Analysis
-
max time kernel
295s -
max time network
301s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 22:31
Static task
static1
Behavioral task
behavioral1
Sample
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe
Resource
win7-20240221-en
General
-
Target
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe
-
Size
420KB
-
MD5
8219dda07acbb3e33bf0683527e57bfe
-
SHA1
b918fe7c55f89360ffe7dd8545287dbde3c2607c
-
SHA256
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b
-
SHA512
330715518f51207db3a8a90ae036cdb7d0c8e873a1c2480887c26a5ab0c6c18b111577fe2f095d9e5134fc5829c13625ceb3cd13fff310050690dc67f8d341a6
-
SSDEEP
6144:00BAcIN3u6RznWo2PX9526kR2MlNa6GO2rMRZzApr5vYqkN:FSN3u6lnWo6+6kR2MHax4R2FSX
Malware Config
Extracted
amadey
4.18
-
install_dir
154561dcbf
-
install_file
Dctooux.exe
-
strings_key
2cd47fa043c815e1a033c67832f3c6a5
-
url_paths
/j4Fvskd3/index.php
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 9 2468 rundll32.exe 12 1760 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Dctooux.exepid process 2504 Dctooux.exe -
Loads dropped DLL 14 IoCs
Processes:
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exerundll32.exerundll32.exerundll32.exepid process 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe 560 rundll32.exe 560 rundll32.exe 560 rundll32.exe 560 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 1 IoCs
Processes:
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exedescription ioc process File created C:\Windows\Tasks\Dctooux.job 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
rundll32.exepowershell.exepid process 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 1960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1960 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exepid process 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exeDctooux.exerundll32.exerundll32.exedescription pid process target process PID 2928 wrote to memory of 2504 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe Dctooux.exe PID 2928 wrote to memory of 2504 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe Dctooux.exe PID 2928 wrote to memory of 2504 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe Dctooux.exe PID 2928 wrote to memory of 2504 2928 639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe Dctooux.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 560 2504 Dctooux.exe rundll32.exe PID 560 wrote to memory of 2468 560 rundll32.exe rundll32.exe PID 560 wrote to memory of 2468 560 rundll32.exe rundll32.exe PID 560 wrote to memory of 2468 560 rundll32.exe rundll32.exe PID 560 wrote to memory of 2468 560 rundll32.exe rundll32.exe PID 2468 wrote to memory of 2472 2468 rundll32.exe netsh.exe PID 2468 wrote to memory of 2472 2468 rundll32.exe netsh.exe PID 2468 wrote to memory of 2472 2468 rundll32.exe netsh.exe PID 2468 wrote to memory of 1960 2468 rundll32.exe powershell.exe PID 2468 wrote to memory of 1960 2468 rundll32.exe powershell.exe PID 2468 wrote to memory of 1960 2468 rundll32.exe powershell.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe PID 2504 wrote to memory of 1760 2504 Dctooux.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe"C:\Users\Admin\AppData\Local\Temp\639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\461186416230_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\461186416230Filesize
70KB
MD5b79a2b0911ce99298b9469d9f72293a3
SHA16f98cb6c3c0f2b0816141f5665f44425cddd7ae4
SHA2560c74f0465567179ccec76b9f4e180c4659d9a8f3250ce714202ccd04aa43d51b
SHA51248a1e1f36b8bb80cf25ea4a03c28095f1854dfb29adcaa650ef896826f03eb027eec3160bd562283e464f97fd68d9dd435ec151a9e87334e93e09a48db808936
-
C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dllFilesize
109KB
MD5ca684dc5ebed4381701a39f1cc3a0fb2
SHA18c4a375aa583bd1c705597a7f45fd18934276770
SHA256b8c5ad09c5b62fa8d8bcb8e1c317700274b4756d04fc964ccae38103c318ddd2
SHA5128b414799e37d50f664e04e704ab06a8f6f25cb9f9c24f157e998a72aad9c0a0cd9435b42c629dc26643f039725d22a89ca3468dc39009d11d910420a80e9c510
-
C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dllFilesize
1.2MB
MD54876ee75ce2712147c41ff1277cd2d30
SHA13733dc92318f0c6b92cb201e49151686281acda6
SHA256bbfba2d40f48c16a53b5806555c08aff1982c3fe4a77964963edbab9d7e672ed
SHA5129bf25d4d0dfebd287b0c84abb64612b3db00a26b0217490b35925e77487d6c872632c936cedf1205c46ecbf9d4dfc9bc7600bee05afc550b30ae0d0964c5afe9
-
\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeFilesize
420KB
MD58219dda07acbb3e33bf0683527e57bfe
SHA1b918fe7c55f89360ffe7dd8545287dbde3c2607c
SHA256639d94ee512db05588f1964308d82adc6f62b27565ec5561f9d1e609ba58899b
SHA512330715518f51207db3a8a90ae036cdb7d0c8e873a1c2480887c26a5ab0c6c18b111577fe2f095d9e5134fc5829c13625ceb3cd13fff310050690dc67f8d341a6
-
memory/1960-59-0x0000000002550000-0x00000000025D0000-memory.dmpFilesize
512KB
-
memory/1960-51-0x000007FEF4DE0000-0x000007FEF577D000-memory.dmpFilesize
9.6MB
-
memory/1960-66-0x000007FEF4DE0000-0x000007FEF577D000-memory.dmpFilesize
9.6MB
-
memory/1960-57-0x000007FEF4DE0000-0x000007FEF577D000-memory.dmpFilesize
9.6MB
-
memory/1960-52-0x0000000002550000-0x00000000025D0000-memory.dmpFilesize
512KB
-
memory/1960-55-0x0000000002550000-0x00000000025D0000-memory.dmpFilesize
512KB
-
memory/1960-54-0x0000000002550000-0x00000000025D0000-memory.dmpFilesize
512KB
-
memory/1960-53-0x0000000001F30000-0x0000000001F38000-memory.dmpFilesize
32KB
-
memory/1960-50-0x000000001B370000-0x000000001B652000-memory.dmpFilesize
2.9MB
-
memory/2504-28-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2504-58-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2504-106-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2504-22-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2504-56-0x0000000000CE0000-0x0000000000DE0000-memory.dmpFilesize
1024KB
-
memory/2504-80-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2504-20-0x0000000000CE0000-0x0000000000DE0000-memory.dmpFilesize
1024KB
-
memory/2504-21-0x0000000000220000-0x000000000028F000-memory.dmpFilesize
444KB
-
memory/2504-65-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2928-3-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2928-1-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB
-
memory/2928-5-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/2928-2-0x0000000000B90000-0x0000000000BFF000-memory.dmpFilesize
444KB
-
memory/2928-19-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB
-
memory/2928-17-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB