Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 16:47
Static task
static1
Behavioral task
behavioral1
Sample
f4a5122b23d930794978c4615b0ce6d9.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
f4a5122b23d930794978c4615b0ce6d9.exe
Resource
win10v2004-20231130-en
General
-
Target
f4a5122b23d930794978c4615b0ce6d9.exe
-
Size
5.8MB
-
MD5
f4a5122b23d930794978c4615b0ce6d9
-
SHA1
8e34c6a3da1d048b932c20b15fd6ba119677d57c
-
SHA256
2514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
-
SHA512
bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
-
SSDEEP
98304:+houLKz8ObAUvRXrrmARbgc4RS6HrHbAdMd93J7OgVNLIKORMed6KSu:+h9LKz8CXhvrRL4RS67bAd63J7vREX0
Malware Config
Extracted
amadey
4.13
http://185.172.128.125
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
a70b05054314f381be1ab9a5cdc8b250
-
url_paths
/u6vhSc3PPq/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Utsysc.exeUtsysc.exeUtsysc.exepid process 2596 Utsysc.exe 636 Utsysc.exe 1568 Utsysc.exe -
Loads dropped DLL 1 IoCs
Processes:
f4a5122b23d930794978c4615b0ce6d9.exepid process 1732 f4a5122b23d930794978c4615b0ce6d9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f4a5122b23d930794978c4615b0ce6d9.exeUtsysc.exeUtsysc.exeUtsysc.exepid process 1732 f4a5122b23d930794978c4615b0ce6d9.exe 2596 Utsysc.exe 636 Utsysc.exe 1568 Utsysc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
f4a5122b23d930794978c4615b0ce6d9.exepid process 1732 f4a5122b23d930794978c4615b0ce6d9.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
f4a5122b23d930794978c4615b0ce6d9.exeUtsysc.exetaskeng.exedescription pid process target process PID 1732 wrote to memory of 2596 1732 f4a5122b23d930794978c4615b0ce6d9.exe Utsysc.exe PID 1732 wrote to memory of 2596 1732 f4a5122b23d930794978c4615b0ce6d9.exe Utsysc.exe PID 1732 wrote to memory of 2596 1732 f4a5122b23d930794978c4615b0ce6d9.exe Utsysc.exe PID 1732 wrote to memory of 2596 1732 f4a5122b23d930794978c4615b0ce6d9.exe Utsysc.exe PID 2596 wrote to memory of 2936 2596 Utsysc.exe schtasks.exe PID 2596 wrote to memory of 2936 2596 Utsysc.exe schtasks.exe PID 2596 wrote to memory of 2936 2596 Utsysc.exe schtasks.exe PID 2596 wrote to memory of 2936 2596 Utsysc.exe schtasks.exe PID 844 wrote to memory of 636 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 636 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 636 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 636 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 1568 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 1568 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 1568 844 taskeng.exe Utsysc.exe PID 844 wrote to memory of 1568 844 taskeng.exe Utsysc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4a5122b23d930794978c4615b0ce6d9.exe"C:\Users\Admin\AppData\Local\Temp\f4a5122b23d930794978c4615b0ce6d9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {589AB7AD-5191-4F72-BFFE-21A8A42BEA74} S-1-5-21-1502336823-1680518048-858510903-1000:XARGEIVJ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeFilesize
2.1MB
MD5ac639c7663cb764c0d69d0d448b624ad
SHA183338115007b7aed9711c01392bdda0561600301
SHA256227365fb387d6177be72e8ec811e1da97e7d493f058a760ed122b58345e0dadd
SHA51205113f2fc09d4fc2b5c9e685311976ff0628029937a0d399c8dbe3db67ce2199a89060dc39e21d59acc18461dea1fc739500ed993f4c9e06e223a87fda3ffbc1
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeFilesize
5.8MB
MD5f4a5122b23d930794978c4615b0ce6d9
SHA18e34c6a3da1d048b932c20b15fd6ba119677d57c
SHA2562514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
SHA512bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeFilesize
5.8MB
MD5f4a5122b23d930794978c4615b0ce6d9
SHA18e34c6a3da1d048b932c20b15fd6ba119677d57c
SHA2562514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
SHA512bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeFilesize
5.8MB
MD5f4a5122b23d930794978c4615b0ce6d9
SHA18e34c6a3da1d048b932c20b15fd6ba119677d57c
SHA2562514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
SHA512bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeFilesize
5.8MB
MD5f4a5122b23d930794978c4615b0ce6d9
SHA18e34c6a3da1d048b932c20b15fd6ba119677d57c
SHA2562514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
SHA512bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
-
\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeFilesize
5.8MB
MD5f4a5122b23d930794978c4615b0ce6d9
SHA18e34c6a3da1d048b932c20b15fd6ba119677d57c
SHA2562514ec71e8ecb604c6b979d954ddb1d63402a513912000eaa3d8d6dfa98f7441
SHA512bc98cc58195392f944b82bdb8e246315c0b3670ec3f3ff8f44385fe14b8fdab942dc94ac87313a4c824bdb189b3b7eccb6b09e4781ebe49fb9a99f1e199a1bca
-
memory/636-132-0x0000000001220000-0x0000000001BFF000-memory.dmpFilesize
9.9MB
-
memory/636-94-0x0000000001220000-0x0000000001BFF000-memory.dmpFilesize
9.9MB
-
memory/1568-175-0x0000000001220000-0x0000000001BFF000-memory.dmpFilesize
9.9MB
-
memory/1568-144-0x0000000077C40000-0x0000000077C41000-memory.dmpFilesize
4KB
-
memory/1568-145-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1568-136-0x0000000001220000-0x0000000001BFF000-memory.dmpFilesize
9.9MB
-
memory/1732-19-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1732-14-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1732-26-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1732-29-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1732-31-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1732-34-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1732-36-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1732-40-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/1732-21-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1732-0-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1732-16-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1732-12-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1732-50-0x0000000000230000-0x0000000000C0F000-memory.dmpFilesize
9.9MB
-
memory/1732-2-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1732-4-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1732-5-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1732-7-0x0000000000230000-0x0000000000C0F000-memory.dmpFilesize
9.9MB
-
memory/1732-24-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1732-9-0x0000000077C40000-0x0000000077C41000-memory.dmpFilesize
4KB
-
memory/1732-8-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1732-11-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2596-77-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2596-61-0x0000000001220000-0x0000000001BFF000-memory.dmpFilesize
9.9MB
-
memory/2596-60-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2596-53-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2596-91-0x0000000001220000-0x0000000001BFF000-memory.dmpFilesize
9.9MB
-
memory/2596-65-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2596-67-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2596-70-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2596-75-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2596-72-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2596-63-0x0000000077C40000-0x0000000077C41000-memory.dmpFilesize
4KB
-
memory/2596-55-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2596-58-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB