Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
10-08-2023 00:44
Behavioral task
behavioral1
Sample
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe
Resource
win7-20230712-en
General
-
Target
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe
-
Size
6.5MB
-
MD5
92031e02bc46932ace98fb8b54f261f4
-
SHA1
e4414033fedbaa9cb96660558748f36b5c0ae9d3
-
SHA256
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
-
SHA512
9407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
SSDEEP
98304:FgTOuxyekXIG+AM/M8MqPtPGp/6qWXCT5QYux3bWJvAi9nzDMeEuJW2wq73:l4KM/BMqPt8/lWSDucUPqr
Malware Config
Extracted
amadey
3.85
45.9.74.166/b7djSDcPcZ/index.php
45.9.74.141/b7djSDcPcZ/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
bstyoops.exebstyoops.exebstyoops.exepid process 2988 bstyoops.exe 1696 bstyoops.exe 2040 bstyoops.exe -
Loads dropped DLL 1 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exepid process 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe -
Processes:
resource yara_rule behavioral1/memory/2552-56-0x0000000000FB0000-0x0000000001A49000-memory.dmp vmprotect behavioral1/memory/2552-59-0x0000000000FB0000-0x0000000001A49000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect \Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral1/memory/2552-75-0x0000000000FB0000-0x0000000001A49000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral1/memory/2988-79-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect behavioral1/memory/2988-84-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect behavioral1/memory/2988-88-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral1/memory/1696-92-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect behavioral1/memory/1696-95-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect behavioral1/memory/1696-100-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral1/memory/2040-104-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect behavioral1/memory/2040-108-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect behavioral1/memory/2040-112-0x0000000000860000-0x00000000012F9000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exebstyoops.exebstyoops.exebstyoops.exepid process 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe 2988 bstyoops.exe 1696 bstyoops.exe 2040 bstyoops.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exepid process 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exebstyoops.execmd.exetaskeng.exedescription pid process target process PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2552 wrote to memory of 2988 2552 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 2988 wrote to memory of 2128 2988 bstyoops.exe schtasks.exe PID 2988 wrote to memory of 2128 2988 bstyoops.exe schtasks.exe PID 2988 wrote to memory of 2128 2988 bstyoops.exe schtasks.exe PID 2988 wrote to memory of 2128 2988 bstyoops.exe schtasks.exe PID 2988 wrote to memory of 2748 2988 bstyoops.exe cmd.exe PID 2988 wrote to memory of 2748 2988 bstyoops.exe cmd.exe PID 2988 wrote to memory of 2748 2988 bstyoops.exe cmd.exe PID 2988 wrote to memory of 2748 2988 bstyoops.exe cmd.exe PID 2748 wrote to memory of 2836 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2836 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2836 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2836 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2216 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2216 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2216 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2216 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2728 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2728 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2728 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2728 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2740 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2740 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2740 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2740 2748 cmd.exe cmd.exe PID 2748 wrote to memory of 2756 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2756 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2756 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2756 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2796 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2796 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2796 2748 cmd.exe cacls.exe PID 2748 wrote to memory of 2796 2748 cmd.exe cacls.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 1696 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe PID 2764 wrote to memory of 2040 2764 taskeng.exe bstyoops.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe"C:\Users\Admin\AppData\Local\Temp\15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F3⤵
- Creates scheduled task(s)
PID:2128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2836
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:N"4⤵PID:2216
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:R" /E4⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2740
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:N"4⤵PID:2756
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:R" /E4⤵PID:2796
-
C:\Windows\system32\taskeng.exetaskeng.exe {4A007798-4C2B-4C45-B685-A515311D27E0} S-1-5-21-4159544280-4273523227-683900707-1000:UMAXQRGK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
memory/1696-100-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/1696-95-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/1696-92-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2040-112-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2040-108-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2040-104-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2552-66-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2552-61-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2552-56-0x0000000000FB0000-0x0000000001A49000-memory.dmpFilesize
10.6MB
-
memory/2552-57-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2552-59-0x0000000000FB0000-0x0000000001A49000-memory.dmpFilesize
10.6MB
-
memory/2552-62-0x0000000077B00000-0x0000000077B01000-memory.dmpFilesize
4KB
-
memory/2552-54-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2552-75-0x0000000000FB0000-0x0000000001A49000-memory.dmpFilesize
10.6MB
-
memory/2988-80-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2988-88-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2988-79-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2988-86-0x0000000077B00000-0x0000000077B01000-memory.dmpFilesize
4KB
-
memory/2988-84-0x0000000000860000-0x00000000012F9000-memory.dmpFilesize
10.6MB
-
memory/2988-82-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB