Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2023 09:16
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230703-en
General
-
Target
tmp.exe
-
Size
364KB
-
MD5
624053fd08cbbd4b037d42abf3bebccf
-
SHA1
9cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0
-
SHA256
232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a
-
SHA512
0d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6
-
SSDEEP
6144:1IlO3QxkS7Vhc6l3qbPar3jriFa5gMfSuK+yJXsnGqgHt56b2:iqQxDpq6l3qbParyFa5/SVlvq5K
Malware Config
Extracted
amadey
3.21
185.215.113.15/Lkb2dxj3/index.php
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\110809d565579c\cred.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\110809d565579c\cred.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\110809d565579c\cred.dll amadey_cred_module behavioral2/memory/2716-178-0x0000000002050000-0x0000000002074000-memory.dmp amadey_cred_module C:\Users\Admin\AppData\Roaming\110809d565579c\cred.dll amadey_cred_module -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 54 2716 rundll32.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exebguuwe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation bguuwe.exe -
Executes dropped EXE 3 IoCs
Processes:
bguuwe.exebguuwe.exebguuwe.exepid process 4156 bguuwe.exe 3104 bguuwe.exe 1232 bguuwe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 2716 rundll32.exe 2716 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3664 1964 WerFault.exe tmp.exe 1984 3104 WerFault.exe bguuwe.exe 3788 1232 WerFault.exe bguuwe.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 2716 rundll32.exe 2716 rundll32.exe 2716 rundll32.exe 2716 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exebguuwe.execmd.exedescription pid process target process PID 1964 wrote to memory of 4156 1964 tmp.exe bguuwe.exe PID 1964 wrote to memory of 4156 1964 tmp.exe bguuwe.exe PID 1964 wrote to memory of 4156 1964 tmp.exe bguuwe.exe PID 4156 wrote to memory of 4700 4156 bguuwe.exe cmd.exe PID 4156 wrote to memory of 4700 4156 bguuwe.exe cmd.exe PID 4156 wrote to memory of 4700 4156 bguuwe.exe cmd.exe PID 4156 wrote to memory of 652 4156 bguuwe.exe schtasks.exe PID 4156 wrote to memory of 652 4156 bguuwe.exe schtasks.exe PID 4156 wrote to memory of 652 4156 bguuwe.exe schtasks.exe PID 4700 wrote to memory of 4340 4700 cmd.exe reg.exe PID 4700 wrote to memory of 4340 4700 cmd.exe reg.exe PID 4700 wrote to memory of 4340 4700 cmd.exe reg.exe PID 4156 wrote to memory of 2716 4156 bguuwe.exe rundll32.exe PID 4156 wrote to memory of 2716 4156 bguuwe.exe rundll32.exe PID 4156 wrote to memory of 2716 4156 bguuwe.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe"C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\62eca45584\3⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\62eca45584\4⤵PID:4340
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bguuwe.exe /TR "C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe" /F3⤵
- Creates scheduled task(s)
PID:652 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\110809d565579c\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 10962⤵
- Program crash
PID:3664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1964 -ip 19641⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exeC:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe1⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 4802⤵
- Program crash
PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3104 -ip 31041⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exeC:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe1⤵
- Executes dropped EXE
PID:1232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 4842⤵
- Program crash
PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1232 -ip 12321⤵PID:3936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5c2392f656080bc02f0d9f38faf533125
SHA1918f9a3d8d799572cd0c76567e26c3390fe12573
SHA256f7cb320df57a5e4dcf6924f6c90452fe1478fe1af5f808a0c688f1ebef00d220
SHA5121b402e0f6caf7a25a8c5162ee52b56cbba8f3827ccafd89875d2356c76d479e539898943a2a52c78bb6fd3d9ecd1fe156a55c222663b914293f8e056601d7430
-
Filesize
76KB
MD5aa09c71b6923a72197097ef21779e069
SHA1a94dd342bac4a494fd7934556be69cb19e869e8b
SHA256e8cbd302c1e4dfd96e083334420d709859c66477decaac343e5fb591862f0880
SHA512ce08998ba5da6b19223adb212ba1189a15caf5e89136c7d6f419966a57d2752889850fd675e9a3ba02ae1d090402736766ea0b10a5b9efd663f4af87a20576c4
-
Filesize
75KB
MD5ec15428eb8c582261ea66e78a098e596
SHA183b3f2cbafb27d299e57b13712091a1b9c676697
SHA256247b402b1d8a260fbb0cd3350f66d4dd121b0fa3270affee619582ee10ef508d
SHA512c9d260bfaae905e2cbb6ceadcca2a9269f89e997e7c4018f794a53a2654d6db443ed025650cf96fb892dcafc873ab587654165d4a0fef887255a81783d19907f
-
Filesize
364KB
MD5624053fd08cbbd4b037d42abf3bebccf
SHA19cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0
SHA256232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a
SHA5120d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6
-
Filesize
364KB
MD5624053fd08cbbd4b037d42abf3bebccf
SHA19cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0
SHA256232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a
SHA5120d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6
-
Filesize
364KB
MD5624053fd08cbbd4b037d42abf3bebccf
SHA19cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0
SHA256232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a
SHA5120d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6
-
Filesize
364KB
MD5624053fd08cbbd4b037d42abf3bebccf
SHA19cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0
SHA256232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a
SHA5120d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6
-
Filesize
364KB
MD5624053fd08cbbd4b037d42abf3bebccf
SHA19cc34928b43ea6fd5e391f0bcb07c2f1e2c705f0
SHA256232a7888f79f09c47258df130cbf4e854c7a5e0af0a534e5d918bbe7b4a9cd5a
SHA5120d834442875d8dc5a662d6a722cb46fe6f9e1501fa59993c379a34551c5d8c65c16fd156e3b3d02b55cc7eb451ffd5f8f0d11cfb84042c522f2c21ac9acecde6
-
Filesize
126KB
MD5e507e6d6e53146d7c7d7560845d7b51c
SHA112dfec1df517037846dea8044a0edc409b790a13
SHA256e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313
SHA512f81d8232ea61e94dc139eccd2f9246727eb569776f9bef8e25bbb4d7abe2b796ea740ccffaf1b2dd7a01e9dddb51180ca12e563ff4e7a2604f4503ebeed0d29e
-
Filesize
126KB
MD5e507e6d6e53146d7c7d7560845d7b51c
SHA112dfec1df517037846dea8044a0edc409b790a13
SHA256e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313
SHA512f81d8232ea61e94dc139eccd2f9246727eb569776f9bef8e25bbb4d7abe2b796ea740ccffaf1b2dd7a01e9dddb51180ca12e563ff4e7a2604f4503ebeed0d29e
-
Filesize
126KB
MD5e507e6d6e53146d7c7d7560845d7b51c
SHA112dfec1df517037846dea8044a0edc409b790a13
SHA256e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313
SHA512f81d8232ea61e94dc139eccd2f9246727eb569776f9bef8e25bbb4d7abe2b796ea740ccffaf1b2dd7a01e9dddb51180ca12e563ff4e7a2604f4503ebeed0d29e
-
Filesize
126KB
MD5e507e6d6e53146d7c7d7560845d7b51c
SHA112dfec1df517037846dea8044a0edc409b790a13
SHA256e49833410fea53f166523cc960fc7d60ddfcf60d0fc2024e68dbabab27ce8313
SHA512f81d8232ea61e94dc139eccd2f9246727eb569776f9bef8e25bbb4d7abe2b796ea740ccffaf1b2dd7a01e9dddb51180ca12e563ff4e7a2604f4503ebeed0d29e