Analysis
-
max time kernel
138s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2023 19:00
Static task
static1
Behavioral task
behavioral1
Sample
a8424e307924a420ddc4c9ec4ffc7fad.exe
Resource
win7-20231025-en
General
-
Target
a8424e307924a420ddc4c9ec4ffc7fad.exe
-
Size
430KB
-
MD5
a8424e307924a420ddc4c9ec4ffc7fad
-
SHA1
b975360d1500688152825f0888df0433d2a9d822
-
SHA256
67909ab71ebdcfd08df25ecd355c568a3c6717fffc20096fc729a6671e833cc4
-
SHA512
01dc09df1200c944afee7da2c7598150c637057c527400ee3e1e75f959b90b76d49d563089f7d49ea7543a35badde9a71d7dc1ad2269ab04c301ff496af3d376
-
SSDEEP
6144:IYN96UZx2WAIFYwOj9HlH8qAFQVXN9Vubg1X67pb9O/8fgNoFybLz/mjR+vx9x:NZQsoHRo1pb9/DybLq0vd
Malware Config
Extracted
amadey
4.11
http://shohetrc.com
http://sibcomputer.ru
http://tve-mail.com
-
install_dir
d4dd819322
-
install_file
Utsysc.exe
-
strings_key
8419b3024d6f72beef8af6915e592308
-
url_paths
/forum/index.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a8424e307924a420ddc4c9ec4ffc7fad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation a8424e307924a420ddc4c9ec4ffc7fad.exe -
Executes dropped EXE 1 IoCs
Processes:
Utsysc.exepid process 3508 Utsysc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 744 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 3104 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 4512 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 4428 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 756 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 2940 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 2360 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 5000 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 1240 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe 1236 1316 WerFault.exe a8424e307924a420ddc4c9ec4ffc7fad.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
a8424e307924a420ddc4c9ec4ffc7fad.exepid process 1316 a8424e307924a420ddc4c9ec4ffc7fad.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a8424e307924a420ddc4c9ec4ffc7fad.exedescription pid process target process PID 1316 wrote to memory of 3508 1316 a8424e307924a420ddc4c9ec4ffc7fad.exe Utsysc.exe PID 1316 wrote to memory of 3508 1316 a8424e307924a420ddc4c9ec4ffc7fad.exe Utsysc.exe PID 1316 wrote to memory of 3508 1316 a8424e307924a420ddc4c9ec4ffc7fad.exe Utsysc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8424e307924a420ddc4c9ec4ffc7fad.exe"C:\Users\Admin\AppData\Local\Temp\a8424e307924a420ddc4c9ec4ffc7fad.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 6082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 6522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 6922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 8522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 10562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 11242⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 12442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1316 -ip 13161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1316 -ip 13161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeFilesize
430KB
MD5a8424e307924a420ddc4c9ec4ffc7fad
SHA1b975360d1500688152825f0888df0433d2a9d822
SHA25667909ab71ebdcfd08df25ecd355c568a3c6717fffc20096fc729a6671e833cc4
SHA51201dc09df1200c944afee7da2c7598150c637057c527400ee3e1e75f959b90b76d49d563089f7d49ea7543a35badde9a71d7dc1ad2269ab04c301ff496af3d376
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeFilesize
430KB
MD5a8424e307924a420ddc4c9ec4ffc7fad
SHA1b975360d1500688152825f0888df0433d2a9d822
SHA25667909ab71ebdcfd08df25ecd355c568a3c6717fffc20096fc729a6671e833cc4
SHA51201dc09df1200c944afee7da2c7598150c637057c527400ee3e1e75f959b90b76d49d563089f7d49ea7543a35badde9a71d7dc1ad2269ab04c301ff496af3d376
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeFilesize
430KB
MD5a8424e307924a420ddc4c9ec4ffc7fad
SHA1b975360d1500688152825f0888df0433d2a9d822
SHA25667909ab71ebdcfd08df25ecd355c568a3c6717fffc20096fc729a6671e833cc4
SHA51201dc09df1200c944afee7da2c7598150c637057c527400ee3e1e75f959b90b76d49d563089f7d49ea7543a35badde9a71d7dc1ad2269ab04c301ff496af3d376
-
memory/1316-1-0x0000000000B00000-0x0000000000C00000-memory.dmpFilesize
1024KB
-
memory/1316-2-0x00000000009E0000-0x0000000000A4C000-memory.dmpFilesize
432KB
-
memory/1316-3-0x0000000000400000-0x00000000008B3000-memory.dmpFilesize
4.7MB
-
memory/1316-5-0x0000000000B00000-0x0000000000C00000-memory.dmpFilesize
1024KB
-
memory/1316-7-0x00000000009E0000-0x0000000000A4C000-memory.dmpFilesize
432KB
-
memory/1316-19-0x0000000000400000-0x00000000008B3000-memory.dmpFilesize
4.7MB