Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 06:51
Static task
static1
Behavioral task
behavioral1
Sample
af2af3438253366cfdd0457636e0dc83.exe
Resource
win7-20220812-en
General
-
Target
af2af3438253366cfdd0457636e0dc83.exe
-
Size
272KB
-
MD5
af2af3438253366cfdd0457636e0dc83
-
SHA1
4c0d8c3c672e4c06a3fea96d4de6353180b0ec70
-
SHA256
c57ba99f520a67028fa6b949bf174d46681ade2eb8c69bfa7b37944ca0738e09
-
SHA512
0e56c6b9bb13125041000777117bdfd82147bab2ddd77e52847e0509678cb1e30d5e380395f5af11c7b36c6f5e05cff656413ba38467b6e5d5b8548e6a0943cc
-
SSDEEP
3072:nl2tuy46q9toLPiWcI5Tq7R1pgmuAJnPOMk29MKuZR9kaYLnH82qqElddJpxNlk1:nlcsCLPi9d17BuCTIdvkaYH8xNRwZd
Malware Config
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
mnolyk.exemnolyk.exemnolyk.exepid process 3360 mnolyk.exe 1288 mnolyk.exe 4136 mnolyk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
af2af3438253366cfdd0457636e0dc83.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation af2af3438253366cfdd0457636e0dc83.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3684 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 1640 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 2404 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 4064 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 2208 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 3744 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 2000 628 WerFault.exe af2af3438253366cfdd0457636e0dc83.exe 4168 3360 WerFault.exe mnolyk.exe 4336 3360 WerFault.exe mnolyk.exe 4752 3360 WerFault.exe mnolyk.exe 860 3360 WerFault.exe mnolyk.exe 3468 3360 WerFault.exe mnolyk.exe 4764 3360 WerFault.exe mnolyk.exe 4236 3360 WerFault.exe mnolyk.exe 920 3360 WerFault.exe mnolyk.exe 2012 3360 WerFault.exe mnolyk.exe 4188 3360 WerFault.exe mnolyk.exe 4892 3360 WerFault.exe mnolyk.exe 3932 3360 WerFault.exe mnolyk.exe 1808 3360 WerFault.exe mnolyk.exe 1948 3360 WerFault.exe mnolyk.exe 4628 3360 WerFault.exe mnolyk.exe 2208 1288 WerFault.exe mnolyk.exe 3276 3360 WerFault.exe mnolyk.exe 3660 4136 WerFault.exe mnolyk.exe 4600 3360 WerFault.exe mnolyk.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
af2af3438253366cfdd0457636e0dc83.exemnolyk.execmd.exedescription pid process target process PID 628 wrote to memory of 3360 628 af2af3438253366cfdd0457636e0dc83.exe mnolyk.exe PID 628 wrote to memory of 3360 628 af2af3438253366cfdd0457636e0dc83.exe mnolyk.exe PID 628 wrote to memory of 3360 628 af2af3438253366cfdd0457636e0dc83.exe mnolyk.exe PID 3360 wrote to memory of 2280 3360 mnolyk.exe schtasks.exe PID 3360 wrote to memory of 2280 3360 mnolyk.exe schtasks.exe PID 3360 wrote to memory of 2280 3360 mnolyk.exe schtasks.exe PID 3360 wrote to memory of 2660 3360 mnolyk.exe cmd.exe PID 3360 wrote to memory of 2660 3360 mnolyk.exe cmd.exe PID 3360 wrote to memory of 2660 3360 mnolyk.exe cmd.exe PID 2660 wrote to memory of 1300 2660 cmd.exe cmd.exe PID 2660 wrote to memory of 1300 2660 cmd.exe cmd.exe PID 2660 wrote to memory of 1300 2660 cmd.exe cmd.exe PID 2660 wrote to memory of 5060 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 5060 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 5060 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 3456 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 3456 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 3456 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 3992 2660 cmd.exe cmd.exe PID 2660 wrote to memory of 3992 2660 cmd.exe cmd.exe PID 2660 wrote to memory of 3992 2660 cmd.exe cmd.exe PID 2660 wrote to memory of 5012 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 5012 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 5012 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 836 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 836 2660 cmd.exe cacls.exe PID 2660 wrote to memory of 836 2660 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af2af3438253366cfdd0457636e0dc83.exe"C:\Users\Admin\AppData\Local\Temp\af2af3438253366cfdd0457636e0dc83.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 9002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 9002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 8882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 10962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 11282⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 5843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 9043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 9083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 9043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 9043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 9683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 10323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 10083⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 8923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 11443⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 12043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 11683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 7763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 7923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 10163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 14643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 10443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 7522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3360 -ip 33601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3360 -ip 33601⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1288 -ip 12881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3360 -ip 33601⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4136 -ip 41361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3360 -ip 33601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
272KB
MD5af2af3438253366cfdd0457636e0dc83
SHA14c0d8c3c672e4c06a3fea96d4de6353180b0ec70
SHA256c57ba99f520a67028fa6b949bf174d46681ade2eb8c69bfa7b37944ca0738e09
SHA5120e56c6b9bb13125041000777117bdfd82147bab2ddd77e52847e0509678cb1e30d5e380395f5af11c7b36c6f5e05cff656413ba38467b6e5d5b8548e6a0943cc
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
272KB
MD5af2af3438253366cfdd0457636e0dc83
SHA14c0d8c3c672e4c06a3fea96d4de6353180b0ec70
SHA256c57ba99f520a67028fa6b949bf174d46681ade2eb8c69bfa7b37944ca0738e09
SHA5120e56c6b9bb13125041000777117bdfd82147bab2ddd77e52847e0509678cb1e30d5e380395f5af11c7b36c6f5e05cff656413ba38467b6e5d5b8548e6a0943cc
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
272KB
MD5af2af3438253366cfdd0457636e0dc83
SHA14c0d8c3c672e4c06a3fea96d4de6353180b0ec70
SHA256c57ba99f520a67028fa6b949bf174d46681ade2eb8c69bfa7b37944ca0738e09
SHA5120e56c6b9bb13125041000777117bdfd82147bab2ddd77e52847e0509678cb1e30d5e380395f5af11c7b36c6f5e05cff656413ba38467b6e5d5b8548e6a0943cc
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
272KB
MD5af2af3438253366cfdd0457636e0dc83
SHA14c0d8c3c672e4c06a3fea96d4de6353180b0ec70
SHA256c57ba99f520a67028fa6b949bf174d46681ade2eb8c69bfa7b37944ca0738e09
SHA5120e56c6b9bb13125041000777117bdfd82147bab2ddd77e52847e0509678cb1e30d5e380395f5af11c7b36c6f5e05cff656413ba38467b6e5d5b8548e6a0943cc
-
memory/628-133-0x0000000002C89000-0x0000000002CA8000-memory.dmpFilesize
124KB
-
memory/628-134-0x0000000002C20000-0x0000000002C5C000-memory.dmpFilesize
240KB
-
memory/628-135-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/628-139-0x0000000002C89000-0x0000000002CA8000-memory.dmpFilesize
124KB
-
memory/628-140-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/836-150-0x0000000000000000-mapping.dmp
-
memory/1288-155-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/1288-154-0x0000000002D3C000-0x0000000002D5A000-memory.dmpFilesize
120KB
-
memory/1300-145-0x0000000000000000-mapping.dmp
-
memory/2280-143-0x0000000000000000-mapping.dmp
-
memory/2660-144-0x0000000000000000-mapping.dmp
-
memory/3360-141-0x0000000002C58000-0x0000000002C77000-memory.dmpFilesize
124KB
-
memory/3360-151-0x0000000002C58000-0x0000000002C77000-memory.dmpFilesize
124KB
-
memory/3360-152-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/3360-142-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/3360-136-0x0000000000000000-mapping.dmp
-
memory/3456-147-0x0000000000000000-mapping.dmp
-
memory/3992-148-0x0000000000000000-mapping.dmp
-
memory/4136-157-0x0000000002D6C000-0x0000000002D8A000-memory.dmpFilesize
120KB
-
memory/4136-158-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/5012-149-0x0000000000000000-mapping.dmp
-
memory/5060-146-0x0000000000000000-mapping.dmp