Analysis
-
max time kernel
188s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2022 03:14
Static task
static1
Behavioral task
behavioral1
Sample
e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe
Resource
win7-20221111-en
General
-
Target
e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe
-
Size
299KB
-
MD5
cd4c96ec46c7c5e1f4c57532f3e6bb58
-
SHA1
4bebd3f286874f7336a2155300086f6a2da79338
-
SHA256
e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61
-
SHA512
d0f79aa4c1d7d41868ada4eec52afe69f6fc114ff5296a401bbe023329a7b0b751fa62b0559db8ed773010ec20689f3974e755d42ed0d93c2e9488628a0bc838
-
SSDEEP
6144:7aJg/BgxAvuJZYXp0NgTfaYW/l43CiMcZ8KabX4NuXkDKi:7ahAvurNU3CyE6u
Malware Config
Extracted
amadey
3.50
31.41.244.237/jg94cVd30f/index.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
gntuud.exegntuud.exegntuud.exepid process 3584 gntuud.exe 4384 gntuud.exe 2144 gntuud.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
gntuud.exee7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation gntuud.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1724 2244 WerFault.exe e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe 3036 4384 WerFault.exe gntuud.exe 1708 2144 WerFault.exe gntuud.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exegntuud.execmd.exedescription pid process target process PID 2244 wrote to memory of 3584 2244 e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe gntuud.exe PID 2244 wrote to memory of 3584 2244 e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe gntuud.exe PID 2244 wrote to memory of 3584 2244 e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe gntuud.exe PID 3584 wrote to memory of 732 3584 gntuud.exe schtasks.exe PID 3584 wrote to memory of 732 3584 gntuud.exe schtasks.exe PID 3584 wrote to memory of 732 3584 gntuud.exe schtasks.exe PID 3584 wrote to memory of 1056 3584 gntuud.exe cmd.exe PID 3584 wrote to memory of 1056 3584 gntuud.exe cmd.exe PID 3584 wrote to memory of 1056 3584 gntuud.exe cmd.exe PID 1056 wrote to memory of 2036 1056 cmd.exe cmd.exe PID 1056 wrote to memory of 2036 1056 cmd.exe cmd.exe PID 1056 wrote to memory of 2036 1056 cmd.exe cmd.exe PID 1056 wrote to memory of 4976 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4976 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4976 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4892 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4892 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4892 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4100 1056 cmd.exe cmd.exe PID 1056 wrote to memory of 4100 1056 cmd.exe cmd.exe PID 1056 wrote to memory of 4100 1056 cmd.exe cmd.exe PID 1056 wrote to memory of 4088 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4088 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 4088 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 3680 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 3680 1056 cmd.exe cacls.exe PID 1056 wrote to memory of 3680 1056 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe"C:\Users\Admin\AppData\Local\Temp\e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "Admin:N"&&CACLS "gntuud.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9c69749b54" /P "Admin:N"&&CACLS "..\9c69749b54" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "gntuud.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "gntuud.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\9c69749b54" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\9c69749b54" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 11442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2244 -ip 22441⤵
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exeC:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 4402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4384 -ip 43841⤵
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exeC:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 4162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2144 -ip 21441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exeFilesize
299KB
MD5cd4c96ec46c7c5e1f4c57532f3e6bb58
SHA14bebd3f286874f7336a2155300086f6a2da79338
SHA256e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61
SHA512d0f79aa4c1d7d41868ada4eec52afe69f6fc114ff5296a401bbe023329a7b0b751fa62b0559db8ed773010ec20689f3974e755d42ed0d93c2e9488628a0bc838
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exeFilesize
299KB
MD5cd4c96ec46c7c5e1f4c57532f3e6bb58
SHA14bebd3f286874f7336a2155300086f6a2da79338
SHA256e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61
SHA512d0f79aa4c1d7d41868ada4eec52afe69f6fc114ff5296a401bbe023329a7b0b751fa62b0559db8ed773010ec20689f3974e755d42ed0d93c2e9488628a0bc838
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exeFilesize
299KB
MD5cd4c96ec46c7c5e1f4c57532f3e6bb58
SHA14bebd3f286874f7336a2155300086f6a2da79338
SHA256e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61
SHA512d0f79aa4c1d7d41868ada4eec52afe69f6fc114ff5296a401bbe023329a7b0b751fa62b0559db8ed773010ec20689f3974e755d42ed0d93c2e9488628a0bc838
-
C:\Users\Admin\AppData\Local\Temp\9c69749b54\gntuud.exeFilesize
299KB
MD5cd4c96ec46c7c5e1f4c57532f3e6bb58
SHA14bebd3f286874f7336a2155300086f6a2da79338
SHA256e7dacdbd7e9b95a04785824ec417bd166d1aed5e2d502102ccdcc3c8ceecae61
SHA512d0f79aa4c1d7d41868ada4eec52afe69f6fc114ff5296a401bbe023329a7b0b751fa62b0559db8ed773010ec20689f3974e755d42ed0d93c2e9488628a0bc838
-
memory/732-141-0x0000000000000000-mapping.dmp
-
memory/1056-142-0x0000000000000000-mapping.dmp
-
memory/2036-143-0x0000000000000000-mapping.dmp
-
memory/2144-161-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2144-160-0x00000000006E4000-0x0000000000703000-memory.dmpFilesize
124KB
-
memory/2244-153-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2244-152-0x0000000000722000-0x0000000000741000-memory.dmpFilesize
124KB
-
memory/2244-136-0x00000000020B0000-0x00000000020EE000-memory.dmpFilesize
248KB
-
memory/2244-137-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2244-135-0x0000000000722000-0x0000000000741000-memory.dmpFilesize
124KB
-
memory/3584-149-0x0000000000600000-0x000000000063E000-memory.dmpFilesize
248KB
-
memory/3584-150-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3584-148-0x00000000007F3000-0x0000000000812000-memory.dmpFilesize
124KB
-
memory/3584-154-0x00000000007F3000-0x0000000000812000-memory.dmpFilesize
124KB
-
memory/3584-155-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3584-138-0x0000000000000000-mapping.dmp
-
memory/3680-151-0x0000000000000000-mapping.dmp
-
memory/4088-147-0x0000000000000000-mapping.dmp
-
memory/4100-146-0x0000000000000000-mapping.dmp
-
memory/4384-157-0x00000000004D4000-0x00000000004F3000-memory.dmpFilesize
124KB
-
memory/4384-158-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/4892-145-0x0000000000000000-mapping.dmp
-
memory/4976-144-0x0000000000000000-mapping.dmp