
SHA1cd5683be2cdcd5bab25b9eb2ce90a6926ced96f3
SHA256976fc609d841717da80daa35279c65df2dc9d4f928483259b287208b86097a7b
SHA5125f18a1f0261266e91ebbd88407397c8968302d683e92d4fdf420b65817f41003dc8df896ab8f7caa3e36916b1de7e516b12426fee34315920f62ec6151c77922
-
memory/3608-149-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/3608-148-0x000000000071C000-0x000000000073B000-memory.dmpFilesize
124KB
-
memory/3616-143-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/3616-138-0x0000000000638000-0x0000000000657000-memory.dmpFilesize
124KB
-
memory/3616-139-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/3616-135-0x0000000000000000-mapping.dmp
-
memory/4908-140-0x0000000000000000-mapping.dmp
-
memory/4936-141-0x00000000006A8000-0x00000000006C7000-memory.dmpFilesize
124KB
-
memory/4936-132-0x00000000006A8000-0x00000000006C7000-memory.dmpFilesize
124KB
-
memory/4936-142-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/4936-133-0x00000000005D0000-0x000000000060E000-memory.dmpFilesize
248KB
-
memory/4936-134-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/5116-145-0x00000000005BB000-0x00000000005DA000-memory.dmpFilesize
124KB
-
memory/5116-146-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB