Analysis
-
max time kernel
291s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2024 22:41
Static task
static1
Behavioral task
behavioral1
Sample
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
Resource
win7-20240220-en
General
-
Target
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
-
Size
419KB
-
MD5
27499cf0e73817392b9f50cc9e82c2b3
-
SHA1
a0efab9cdb4b2a4a920f4ab76095d24806d7812f
-
SHA256
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
-
SHA512
94b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
-
SSDEEP
6144:dOpt5U2F/o+89gzpGzlpKmu9HiFqVOmZce8dsGlEpD:Q5U2FQ+8+cpKmu9HikghdsG2h
Malware Config
Extracted
amadey
4.18
-
install_dir
154561dcbf
-
install_file
Dctooux.exe
-
strings_key
2cd47fa043c815e1a033c67832f3c6a5
-
url_paths
/j4Fvskd3/index.php
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
Dctooux.exeDctooux.exeDctooux.exeDctooux.exeDctooux.exepid process 312 Dctooux.exe 2336 Dctooux.exe 1912 Dctooux.exe 4024 Dctooux.exe 2016 Dctooux.exe -
Drops file in Windows directory 1 IoCs
Processes:
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exedescription ioc process File created C:\Windows\Tasks\Dctooux.job bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1800 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4960 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 1036 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 8 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4440 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4844 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4164 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 3584 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4196 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4208 2580 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exepid process 2580 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 6882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 8482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 8522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 8282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 10602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 11202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 11882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 12162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeFilesize
419KB
MD527499cf0e73817392b9f50cc9e82c2b3
SHA1a0efab9cdb4b2a4a920f4ab76095d24806d7812f
SHA256bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
SHA51294b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
-
memory/312-17-0x0000000000CD0000-0x0000000000DD0000-memory.dmpFilesize
1024KB
-
memory/312-18-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/312-19-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/1912-39-0x0000000000C00000-0x0000000000D00000-memory.dmpFilesize
1024KB
-
memory/1912-41-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/1912-40-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2016-63-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2016-62-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2016-61-0x0000000000EB0000-0x0000000000FB0000-memory.dmpFilesize
1024KB
-
memory/2336-28-0x0000000000BD0000-0x0000000000CD0000-memory.dmpFilesize
1024KB
-
memory/2336-29-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2336-30-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2580-1-0x0000000000CD0000-0x0000000000DD0000-memory.dmpFilesize
1024KB
-
memory/2580-11-0x0000000000CD0000-0x0000000000DD0000-memory.dmpFilesize
1024KB
-
memory/2580-9-0x0000000002770000-0x00000000027DF000-memory.dmpFilesize
444KB
-
memory/2580-8-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2580-3-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2580-2-0x0000000002770000-0x00000000027DF000-memory.dmpFilesize
444KB
-
memory/4024-50-0x0000000000D60000-0x0000000000E60000-memory.dmpFilesize
1024KB
-
memory/4024-51-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/4024-52-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB