Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2023 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e46d4436b93d1420eeaf0093aea2134.exe
Resource
win7-20231023-en
windows7-x64
10 signatures
150 seconds
General
-
Target
7e46d4436b93d1420eeaf0093aea2134.exe
-
Size
435KB
-
MD5
7e46d4436b93d1420eeaf0093aea2134
-
SHA1
f1824d9fa5df628082e108989de4a2f19f9658fd
-
SHA256
52286333dc380793b2fa162afcbdb93a25372296e6940df42a2b6c99389dc09b
-
SHA512
c3e67d13d0d398ce55ec8bc5a9775df4608b73d22a9f2305d7bed75f1641fe653310c4b5fc1fbeeb84458f2e82a561361a0d332aff945d42df2ea318ea8136df
-
SSDEEP
6144:VkucYCuJJRlcmGXTOHgcTzZ8/q29aWVKVM38AnhLKAHqG:V5cYCaJ3cjXcnTzubsG
Malware Config
Extracted
Family
amadey
Version
4.11
C2
http://shohetrc.com
http://sibcomputer.ru
http://tve-mail.com
Attributes
-
install_dir
d4dd819322
-
install_file
Utsysc.exe
-
strings_key
8419b3024d6f72beef8af6915e592308
-
url_paths
/forum/index.php
rc4.plain
Signatures
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1272 4352 WerFault.exe 7e46d4436b93d1420eeaf0093aea2134.exe 2792 4352 WerFault.exe 7e46d4436b93d1420eeaf0093aea2134.exe 4436 4352 WerFault.exe 7e46d4436b93d1420eeaf0093aea2134.exe 3928 4352 WerFault.exe 7e46d4436b93d1420eeaf0093aea2134.exe 3880 4352 WerFault.exe 7e46d4436b93d1420eeaf0093aea2134.exe 1908 4352 WerFault.exe 7e46d4436b93d1420eeaf0093aea2134.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e46d4436b93d1420eeaf0093aea2134.exe"C:\Users\Admin\AppData\Local\Temp\7e46d4436b93d1420eeaf0093aea2134.exe"1⤵PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 5962⤵
- Program crash
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 6802⤵
- Program crash
PID:2792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 7482⤵
- Program crash
PID:4436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 8442⤵
- Program crash
PID:3928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 8842⤵
- Program crash
PID:3880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 9002⤵
- Program crash
PID:1908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4352 -ip 43521⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4352 -ip 43521⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4352 -ip 43521⤵PID:1956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4352 -ip 43521⤵PID:3792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4352 -ip 43521⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4352 -ip 43521⤵PID:5016