Malware Analysis Report

2024-09-11 14:44

Sample ID 240618-ynxjqszcmm
Target 4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5
SHA256 4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5
Tags
amadey 8fc809 trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5

Threat Level: Known bad

The file 4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5 was found to be: Known bad.

Malicious Activity Summary

amadey 8fc809 trojan

Amadey

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-18 19:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 19:56

Reported

2024-06-18 19:59

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe"

Signatures

Amadey

trojan amadey

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2216 set thread context of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 5048 set thread context of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 set thread context of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 set thread context of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 set thread context of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2216 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 2344 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2344 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2344 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 5048 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3124 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4160 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3668 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe

"C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe"

C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe

"C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 nudump.com udp

Files

memory/2216-1-0x00000000025D0000-0x00000000026D0000-memory.dmp

memory/2216-2-0x0000000002530000-0x000000000259F000-memory.dmp

memory/2344-3-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2344-5-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2344-4-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2344-6-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

MD5 f3cc40a725055203c0d57b9b51400bad
SHA1 c127d94d4af1b03523214f9c8ab496a19b4572f3
SHA256 4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5
SHA512 16042f78132bdd365e9f15b6ab3918327fefe42ca37a6e7accb6be396abe8d492736cb23694ce97e68a0510e981ab56b8d1f7b158b0c212afade6f55185de1eb

memory/2344-19-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2596-24-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2596-25-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2596-34-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2596-35-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\337824034273

MD5 7a0eee87f156c21812395b9fe568ef1d
SHA1 28e6593116751017a0953ca5d3f0e8ef09199eaf
SHA256 011c9396cc25696af5443b2a8d831d74708a1997e8a2f083585d8294755be165
SHA512 f29f89cc1e9734dbdd1fd16e913e54146645f23258362d10c2414a8c5bd6e1ee178e2391884f1c1b65fc0a2f9e47c3940df77b5aa823392c3aaf632c7cff10ab

memory/4600-51-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4600-52-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2596-54-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2824-64-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2824-65-0x0000000000400000-0x0000000000472000-memory.dmp

memory/892-77-0x0000000000400000-0x0000000000472000-memory.dmp

memory/892-78-0x0000000000400000-0x0000000000472000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 19:56

Reported

2024-06-18 19:59

Platform

win11-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3924 set thread context of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3548 set thread context of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 set thread context of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 set thread context of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 set thread context of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 3924 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe
PID 1172 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1172 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1172 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3548 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3240 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2556 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3768 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe

"C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe"

C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe

"C:\Users\Admin\AppData\Local\Temp\4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
US 20.42.65.94:443 tcp
AR 200.122.37.247:80 selltix.org tcp
SE 192.229.221.95:80 tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp

Files

memory/3924-2-0x00000000040C0000-0x000000000412F000-memory.dmp

memory/3924-1-0x00000000024D0000-0x00000000025D0000-memory.dmp

memory/1172-5-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1172-4-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1172-3-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1172-6-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

MD5 f3cc40a725055203c0d57b9b51400bad
SHA1 c127d94d4af1b03523214f9c8ab496a19b4572f3
SHA256 4ac557937ca4659478dd224cb6b2e72c35ef0620d4be5148b7bef20c4c0991e5
SHA512 16042f78132bdd365e9f15b6ab3918327fefe42ca37a6e7accb6be396abe8d492736cb23694ce97e68a0510e981ab56b8d1f7b158b0c212afade6f55185de1eb

memory/1172-20-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3400-24-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3400-25-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\524922173293

MD5 19ea18d12d47d0c3631d9399d64cb87e
SHA1 fa1feac01679c4a06c1a5ab724b71b7c9574c293
SHA256 43b52c8532716afe7900010aa72a0f1ef4fd2912b19765c5a5dc44a19868ae76
SHA512 9f7b78eac8345748f9c20abe3053699a545fb3180911b9e1d66ddfde3abcdc7024641a4c717012c8dd8e678793ce844fdb0a68332ada42a9871b8af1e26ad601

memory/3400-45-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3400-46-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1244-51-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1244-52-0x0000000000400000-0x0000000000472000-memory.dmp

memory/400-64-0x0000000000400000-0x0000000000472000-memory.dmp

memory/400-65-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4460-77-0x0000000000400000-0x0000000000472000-memory.dmp