Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
29-03-2024 01:46
Static task
static1
Behavioral task
behavioral1
Sample
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
Resource
win7-20240221-en
General
-
Target
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
-
Size
420KB
-
MD5
7b432411c12d3d0d31ecaf9011450e42
-
SHA1
968943d42ba1e8938989b6ed1884195c2285396f
-
SHA256
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348
-
SHA512
6881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b
-
SSDEEP
6144:lfBwgfV+aXoGJR1xpppStlxu4qGilNZZDLxFLWj4+36o9:l3V+anFxZUq1NZJ9N8qu
Malware Config
Extracted
amadey
4.18
-
install_dir
154561dcbf
-
install_file
Dctooux.exe
-
strings_key
2cd47fa043c815e1a033c67832f3c6a5
-
url_paths
/j4Fvskd3/index.php
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
Dctooux.exeDctooux.exeDctooux.exeDctooux.exeDctooux.exepid process 5116 Dctooux.exe 5056 Dctooux.exe 2376 Dctooux.exe 2796 Dctooux.exe 4984 Dctooux.exe -
Drops file in Windows directory 1 IoCs
Processes:
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exedescription ioc process File created C:\Windows\Tasks\Dctooux.job 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1120 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 3132 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 3992 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 3752 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 4556 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 2872 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 4984 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 5100 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 4228 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe 1416 4636 WerFault.exe 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exepid process 4636 3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe"C:\Users\Admin\AppData\Local\Temp\3fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:4636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 6882⤵
- Program crash
PID:1120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 7402⤵
- Program crash
PID:3132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 8202⤵
- Program crash
PID:3992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 8282⤵
- Program crash
PID:3752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 8482⤵
- Program crash
PID:4556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 8522⤵
- Program crash
PID:2872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 10642⤵
- Program crash
PID:4984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 11082⤵
- Program crash
PID:5100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 11682⤵
- Program crash
PID:4228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 12322⤵
- Program crash
PID:1416
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
PID:5116
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
PID:5056
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
PID:2376
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
PID:2796
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeFilesize
420KB
MD57b432411c12d3d0d31ecaf9011450e42
SHA1968943d42ba1e8938989b6ed1884195c2285396f
SHA2563fa8f8c64210e0949184380e438a86e4d8e597c7b63cd8591232083b97fa5348
SHA5126881c00ec9674a90b6390e18bcff67d0a5c837411f83955869a9cb2b62bccdedbc93561e70f6ddab7baaf908c8154de3a5bb982d0ee9ecc62363cc67d9cf563b
-
memory/2376-40-0x0000000000DC0000-0x0000000000EC0000-memory.dmpFilesize
1024KB
-
memory/2376-42-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2376-41-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2796-53-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2796-52-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2796-51-0x0000000000C70000-0x0000000000D70000-memory.dmpFilesize
1024KB
-
memory/4636-11-0x0000000000D00000-0x0000000000E00000-memory.dmpFilesize
1024KB
-
memory/4636-3-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/4636-2-0x0000000000C60000-0x0000000000CCF000-memory.dmpFilesize
444KB
-
memory/4636-8-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/4636-9-0x0000000000C60000-0x0000000000CCF000-memory.dmpFilesize
444KB
-
memory/4636-1-0x0000000000D00000-0x0000000000E00000-memory.dmpFilesize
1024KB
-
memory/4984-62-0x0000000000B40000-0x0000000000C40000-memory.dmpFilesize
1024KB
-
memory/4984-63-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5056-31-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5056-30-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5056-29-0x0000000000BB0000-0x0000000000CB0000-memory.dmpFilesize
1024KB
-
memory/5116-18-0x0000000000CF0000-0x0000000000DF0000-memory.dmpFilesize
1024KB
-
memory/5116-19-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5116-20-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB