Analysis
-
max time kernel
292s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
29-03-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
Resource
win7-20240215-en
General
-
Target
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
-
Size
419KB
-
MD5
27499cf0e73817392b9f50cc9e82c2b3
-
SHA1
a0efab9cdb4b2a4a920f4ab76095d24806d7812f
-
SHA256
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
-
SHA512
94b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
-
SSDEEP
6144:dOpt5U2F/o+89gzpGzlpKmu9HiFqVOmZce8dsGlEpD:Q5U2FQ+8+cpKmu9HikghdsG2h
Malware Config
Extracted
amadey
4.18
-
install_dir
154561dcbf
-
install_file
Dctooux.exe
-
strings_key
2cd47fa043c815e1a033c67832f3c6a5
-
url_paths
/j4Fvskd3/index.php
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
Dctooux.exeDctooux.exeDctooux.exeDctooux.exeDctooux.exepid process 4624 Dctooux.exe 512 Dctooux.exe 5056 Dctooux.exe 2108 Dctooux.exe 3900 Dctooux.exe -
Drops file in Windows directory 1 IoCs
Processes:
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exedescription ioc process File created C:\Windows\Tasks\Dctooux.job bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1048 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 3780 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 2656 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4600 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4000 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4636 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4724 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 960 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4084 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 4432 4556 WerFault.exe bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exepid process 4556 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 6842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 8442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 10602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 10882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 11362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 12162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exeFilesize
419KB
MD527499cf0e73817392b9f50cc9e82c2b3
SHA1a0efab9cdb4b2a4a920f4ab76095d24806d7812f
SHA256bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
SHA51294b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
-
memory/512-23-0x0000000000B50000-0x0000000000C50000-memory.dmpFilesize
1024KB
-
memory/512-25-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/512-24-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2108-45-0x0000000000CC0000-0x0000000000DC0000-memory.dmpFilesize
1024KB
-
memory/2108-47-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/2108-46-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/3900-58-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/3900-57-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/3900-56-0x0000000000DD0000-0x0000000000ED0000-memory.dmpFilesize
1024KB
-
memory/4556-1-0x0000000000ED0000-0x0000000000FD0000-memory.dmpFilesize
1024KB
-
memory/4556-14-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/4556-15-0x0000000000ED0000-0x0000000000FD0000-memory.dmpFilesize
1024KB
-
memory/4556-3-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/4556-2-0x0000000000E60000-0x0000000000ECF000-memory.dmpFilesize
444KB
-
memory/4624-11-0x0000000000C70000-0x0000000000D70000-memory.dmpFilesize
1024KB
-
memory/4624-12-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/4624-13-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5056-36-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5056-35-0x0000000000400000-0x0000000000B12000-memory.dmpFilesize
7.1MB
-
memory/5056-34-0x0000000000B70000-0x0000000000C70000-memory.dmpFilesize
1024KB