Windows Analysis Report
file.exe

Overview

General Information

Sample Name: file.exe
Analysis ID: 764030
MD5: 2365cd5930c2845769177b920d4b8ad6
SHA1: 1246c7f15b215bf1ecc70294434ccd19a1778daf
SHA256: 77bfc0f4bf45082fc3c52c3c10d4394d925c116fda4b3eda7f09151a57ad4010
Tags: exe
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Amadeys stealer DLL
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to steal Instant Messenger accounts or passwords
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found dropped PE file which has not been started or loaded
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Creates a DirectInput object (often for capturing keystrokes)
Drops PE files
Contains functionality to read the PEB
Uses cacls to modify the permissions of files
Contains functionality to launch a program with higher privileges
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection

barindex
Source: 31.41.244.237/jg94cVd30f/index.php Avira URL Cloud: Label: malware
Source: http://31.41.244.237/jg94cVd30f/index.phpM Avira URL Cloud: Label: malware
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll Avira: detection malicious, Label: HEUR/AGEN.1233121
Source: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll Avira: detection malicious, Label: HEUR/AGEN.1233121
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll ReversingLabs: Detection: 88%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll Virustotal: Detection: 76% Perma Link
Source: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll ReversingLabs: Detection: 88%
Source: file.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Joe Sandbox ML: detected
Source: 8.2.gntuud.exe.950e67.1.raw.unpack Malware Configuration Extractor: Amadey {"C2 url": "31.41.244.237/jg94cVd30f/index.php", "Version": "3.50"}

Compliance

barindex
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: Binary string: C:\lexakezuraj_yamimumowur45 rex.pdb source: file.exe, gntuud.exe.0.dr
Source: Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: gntuud.exe, gntuud.exe, 00000008.00000002.385428058.0000000000950000.00000040.00001000.00020000.00000000.sdmp, gntuud.exe, 00000008.00000002.384447242.0000000000400000.00000040.00000001.01000000.00000004.sdmp, gntuud.exe, 00000008.00000003.383588182.0000000000990000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 2C:\lexakezuraj_yamimumowur45 rex.pdb source: file.exe, gntuud.exe.0.dr
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00420C88 FindFirstFileExW, 0_2_00420C88
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00420C88 FindFirstFileExW, 8_2_00420C88
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00970EEF FindFirstFileExW, 8_2_00970EEF

Networking

barindex
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 31.41.244.237 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 192.168.2.4 80 Jump to behavior
Source: Malware configuration extractor URLs: 31.41.244.237/jg94cVd30f/index.php
Source: Joe Sandbox View ASN Name: AEROEXPRESS-ASRU AEROEXPRESS-ASRU
Source: Joe Sandbox View IP Address: 31.41.244.237 31.41.244.237
Source: gntuud.exe, 00000001.00000003.359344808.00000000006A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.237/jg94cVd30f/index.phpM
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004041F0 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 0_2_004041F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00402C70 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown, 0_2_00402C70
Source: file.exe, 00000000.00000002.314289798.00000000006D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

barindex
Source: 00000008.00000002.385428058.0000000000950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.314298922.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.385361747.000000000061B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.314200617.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll, type: DROPPED Matched rule: Detects password stealer DLL. Dropped by Amadey Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, type: DROPPED Matched rule: Detects password stealer DLL. Dropped by Amadey Author: ditekSHen
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 00000008.00000002.385428058.0000000000950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.314298922.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.385361747.000000000061B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.314200617.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll, type: DROPPED Matched rule: INDICATOR_TOOL_PWS_Amady author = ditekSHen, description = Detects password stealer DLL. Dropped by Amadey
Source: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, type: DROPPED Matched rule: INDICATOR_TOOL_PWS_Amady author = ditekSHen, description = Detects password stealer DLL. Dropped by Amadey
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00429560 0_2_00429560
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0042857D 0_2_0042857D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004076A0 0_2_004076A0
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00406F30 8_2_00406F30
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00429560 8_2_00429560
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0042857D 8_2_0042857D
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_009797C7 8_2_009797C7
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00418D20 appears 40 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00417040 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: String function: 00968F87 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: String function: 00418D20 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: String function: 00417040 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process Stats: CPU usage > 98%
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll C7D804E8FB096769B0E199102BDF8EFA97DFAE1A9B57A479819971146877368B
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe"
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "user:N"&&CACLS "gntuud.exe" /P "user:R" /E&&echo Y|CACLS "..\9c69749b54" /P "user:N"&&CACLS "..\9c69749b54" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:N"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\9c69749b54" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\9c69749b54" /P "user:R" /E
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, Main
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe" /F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "user:N"&&CACLS "gntuud.exe" /P "user:R" /E&&echo Y|CACLS "..\9c69749b54" /P "user:N"&&CACLS "..\9c69749b54" /P "user:R" /E&&Exit Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, Main Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:N" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:R" /E Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\9c69749b54" /P "user:N" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\9c69749b54" /P "user:R" /E Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe File created: C:\Users\user\AppData\Roaming\85f469ce401df1 Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\9c69749b54 Jump to behavior
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@24/9@0/2
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006E466E CreateToolhelp32Snapshot,Module32First, 0_2_006E466E
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Mutant created: \Sessions\1\BaseNamedObjects\85f469ce401df19fc5a7f9408bc52f06
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6084:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1680:120:WilError_01
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\lexakezuraj_yamimumowur45 rex.pdb source: file.exe, gntuud.exe.0.dr
Source: Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: gntuud.exe, gntuud.exe, 00000008.00000002.385428058.0000000000950000.00000040.00001000.00020000.00000000.sdmp, gntuud.exe, 00000008.00000002.384447242.0000000000400000.00000040.00000001.01000000.00000004.sdmp, gntuud.exe, 00000008.00000003.383588182.0000000000990000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 2C:\lexakezuraj_yamimumowur45 rex.pdb source: file.exe, gntuud.exe.0.dr

