Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09-06-2023 07:05
General
-
Target
56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe
-
Size
218KB
-
MD5
3367e30e4f2e023419d7b3c4251f854f
-
SHA1
f364b4426d5ec06f152b0dde69306313f1de34ee
-
SHA256
56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490
-
SHA512
6ea512daf807b64acedb2b8e61b1b818ce181f9a56069688b49b1067493613362cd00d14a6e5e849caa2582e85ec46ffa59e15944fdeead54da98a552e76c85b
-
SSDEEP
3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj
Malware Config
Extracted
amadey
3.83
77.91.68.62/wings/game/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
metado.exemetado.exemetado.exepid process 4440 metado.exe 4544 metado.exe 1240 metado.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1008 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exepid process 4080 56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exemetado.execmd.exedescription pid process target process PID 4080 wrote to memory of 4440 4080 56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe metado.exe PID 4080 wrote to memory of 4440 4080 56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe metado.exe PID 4080 wrote to memory of 4440 4080 56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe metado.exe PID 4440 wrote to memory of 4908 4440 metado.exe schtasks.exe PID 4440 wrote to memory of 4908 4440 metado.exe schtasks.exe PID 4440 wrote to memory of 4908 4440 metado.exe schtasks.exe PID 4440 wrote to memory of 4244 4440 metado.exe cmd.exe PID 4440 wrote to memory of 4244 4440 metado.exe cmd.exe PID 4440 wrote to memory of 4244 4440 metado.exe cmd.exe PID 4244 wrote to memory of 1736 4244 cmd.exe cmd.exe PID 4244 wrote to memory of 1736 4244 cmd.exe cmd.exe PID 4244 wrote to memory of 1736 4244 cmd.exe cmd.exe PID 4244 wrote to memory of 1412 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 1412 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 1412 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 2056 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 2056 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 2056 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 3488 4244 cmd.exe cmd.exe PID 4244 wrote to memory of 3488 4244 cmd.exe cmd.exe PID 4244 wrote to memory of 3488 4244 cmd.exe cmd.exe PID 4244 wrote to memory of 4400 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 4400 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 4400 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 4488 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 4488 4244 cmd.exe cacls.exe PID 4244 wrote to memory of 4488 4244 cmd.exe cacls.exe PID 4440 wrote to memory of 1008 4440 metado.exe rundll32.exe PID 4440 wrote to memory of 1008 4440 metado.exe rundll32.exe PID 4440 wrote to memory of 1008 4440 metado.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe"C:\Users\Admin\AppData\Local\Temp\56de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "metado.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "metado.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeFilesize
218KB
MD53367e30e4f2e023419d7b3c4251f854f
SHA1f364b4426d5ec06f152b0dde69306313f1de34ee
SHA25656de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490
SHA5126ea512daf807b64acedb2b8e61b1b818ce181f9a56069688b49b1067493613362cd00d14a6e5e849caa2582e85ec46ffa59e15944fdeead54da98a552e76c85b
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeFilesize
218KB
MD53367e30e4f2e023419d7b3c4251f854f
SHA1f364b4426d5ec06f152b0dde69306313f1de34ee
SHA25656de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490
SHA5126ea512daf807b64acedb2b8e61b1b818ce181f9a56069688b49b1067493613362cd00d14a6e5e849caa2582e85ec46ffa59e15944fdeead54da98a552e76c85b
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeFilesize
218KB
MD53367e30e4f2e023419d7b3c4251f854f
SHA1f364b4426d5ec06f152b0dde69306313f1de34ee
SHA25656de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490
SHA5126ea512daf807b64acedb2b8e61b1b818ce181f9a56069688b49b1067493613362cd00d14a6e5e849caa2582e85ec46ffa59e15944fdeead54da98a552e76c85b
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeFilesize
218KB
MD53367e30e4f2e023419d7b3c4251f854f
SHA1f364b4426d5ec06f152b0dde69306313f1de34ee
SHA25656de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490
SHA5126ea512daf807b64acedb2b8e61b1b818ce181f9a56069688b49b1067493613362cd00d14a6e5e849caa2582e85ec46ffa59e15944fdeead54da98a552e76c85b
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exeFilesize
218KB
MD53367e30e4f2e023419d7b3c4251f854f
SHA1f364b4426d5ec06f152b0dde69306313f1de34ee
SHA25656de980060e4a4e6619fcda6b716b08278487459a301a1938838b90467531490
SHA5126ea512daf807b64acedb2b8e61b1b818ce181f9a56069688b49b1067493613362cd00d14a6e5e849caa2582e85ec46ffa59e15944fdeead54da98a552e76c85b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5547bae937be965d63f61d89e8eafb4a1
SHA185466c95625bcbb7f68aa89a367149d35f80e1fa
SHA256015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5
SHA5121869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5547bae937be965d63f61d89e8eafb4a1
SHA185466c95625bcbb7f68aa89a367149d35f80e1fa
SHA256015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5
SHA5121869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5547bae937be965d63f61d89e8eafb4a1
SHA185466c95625bcbb7f68aa89a367149d35f80e1fa
SHA256015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5
SHA5121869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f