Analysis
-
max time kernel
59s -
max time network
56s -
platform
windows11-21h2_x64 -
resource
win11-20231128-en -
resource tags
arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-12-2023 18:55
Static task
static1
General
-
Target
35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe
-
Size
375KB
-
MD5
906f443ff2f5e59b38d0da12090ae17e
-
SHA1
1e50f93e2a49cf1325c291eb8c491e00e84e80d8
-
SHA256
35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd
-
SHA512
f4238ff549af3e0a20e53a98680de3b00db296aaf733f60992d9c7738f46febad44f4214b683c422f3dfd04d4389f3956e8076ffb6c13faa0be46e80c6012b68
-
SSDEEP
6144:9bgwg3Zl1zv+E53TbUBdxz+xdcPX8aiirmcDtczEcmTPO3:90B1zv+2PUHJCdcfPiiyGCMW
Malware Config
Extracted
amadey
4.11
http://shohetrc.com
http://sibcomputer.ru
http://tve-mail.com
-
install_dir
d4dd819322
-
install_file
Utsysc.exe
-
strings_key
8419b3024d6f72beef8af6915e592308
-
url_paths
/forum/index.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Utsysc.exepid process 4668 Utsysc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 31 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1920 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 804 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 2500 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 4432 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 3276 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 3052 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 992 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 1084 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 3416 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 1624 5324 WerFault.exe 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe 2156 4668 WerFault.exe Utsysc.exe 6128 4668 WerFault.exe Utsysc.exe 5724 4668 WerFault.exe Utsysc.exe 6120 4668 WerFault.exe Utsysc.exe 5596 4668 WerFault.exe Utsysc.exe 952 4668 WerFault.exe Utsysc.exe 964 4668 WerFault.exe Utsysc.exe 548 4668 WerFault.exe Utsysc.exe 5628 4668 WerFault.exe Utsysc.exe 5268 4668 WerFault.exe Utsysc.exe 3300 4668 WerFault.exe Utsysc.exe 5388 4668 WerFault.exe Utsysc.exe 2388 4668 WerFault.exe Utsysc.exe 5768 4668 WerFault.exe Utsysc.exe 5644 4668 WerFault.exe Utsysc.exe 4752 4668 WerFault.exe Utsysc.exe 5956 4668 WerFault.exe Utsysc.exe 3748 4668 WerFault.exe Utsysc.exe 3700 4668 WerFault.exe Utsysc.exe 416 4668 WerFault.exe Utsysc.exe 3840 4668 WerFault.exe Utsysc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exepid process 5324 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exeUtsysc.exedescription pid process target process PID 5324 wrote to memory of 4668 5324 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe Utsysc.exe PID 5324 wrote to memory of 4668 5324 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe Utsysc.exe PID 5324 wrote to memory of 4668 5324 35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe Utsysc.exe PID 4668 wrote to memory of 5284 4668 Utsysc.exe schtasks.exe PID 4668 wrote to memory of 5284 4668 Utsysc.exe schtasks.exe PID 4668 wrote to memory of 5284 4668 Utsysc.exe schtasks.exe PID 4668 wrote to memory of 3060 4668 Utsysc.exe rundll32.exe PID 4668 wrote to memory of 3060 4668 Utsysc.exe rundll32.exe PID 4668 wrote to memory of 3060 4668 Utsysc.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe"C:\Users\Admin\AppData\Local\Temp\35444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 6162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 6882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 8842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 10122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 10482⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 6323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 8243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 8803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 11163⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 8923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 7203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 12723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 12803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 9323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 9283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 12723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 12963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 14723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 15603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 15443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 15483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 18083⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 12522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 46681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\484251756281Filesize
76KB
MD560daa4697963cae849c549c9d3cd3f66
SHA1a717fab122442e0e1d2f5b0168d5ab34d4c36028
SHA256130f3164ccde4aeeb54ff048773796d363a5d2b4de87bf5fda35988451c92c6a
SHA5121113ac22f93bab78d1da108b7f53fa4ad3af774d41908a10237efb1bea59cb254709235dbefb0d3b4464c7c3c6e135fea07837816bda42f7cf63cb017700c6c4
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeFilesize
375KB
MD5906f443ff2f5e59b38d0da12090ae17e
SHA11e50f93e2a49cf1325c291eb8c491e00e84e80d8
SHA25635444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd
SHA512f4238ff549af3e0a20e53a98680de3b00db296aaf733f60992d9c7738f46febad44f4214b683c422f3dfd04d4389f3956e8076ffb6c13faa0be46e80c6012b68
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeFilesize
375KB
MD5906f443ff2f5e59b38d0da12090ae17e
SHA11e50f93e2a49cf1325c291eb8c491e00e84e80d8
SHA25635444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd
SHA512f4238ff549af3e0a20e53a98680de3b00db296aaf733f60992d9c7738f46febad44f4214b683c422f3dfd04d4389f3956e8076ffb6c13faa0be46e80c6012b68
-
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeFilesize
375KB
MD5906f443ff2f5e59b38d0da12090ae17e
SHA11e50f93e2a49cf1325c291eb8c491e00e84e80d8
SHA25635444ec8434846a91960534af1f3cf875096c4c5aa869e7612a06327ddf616bd
SHA512f4238ff549af3e0a20e53a98680de3b00db296aaf733f60992d9c7738f46febad44f4214b683c422f3dfd04d4389f3956e8076ffb6c13faa0be46e80c6012b68
-
C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dllFilesize
66KB
MD59b0507b53287ffe4c3af7ea8413b3998
SHA1a042a1973f9714866e8156a8f714926c2bb02b3f
SHA25670746fa232ede6a0818ad60d2552f22b5cce9b06181c6bfa1808fe5a1c313db1
SHA512a46f2e4380c13b4f48f3e8e60522f6e707a0c198e53fa37ae478f2323017e1106e77f1542db3c01c9d534c59c5ec0cd4f604886fb8d04bab77b06bc13464f521
-
C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dllFilesize
66KB
MD59b0507b53287ffe4c3af7ea8413b3998
SHA1a042a1973f9714866e8156a8f714926c2bb02b3f
SHA25670746fa232ede6a0818ad60d2552f22b5cce9b06181c6bfa1808fe5a1c313db1
SHA512a46f2e4380c13b4f48f3e8e60522f6e707a0c198e53fa37ae478f2323017e1106e77f1542db3c01c9d534c59c5ec0cd4f604886fb8d04bab77b06bc13464f521
-
memory/4668-20-0x0000000000EC0000-0x0000000000FC0000-memory.dmpFilesize
1024KB
-
memory/4668-21-0x0000000000400000-0x0000000000BB8000-memory.dmpFilesize
7.7MB
-
memory/4668-26-0x0000000000400000-0x0000000000BB8000-memory.dmpFilesize
7.7MB
-
memory/4668-38-0x0000000000400000-0x0000000000BB8000-memory.dmpFilesize
7.7MB
-
memory/4668-39-0x0000000000EC0000-0x0000000000FC0000-memory.dmpFilesize
1024KB
-
memory/4668-52-0x0000000000400000-0x0000000000BB8000-memory.dmpFilesize
7.7MB
-
memory/5324-18-0x0000000000400000-0x0000000000BB8000-memory.dmpFilesize
7.7MB
-
memory/5324-1-0x0000000000D20000-0x0000000000E20000-memory.dmpFilesize
1024KB
-
memory/5324-19-0x0000000002A10000-0x0000000002A7C000-memory.dmpFilesize
432KB
-
memory/5324-3-0x0000000000400000-0x0000000000BB8000-memory.dmpFilesize
7.7MB
-
memory/5324-2-0x0000000002A10000-0x0000000002A7C000-memory.dmpFilesize
432KB