Analysis
-
max time kernel
138s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2023 01:11
General
-
Target
db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe
-
Size
205KB
-
MD5
79fa4eabaa10e7eade4ca7774f913964
-
SHA1
e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
-
SHA256
db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
-
SHA512
09d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
SSDEEP
3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj
Malware Config
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation rugen.exe -
Executes dropped EXE 4 IoCs
pid Process 924 rugen.exe 3256 rugen.exe 4180 rugen.exe 3732 rugen.exe -
Loads dropped DLL 1 IoCs
pid Process 3484 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2532 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1996 wrote to memory of 924 1996 db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe 85 PID 1996 wrote to memory of 924 1996 db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe 85 PID 1996 wrote to memory of 924 1996 db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe 85 PID 924 wrote to memory of 2532 924 rugen.exe 86 PID 924 wrote to memory of 2532 924 rugen.exe 86 PID 924 wrote to memory of 2532 924 rugen.exe 86 PID 924 wrote to memory of 2640 924 rugen.exe 88 PID 924 wrote to memory of 2640 924 rugen.exe 88 PID 924 wrote to memory of 2640 924 rugen.exe 88 PID 2640 wrote to memory of 1640 2640 cmd.exe 90 PID 2640 wrote to memory of 1640 2640 cmd.exe 90 PID 2640 wrote to memory of 1640 2640 cmd.exe 90 PID 2640 wrote to memory of 2416 2640 cmd.exe 91 PID 2640 wrote to memory of 2416 2640 cmd.exe 91 PID 2640 wrote to memory of 2416 2640 cmd.exe 91 PID 2640 wrote to memory of 1464 2640 cmd.exe 92 PID 2640 wrote to memory of 1464 2640 cmd.exe 92 PID 2640 wrote to memory of 1464 2640 cmd.exe 92 PID 2640 wrote to memory of 3932 2640 cmd.exe 93 PID 2640 wrote to memory of 3932 2640 cmd.exe 93 PID 2640 wrote to memory of 3932 2640 cmd.exe 93 PID 2640 wrote to memory of 4480 2640 cmd.exe 94 PID 2640 wrote to memory of 4480 2640 cmd.exe 94 PID 2640 wrote to memory of 4480 2640 cmd.exe 94 PID 2640 wrote to memory of 3068 2640 cmd.exe 95 PID 2640 wrote to memory of 3068 2640 cmd.exe 95 PID 2640 wrote to memory of 3068 2640 cmd.exe 95 PID 924 wrote to memory of 3484 924 rugen.exe 111 PID 924 wrote to memory of 3484 924 rugen.exe 111 PID 924 wrote to memory of 3484 924 rugen.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe"C:\Users\Admin\AppData\Local\Temp\db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F3⤵
- Creates scheduled task(s)
PID:2532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1640
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:N"4⤵PID:2416
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:R" /E4⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:3932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:N"4⤵PID:4480
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:R" /E4⤵PID:3068
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:3484
-
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:3256
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:4180
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:3732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD579fa4eabaa10e7eade4ca7774f913964
SHA1e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
SHA256db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
SHA51209d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
Filesize
205KB
MD579fa4eabaa10e7eade4ca7774f913964
SHA1e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
SHA256db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
SHA51209d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
Filesize
205KB
MD579fa4eabaa10e7eade4ca7774f913964
SHA1e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
SHA256db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
SHA51209d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
Filesize
205KB
MD579fa4eabaa10e7eade4ca7774f913964
SHA1e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
SHA256db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
SHA51209d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
Filesize
205KB
MD579fa4eabaa10e7eade4ca7774f913964
SHA1e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
SHA256db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
SHA51209d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
Filesize
205KB
MD579fa4eabaa10e7eade4ca7774f913964
SHA1e5c9905b4fbf4da227a7ba91a59364e93c81ea7c
SHA256db90fd342823130eee3686f107f290a81640deae2806400c85c5254d3086bc45
SHA51209d70e79b661ab71c23d3fbcdc871bb4950a2e6c19b5d0ac9fb4485c9f2fffc0e8af7800516bd0272f9c662de7774279814aec9464f817bc162b8e7fa3253ad6
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5