Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2022, 17:28

General

  • Target

    952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4.exe

  • Size

    367KB

  • MD5

    17988a22cb3105fae2488f11a38e55e7

  • SHA1

    ded099d65110a6be60931ae3e46d14c24ef562e6

  • SHA256

    952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4

  • SHA512

    0bceec8403c66a7417d9a837e3531c070ccf22f6473845dcd1ba877a26f6469f4dafdfb185e1462165171f476b3b20d2b596c6d676e93ccbf9394e00d3603a56

  • SSDEEP

    6144:JYCnsLtk6+k4guyzJGRRpppzgLno2VMzrPrTvt0l0iPvzpQ6ijLxQFiaI:FsBkDtOFKpdgLoBPfv+lxnzpQ6ijqF

Malware Config

Extracted

Family

amadey

Version

3.60

C2

62.204.41.79/fb73jc3/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4.exe
    "C:\Users\Admin\AppData\Local\Temp\952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
      "C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:548
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "Admin:N"&&CACLS "gntuud.exe" /P "Admin:R" /E&&echo Y|CACLS "..\2c33368f7d" /P "Admin:N"&&CACLS "..\2c33368f7d" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1048
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "gntuud.exe" /P "Admin:N"
            4⤵
              PID:4400
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "gntuud.exe" /P "Admin:R" /E
              4⤵
                PID:100
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:204
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\2c33368f7d" /P "Admin:N"
                  4⤵
                    PID:228
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\2c33368f7d" /P "Admin:R" /E
                    4⤵
                      PID:4796
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
                    3⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    • Accesses Microsoft Outlook profiles
                    • Suspicious behavior: EnumeratesProcesses
                    • outlook_win_path
                    PID:4124
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 1136
                  2⤵
                  • Program crash
                  PID:3196
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 676 -ip 676
                1⤵
                  PID:2132
                • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
                  C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3368
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 420
                    2⤵
                    • Program crash
                    PID:4336
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3368 -ip 3368
                  1⤵
                    PID:3924
                  • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
                    C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1276
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 428
                      2⤵
                      • Program crash
                      PID:3744
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1276 -ip 1276
                    1⤵
                      PID:1516
                    • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
                      C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4356
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 236
                        2⤵
                        • Program crash
                        PID:4164
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4356 -ip 4356
                      1⤵
                        PID:620

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe

                        Filesize

                        367KB

                        MD5

                        17988a22cb3105fae2488f11a38e55e7

                        SHA1

                        ded099d65110a6be60931ae3e46d14c24ef562e6

                        SHA256

                        952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4

                        SHA512

                        0bceec8403c66a7417d9a837e3531c070ccf22f6473845dcd1ba877a26f6469f4dafdfb185e1462165171f476b3b20d2b596c6d676e93ccbf9394e00d3603a56

                      • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe

                        Filesize

                        367KB

                        MD5

                        17988a22cb3105fae2488f11a38e55e7

                        SHA1

                        ded099d65110a6be60931ae3e46d14c24ef562e6

                        SHA256

                        952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4

                        SHA512

                        0bceec8403c66a7417d9a837e3531c070ccf22f6473845dcd1ba877a26f6469f4dafdfb185e1462165171f476b3b20d2b596c6d676e93ccbf9394e00d3603a56

                      • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe

                        Filesize

                        367KB

                        MD5

                        17988a22cb3105fae2488f11a38e55e7

                        SHA1

                        ded099d65110a6be60931ae3e46d14c24ef562e6

                        SHA256

                        952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4

                        SHA512

                        0bceec8403c66a7417d9a837e3531c070ccf22f6473845dcd1ba877a26f6469f4dafdfb185e1462165171f476b3b20d2b596c6d676e93ccbf9394e00d3603a56

                      • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe

                        Filesize

                        367KB

                        MD5

                        17988a22cb3105fae2488f11a38e55e7

                        SHA1

                        ded099d65110a6be60931ae3e46d14c24ef562e6

                        SHA256

                        952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4

                        SHA512

                        0bceec8403c66a7417d9a837e3531c070ccf22f6473845dcd1ba877a26f6469f4dafdfb185e1462165171f476b3b20d2b596c6d676e93ccbf9394e00d3603a56

                      • C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe

                        Filesize

                        367KB

                        MD5

                        17988a22cb3105fae2488f11a38e55e7

                        SHA1

                        ded099d65110a6be60931ae3e46d14c24ef562e6

                        SHA256

                        952516f9329a78c22dd4616690e1da1d468876a5a5d7410bf3b087d2bd65eec4

                        SHA512

                        0bceec8403c66a7417d9a837e3531c070ccf22f6473845dcd1ba877a26f6469f4dafdfb185e1462165171f476b3b20d2b596c6d676e93ccbf9394e00d3603a56

                      • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll

                        Filesize

                        126KB

                        MD5

                        9995abf2f401e4945a7d2930a3727619

                        SHA1

                        7715e14ad6e4adf609c62c5812419800343fbd4f

                        SHA256

                        d35b5dd18d91dbfe3dc89cb75b6a26757777b5c52a33cd8fcf6e5ed45a946f1a

                        SHA512

                        42726fb602958594914b5bc936aff36833823f9f9da9bc80a46579d96cec12c7df070c174ec9dd82c21f2fe44f1e9a4a2e50d9944fea6379dbdec666727a7eda

                      • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll

                        Filesize

                        126KB

                        MD5

                        9995abf2f401e4945a7d2930a3727619

                        SHA1

                        7715e14ad6e4adf609c62c5812419800343fbd4f

                        SHA256

                        d35b5dd18d91dbfe3dc89cb75b6a26757777b5c52a33cd8fcf6e5ed45a946f1a

                        SHA512

                        42726fb602958594914b5bc936aff36833823f9f9da9bc80a46579d96cec12c7df070c174ec9dd82c21f2fe44f1e9a4a2e50d9944fea6379dbdec666727a7eda

                      • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll

                        Filesize

                        126KB

                        MD5

                        9995abf2f401e4945a7d2930a3727619

                        SHA1

                        7715e14ad6e4adf609c62c5812419800343fbd4f

                        SHA256

                        d35b5dd18d91dbfe3dc89cb75b6a26757777b5c52a33cd8fcf6e5ed45a946f1a

                        SHA512

                        42726fb602958594914b5bc936aff36833823f9f9da9bc80a46579d96cec12c7df070c174ec9dd82c21f2fe44f1e9a4a2e50d9944fea6379dbdec666727a7eda

                      • memory/676-132-0x0000000000618000-0x0000000000637000-memory.dmp

                        Filesize

                        124KB

                      • memory/676-138-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/676-134-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/676-133-0x00000000021E0000-0x000000000221E000-memory.dmp

                        Filesize

                        248KB

                      • memory/1276-160-0x000000000075C000-0x000000000077B000-memory.dmp

                        Filesize

                        124KB

                      • memory/1276-161-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3368-153-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3368-152-0x00000000006EC000-0x000000000070B000-memory.dmp

                        Filesize

                        124KB

                      • memory/3472-148-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3472-150-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3472-149-0x0000000000738000-0x0000000000758000-memory.dmp

                        Filesize

                        128KB

                      • memory/3472-147-0x0000000000738000-0x0000000000758000-memory.dmp

                        Filesize

                        128KB

                      • memory/4124-158-0x0000000000980000-0x00000000009A4000-memory.dmp

                        Filesize

                        144KB

                      • memory/4356-163-0x00000000007BC000-0x00000000007DB000-memory.dmp

                        Filesize

                        124KB

                      • memory/4356-164-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB