Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2023 07:31
Static task
static1
Behavioral task
behavioral1
Sample
2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe
Resource
win7-20231129-en
General
-
Target
2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe
-
Size
430KB
-
MD5
fac43cfef66cbe7a612f11ab8acbce9f
-
SHA1
ecbe7847537433957097edf20659b532ef9f8819
-
SHA256
2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285
-
SHA512
44f668b81704d6cf1a435ed4072e00d58ac4b98dae6fc1b069fc3c0da77553667fbc6f1c0c8db7084ae4b93bc6478e6e95b3933c6e3ed44d3ada60fbe99a127d
-
SSDEEP
6144:5UNHaj0eTOkkyYrfKFoWTWbvYK8jHCw1E9BO21NE6iYSd3Sg/x:x0SfPFogWbyHRkBOuWY2Z5
Malware Config
Extracted
amadey
4.11
http://shohetrc.com
http://sibcomputer.ru
http://tve-mail.com
-
install_dir
d4dd819322
-
install_file
Utsysc.exe
-
strings_key
8419b3024d6f72beef8af6915e592308
-
url_paths
/forum/index.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exeUtsysc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe Key value queried \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation Utsysc.exe -
Executes dropped EXE 3 IoCs
Processes:
Utsysc.exeUtsysc.exeUtsysc.exepid process 3096 Utsysc.exe 5028 Utsysc.exe 2164 Utsysc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 32 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 772 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 3152 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 3876 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 544 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 2752 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 2756 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 4100 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 4412 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 3384 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 4968 2456 WerFault.exe 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe 3004 3096 WerFault.exe Utsysc.exe 4880 3096 WerFault.exe Utsysc.exe 2244 3096 WerFault.exe Utsysc.exe 2476 3096 WerFault.exe Utsysc.exe 4332 3096 WerFault.exe Utsysc.exe 3208 3096 WerFault.exe Utsysc.exe 2668 3096 WerFault.exe Utsysc.exe 1040 3096 WerFault.exe Utsysc.exe 2840 3096 WerFault.exe Utsysc.exe 4560 3096 WerFault.exe Utsysc.exe 4908 3096 WerFault.exe Utsysc.exe 4996 3096 WerFault.exe Utsysc.exe 3620 3096 WerFault.exe Utsysc.exe 1344 3096 WerFault.exe Utsysc.exe 852 3096 WerFault.exe Utsysc.exe 4244 3096 WerFault.exe Utsysc.exe 3020 3096 WerFault.exe Utsysc.exe 448 3096 WerFault.exe Utsysc.exe 4840 3096 WerFault.exe Utsysc.exe 440 3096 WerFault.exe Utsysc.exe 3852 3096 WerFault.exe Utsysc.exe 3448 5028 WerFault.exe Utsysc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exepid process 2456 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exeUtsysc.exedescription pid process target process PID 2456 wrote to memory of 3096 2456 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe Utsysc.exe PID 2456 wrote to memory of 3096 2456 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe Utsysc.exe PID 2456 wrote to memory of 3096 2456 2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe Utsysc.exe PID 3096 wrote to memory of 3536 3096 Utsysc.exe schtasks.exe PID 3096 wrote to memory of 3536 3096 Utsysc.exe schtasks.exe PID 3096 wrote to memory of 3536 3096 Utsysc.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe"C:\Users\Admin\AppData\Local\Temp\2b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 6162⤵
- Program crash
PID:772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 6962⤵
- Program crash
PID:3152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 7562⤵
- Program crash
PID:3876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 8602⤵
- Program crash
PID:544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 7682⤵
- Program crash
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 8842⤵
- Program crash
PID:2756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 11242⤵
- Program crash
PID:4100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 11402⤵
- Program crash
PID:4412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 12242⤵
- Program crash
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 6403⤵
- Program crash
PID:3004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7603⤵
- Program crash
PID:4880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7603⤵
- Program crash
PID:2244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 9803⤵
- Program crash
PID:2476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 10043⤵
- Program crash
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 10043⤵
- Program crash
PID:3208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 10483⤵
- Program crash
PID:2668 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
PID:3536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 9243⤵
- Program crash
PID:1040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 11963⤵
- Program crash
PID:2840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 6403⤵
- Program crash
PID:4560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7083⤵
- Program crash
PID:4908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7043⤵
- Program crash
PID:4996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 12283⤵
- Program crash
PID:3620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 12443⤵
- Program crash
PID:1344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 12963⤵
- Program crash
PID:852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 13203⤵
- Program crash
PID:4244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 14763⤵
- Program crash
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 15523⤵
- Program crash
PID:448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 15763⤵
- Program crash
PID:4840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 16803⤵
- Program crash
PID:440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 10203⤵
- Program crash
PID:3852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 13442⤵
- Program crash
PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2456 -ip 24561⤵PID:4560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2456 -ip 24561⤵PID:3892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2456 -ip 24561⤵PID:1088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2456 -ip 24561⤵PID:3840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2456 -ip 24561⤵PID:1344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2456 -ip 24561⤵PID:716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2456 -ip 24561⤵PID:264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2456 -ip 24561⤵PID:2956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2456 -ip 24561⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2456 -ip 24561⤵PID:388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3096 -ip 30961⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3096 -ip 30961⤵PID:3864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3096 -ip 30961⤵PID:884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3096 -ip 30961⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3096 -ip 30961⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3096 -ip 30961⤵PID:4720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3096 -ip 30961⤵PID:5108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3096 -ip 30961⤵PID:3188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3096 -ip 30961⤵PID:3696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3096 -ip 30961⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3096 -ip 30961⤵PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3096 -ip 30961⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3096 -ip 30961⤵PID:700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3096 -ip 30961⤵PID:2276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3096 -ip 30961⤵PID:2304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3096 -ip 30961⤵PID:3392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3096 -ip 30961⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3096 -ip 30961⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3096 -ip 30961⤵PID:1360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3096 -ip 30961⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe1⤵
- Executes dropped EXE
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 4642⤵
- Program crash
PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3096 -ip 30961⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5028 -ip 50281⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe1⤵
- Executes dropped EXE
PID:2164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5a3142abe1be228b0f5b63a3f1a4a0449
SHA19ffb07c346896f82b3a8ee3dd1fdc5facd82b127
SHA256f2e90cfa87f63058b8af2e6f7c9bd8a06093595eaefc1fbfb11b7ac14fbd7667
SHA5126318c0fbda6dc6386d13a38fb7e0138a48e72dd9f2cb245468e413db89d0063050a12427ce513db1b685d05345d1b300180268c71b853f743922f7ebf3e8ec36
-
Filesize
430KB
MD5fac43cfef66cbe7a612f11ab8acbce9f
SHA1ecbe7847537433957097edf20659b532ef9f8819
SHA2562b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285
SHA51244f668b81704d6cf1a435ed4072e00d58ac4b98dae6fc1b069fc3c0da77553667fbc6f1c0c8db7084ae4b93bc6478e6e95b3933c6e3ed44d3ada60fbe99a127d
-
Filesize
430KB
MD5fac43cfef66cbe7a612f11ab8acbce9f
SHA1ecbe7847537433957097edf20659b532ef9f8819
SHA2562b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285
SHA51244f668b81704d6cf1a435ed4072e00d58ac4b98dae6fc1b069fc3c0da77553667fbc6f1c0c8db7084ae4b93bc6478e6e95b3933c6e3ed44d3ada60fbe99a127d
-
Filesize
430KB
MD5fac43cfef66cbe7a612f11ab8acbce9f
SHA1ecbe7847537433957097edf20659b532ef9f8819
SHA2562b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285
SHA51244f668b81704d6cf1a435ed4072e00d58ac4b98dae6fc1b069fc3c0da77553667fbc6f1c0c8db7084ae4b93bc6478e6e95b3933c6e3ed44d3ada60fbe99a127d
-
Filesize
430KB
MD5fac43cfef66cbe7a612f11ab8acbce9f
SHA1ecbe7847537433957097edf20659b532ef9f8819
SHA2562b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285
SHA51244f668b81704d6cf1a435ed4072e00d58ac4b98dae6fc1b069fc3c0da77553667fbc6f1c0c8db7084ae4b93bc6478e6e95b3933c6e3ed44d3ada60fbe99a127d
-
Filesize
430KB
MD5fac43cfef66cbe7a612f11ab8acbce9f
SHA1ecbe7847537433957097edf20659b532ef9f8819
SHA2562b3b153fd47433b92c199c148d5a2a431e107cae6ad2be0a07d0fe5ea9227285
SHA51244f668b81704d6cf1a435ed4072e00d58ac4b98dae6fc1b069fc3c0da77553667fbc6f1c0c8db7084ae4b93bc6478e6e95b3933c6e3ed44d3ada60fbe99a127d