Malware Analysis Report

2024-09-11 11:17

Sample ID 240620-kh8g6aselj
Target 97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06
SHA256 97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06
Tags
amadey 9a3efc trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06

Threat Level: Known bad

The file 97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06 was found to be: Known bad.

Malicious Activity Summary

amadey 9a3efc trojan

Amadey

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-20 08:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 08:37

Reported

2024-06-20 08:39

Platform

win10v2004-20240611-en

Max time kernel

144s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe"

Signatures

Amadey

trojan amadey

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1464 set thread context of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 4188 set thread context of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 set thread context of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 set thread context of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1464 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1208 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1208 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1208 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4188 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3180 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 3004 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe

"C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe"

C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe

"C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 check-ftp.ru udp
KW 78.89.199.216:80 check-ftp.ru tcp
KW 78.89.199.216:80 check-ftp.ru tcp
N/A 127.0.0.127:80 tcp
KW 78.89.199.216:80 check-ftp.ru tcp
N/A 127.0.0.127:80 tcp
US 8.8.8.8:53 216.199.89.78.in-addr.arpa udp
N/A 127.0.0.127:80 tcp
N/A 127.0.0.127:80 tcp
N/A 127.0.0.127:80 tcp
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/1464-2-0x00000000043D0000-0x000000000443B000-memory.dmp

memory/1464-1-0x0000000002930000-0x0000000002A30000-memory.dmp

memory/1208-3-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1208-4-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1208-5-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1208-6-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

MD5 64d4f83323d2a7e3b838e3ccb3f756ac
SHA1 277652c5492c396e8ee93f88de21aa018bf67420
SHA256 97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06
SHA512 291892121476036fdc6cc75c3bd4fe0e5145fc242bd1b43cb4c9b9822c878945341e9aebb91b263e372bb5ff7c0400e2db07cec56fd9504dee1e81971d5d122e

memory/1208-19-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4036-24-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4036-25-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\080292272204

MD5 a1dc58a700b288d91ec1ccdfe28a24b6
SHA1 f56c77ca3fba868fd142c44f2b2f41d9b58d2cea
SHA256 1252ccc66c28a6503407aba32bf7619080afcd50e389342913a96ac22fcfd542
SHA512 1b59bff31e27f6a1ee377fbbba30d715a123ab921ba3fe37735e89b4b0b9f2aa17e9a487a1ba4a7697abd79ddf88ce82f933876a4603a45a4b69eda81a334163

memory/4036-44-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4204-52-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4204-53-0x0000000000400000-0x0000000000470000-memory.dmp

memory/636-65-0x0000000000400000-0x0000000000470000-memory.dmp

memory/636-66-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 08:37

Reported

2024-06-20 08:39

Platform

win11-20240611-en

Max time kernel

141s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 412 set thread context of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 1344 set thread context of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 set thread context of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 set thread context of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 412 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe
PID 564 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 564 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 564 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1344 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2680 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 4964 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe

"C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe"

C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe

"C:\Users\Admin\AppData\Local\Temp\97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 check-ftp.ru udp
QA 37.210.45.144:80 check-ftp.ru tcp
QA 37.210.45.144:80 check-ftp.ru tcp
N/A 127.0.0.127:80 tcp
QA 37.210.45.144:80 check-ftp.ru tcp
N/A 127.0.0.127:80 tcp
N/A 127.0.0.127:80 tcp
N/A 127.0.0.127:80 tcp
N/A 127.0.0.127:80 tcp
US 52.111.227.13:443 tcp

Files

memory/412-2-0x0000000004470000-0x00000000044DB000-memory.dmp

memory/412-1-0x0000000002830000-0x0000000002930000-memory.dmp

memory/564-4-0x0000000000400000-0x0000000000470000-memory.dmp

memory/564-3-0x0000000000400000-0x0000000000470000-memory.dmp

memory/564-5-0x0000000000400000-0x0000000000470000-memory.dmp

memory/564-6-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

MD5 64d4f83323d2a7e3b838e3ccb3f756ac
SHA1 277652c5492c396e8ee93f88de21aa018bf67420
SHA256 97e7d7f8bb1d6ca1132c4e5c3f6f178a10c77c30f03c56773a062fb5fc266b06
SHA512 291892121476036fdc6cc75c3bd4fe0e5145fc242bd1b43cb4c9b9822c878945341e9aebb91b263e372bb5ff7c0400e2db07cec56fd9504dee1e81971d5d122e

memory/564-19-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2944-24-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2944-25-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\524922173293

MD5 b5f4e378aabf5fa8517eac001682cedc
SHA1 41ea6992cf5b76a4c3ccd191eb55b7c5b1289fa5
SHA256 e268242188a30b1a5b84aa62e5191722881a97fe257c7dec95c7f31e6858ecb5
SHA512 b70bb1553de60d8a69a7a2251a1f25cb1a189970ffbf1d5a0c1ffc4194ac2a2834d7851da8b79674a4024b9aa9160107f28e887ed359d1db4b38c83f9fd17654

memory/2944-44-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2620-52-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2620-53-0x0000000000400000-0x0000000000470000-memory.dmp

memory/364-65-0x0000000000400000-0x0000000000470000-memory.dmp

memory/364-66-0x0000000000400000-0x0000000000470000-memory.dmp