Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 07:11
Static task
static1
Behavioral task
behavioral1
Sample
8e3a84fe51240b2f9a1e981e153b9c57.exe
Resource
win7-20220812-en
General
-
Target
8e3a84fe51240b2f9a1e981e153b9c57.exe
-
Size
273KB
-
MD5
8e3a84fe51240b2f9a1e981e153b9c57
-
SHA1
b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
-
SHA256
1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
-
SHA512
8f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
SSDEEP
6144:CpGJ8Lk3B3oSvcjS4e0nCX4V7r/mezTyZM:CpGyo3B37Tw75z
Malware Config
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
mnolyk.exemnolyk.exemnolyk.exepid process 228 mnolyk.exe 4540 mnolyk.exe 1020 mnolyk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8e3a84fe51240b2f9a1e981e153b9c57.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 8e3a84fe51240b2f9a1e981e153b9c57.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1960 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 2960 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 668 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 4576 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 1660 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 4208 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 1996 5060 WerFault.exe 8e3a84fe51240b2f9a1e981e153b9c57.exe 652 228 WerFault.exe mnolyk.exe 1316 228 WerFault.exe mnolyk.exe 1048 228 WerFault.exe mnolyk.exe 1864 228 WerFault.exe mnolyk.exe 4016 228 WerFault.exe mnolyk.exe 2516 228 WerFault.exe mnolyk.exe 3576 228 WerFault.exe mnolyk.exe 3284 228 WerFault.exe mnolyk.exe 1032 228 WerFault.exe mnolyk.exe 3280 228 WerFault.exe mnolyk.exe 3856 228 WerFault.exe mnolyk.exe 2228 228 WerFault.exe mnolyk.exe 4384 228 WerFault.exe mnolyk.exe 572 228 WerFault.exe mnolyk.exe 624 4540 WerFault.exe mnolyk.exe 4760 228 WerFault.exe mnolyk.exe 4664 1020 WerFault.exe mnolyk.exe 4356 228 WerFault.exe mnolyk.exe 4804 228 WerFault.exe mnolyk.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
8e3a84fe51240b2f9a1e981e153b9c57.exemnolyk.execmd.exedescription pid process target process PID 5060 wrote to memory of 228 5060 8e3a84fe51240b2f9a1e981e153b9c57.exe mnolyk.exe PID 5060 wrote to memory of 228 5060 8e3a84fe51240b2f9a1e981e153b9c57.exe mnolyk.exe PID 5060 wrote to memory of 228 5060 8e3a84fe51240b2f9a1e981e153b9c57.exe mnolyk.exe PID 228 wrote to memory of 1608 228 mnolyk.exe schtasks.exe PID 228 wrote to memory of 1608 228 mnolyk.exe schtasks.exe PID 228 wrote to memory of 1608 228 mnolyk.exe schtasks.exe PID 228 wrote to memory of 3424 228 mnolyk.exe cmd.exe PID 228 wrote to memory of 3424 228 mnolyk.exe cmd.exe PID 228 wrote to memory of 3424 228 mnolyk.exe cmd.exe PID 3424 wrote to memory of 4868 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 4868 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 4868 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 4204 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 4204 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 4204 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 3384 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 3384 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 3384 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 2272 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 2272 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 2272 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 2092 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 2092 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 2092 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 3980 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 3980 3424 cmd.exe cacls.exe PID 3424 wrote to memory of 3980 3424 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3a84fe51240b2f9a1e981e153b9c57.exe"C:\Users\Admin\AppData\Local\Temp\8e3a84fe51240b2f9a1e981e153b9c57.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 8762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 8762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10602⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 3483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 7203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 8003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 9443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 9563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 8923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 11923⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 12363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 3483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 6683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 12243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 10003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 10323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 13123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 228 -ip 2281⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 228 -ip 2281⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1020 -ip 10201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 228 -ip 2281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 228 -ip 2281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
273KB
MD58e3a84fe51240b2f9a1e981e153b9c57
SHA1b9ab34555604eb20d5e6ab3d3c729adafd43bbc9
SHA2561a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10
SHA5128f83f72d995ad80e62051219e7b47a7bd738ed3c630c4d1508ab7b30cf5265783c84157559791ded45e268c6ec0d1f99bda73957e096b5e466115c08c4661bfb
-
memory/228-135-0x0000000000000000-mapping.dmp
-
memory/228-141-0x0000000002E78000-0x0000000002E97000-memory.dmpFilesize
124KB
-
memory/228-142-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/228-152-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/228-151-0x0000000002E78000-0x0000000002E97000-memory.dmpFilesize
124KB
-
memory/1020-157-0x0000000002DCC000-0x0000000002DEB000-memory.dmpFilesize
124KB
-
memory/1020-158-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/1020-159-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/1608-143-0x0000000000000000-mapping.dmp
-
memory/2092-149-0x0000000000000000-mapping.dmp
-
memory/2272-148-0x0000000000000000-mapping.dmp
-
memory/3384-147-0x0000000000000000-mapping.dmp
-
memory/3424-144-0x0000000000000000-mapping.dmp
-
memory/3980-150-0x0000000000000000-mapping.dmp
-
memory/4204-146-0x0000000000000000-mapping.dmp
-
memory/4540-155-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/4868-145-0x0000000000000000-mapping.dmp
-
memory/5060-132-0x0000000002D99000-0x0000000002DB7000-memory.dmpFilesize
120KB
-
memory/5060-140-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/5060-139-0x0000000004920000-0x000000000495C000-memory.dmpFilesize
240KB
-
memory/5060-138-0x0000000002D99000-0x0000000002DB7000-memory.dmpFilesize
120KB
-
memory/5060-134-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/5060-133-0x0000000004920000-0x000000000495C000-memory.dmpFilesize
240KB