Data Obfuscation

barindex
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.sapara:R;.dinol:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418D66 push ecx; ret 0_2_00418D79
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006E518A pushfd ; ret 0_2_006E518B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006E6BFB push ecx; iretd 0_2_006E6C05
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006E6B88 push edi; ret 0_2_006E6B89
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006E7E70 push ss; retf 0_2_006E7E71
Source: file.exe Static PE information: section name: .sapara
Source: file.exe Static PE information: section name: .dinol
Source: gntuud.exe.0.dr Static PE information: section name: .sapara
Source: gntuud.exe.0.dr Static PE information: section name: .dinol
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe File created: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll Jump to dropped file

Boot Survival

barindex
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe" /F
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:N"
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe TID: 4216 Thread sleep time: -720000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe TID: 1888 Thread sleep time: -50000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe TID: 4136 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe TID: 1900 Thread sleep time: -1440000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe TID: 4216 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe TID: 4136 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 360000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe API coverage: 5.0 %
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe API coverage: 3.6 %
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405470 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo, 0_2_00405470
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00420C88 FindFirstFileExW, 0_2_00420C88
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00420C88 FindFirstFileExW, 8_2_00420C88
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00970EEF FindFirstFileExW, 8_2_00970EEF
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 50000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 360000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Thread delayed: delay time: 180000 Jump to behavior
Source: rundll32.exe, 0000000D.00000002.350105961.000000000296A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418B47 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00418B47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00421EDE GetProcessHeap, 0_2_00421EDE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041B9E1 mov eax, dword ptr fs:[00000030h] 0_2_0041B9E1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041DFE2 mov eax, dword ptr fs:[00000030h] 0_2_0041DFE2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_006E3F4B push dword ptr fs:[00000030h] 0_2_006E3F4B
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0041B9E1 mov eax, dword ptr fs:[00000030h] 8_2_0041B9E1
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0041DFE2 mov eax, dword ptr fs:[00000030h] 8_2_0041DFE2
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0095092B mov eax, dword ptr fs:[00000030h] 8_2_0095092B
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0096E249 mov eax, dword ptr fs:[00000030h] 8_2_0096E249
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0096BC48 mov eax, dword ptr fs:[00000030h] 8_2_0096BC48
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00950D90 mov eax, dword ptr fs:[00000030h] 8_2_00950D90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418243 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00418243
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418B47 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00418B47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041CB60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0041CB60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418CAC SetUnhandledExceptionFilter, 0_2_00418CAC
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00418243 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00418243
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00418B47 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00418B47
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0041CB60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_0041CB60
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_009684AA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_009684AA
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_00968DAE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00968DAE
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Code function: 8_2_0096CDC7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_0096CDC7

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 31.41.244.237 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 192.168.2.4 80 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00403FB0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree, 0_2_00403FB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004043C0 ShellExecuteA, 0_2_004043C0
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe" /F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "user:N"&&CACLS "gntuud.exe" /P "user:R" /E&&echo Y|CACLS "..\9c69749b54" /P "user:N"&&CACLS "..\9c69749b54" /P "user:R" /E&&Exit Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, Main Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:N" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "gntuud.exe" /P "user:R" /E Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\9c69749b54" /P "user:N" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\9c69749b54" /P "user:R" /E Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9c69749b54\gntuud.exe Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418967 cpuid 0_2_00418967
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418D81 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00418D81
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00424CA6 _free,_free,_free,GetTimeZoneInformation,_free, 0_2_00424CA6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405470 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo, 0_2_00405470
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040B8C0 GetUserNameA,SetCurrentDirectoryA, 0_2_0040B8C0

Stealing of Sensitive Information

barindex
Source: Yara match File source: 8.3.gntuud.exe.990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.gntuud.exe.950e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.gntuud.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.gntuud.exe.2120000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.gntuud.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.file.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.gntuud.exe.2120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.gntuud.exe.950e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.gntuud.exe.990000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.5f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.file.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.385428058.0000000000950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.314114177.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.311169503.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.384447242.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.326614950.0000000002120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.314200617.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.383588182.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cred64[1].dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\85f469ce401df1\cred64.dll, type: DROPPED
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs