Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
q3oUuJIXkc.exe

Overview

General Information

Sample Name:q3oUuJIXkc.exe
Analysis ID:764037
MD5:2239a58cc93fd94dc2806ce7f6af0a0b
SHA1:f09eb7d69bc7440d3d45e14267236a78ac789fcb
SHA256:682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811
Tags:32exetrojan
Infos:

Detection

Amadey
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Amadeys stealer DLL
Multi AV Scanner detection for submitted file
Yara detected Amadey bot
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Hides threads from debuggers
Tries to steal Mail credentials (via file / registry access)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Overwrites code with function prologues
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to evade analysis by execution special instruction (VM detection)
Tries to detect virtualization through RDTSC time measurements
Creates an undocumented autostart registry key
C2 URLs / IPs found in malware configuration
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to steal Instant Messenger accounts or passwords
PE file contains section with special chars
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Sample execution stops while process was sleeping (likely an evasion)
Found dropped PE file which has not been started or loaded
Entry point lies outside standard sections
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Uses cacls to modify the permissions of files
Checks if the current process is being debugged
PE / OLE file has an invalid certificate
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • q3oUuJIXkc.exe (PID: 1780 cmdline: C:\Users\user\Desktop\q3oUuJIXkc.exe MD5: 2239A58CC93FD94DC2806CE7F6AF0A0B)
    • gntuud.exe (PID: 5280 cmdline: "C:\Users\user\AppData\Local\Temp\03bd543fce\gntuud.exe" MD5: 2239A58CC93FD94DC2806CE7F6AF0A0B)
      • schtasks.exe (PID: 1128 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\user\AppData\Local\Temp\03bd543fce\gntuud.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 1592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 2188 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "user:N"&&CACLS "gntuud.exe" /P "user:R" /E&&echo Y|CACLS "..\03bd543fce" /P "user:N"&&CACLS "..\03bd543fce" /P "user:R" /E&&Exit MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • cmd.exe (PID: 4216 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • cacls.exe (PID: 1844 cmdline: CACLS "gntuud.exe" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)
        • cacls.exe (PID: 5132 cmdline: CACLS "gntuud.exe" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)
        • cmd.exe (PID: 4768 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • cacls.exe (PID: 5412 cmdline: CACLS "..\03bd543fce" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)
        • cacls.exe (PID: 5344 cmdline: CACLS "..\03bd543fce" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)
      • rundll32.exe (PID: 4828 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c33e9ad058e5d3\cred64.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • gntuud.exe (PID: 2468 cmdline: C:\Users\user\AppData\Local\Temp\03bd543fce\gntuud.exe MD5: 2239A58CC93FD94DC2806CE7F6AF0A0B)
  • cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "85.209.135.109/jg94cVd30f/index.php", "Version": "3.50"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.315315946.0000000000071000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
    0000000C.00000002.379083563.0000000001281000.00000020.00000001.01000000.00000004.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
      00000001.00000003.350752206.0000000000EAD000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_AmadeyYara detected Amadey botJoe Security
        Process Memory Space: gntuud.exe PID: 5280JoeSecurity_AmadeyYara detected Amadey botJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          12.2.gntuud.exe.1280000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
            0.2.q3oUuJIXkc.exe.70000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for submitted file
              Source: q3oUuJIXkc.exeVirustotal: Detection: 15%Perma Link
              Source: q3oUuJIXkc.exeReversingLabs: Detection: 35%
              Antivirus detection for URL or domain
              Source: http://85.209.135.109/jg94cVd30f/index.php?scr=1Avira URL Cloud: Label: malware
              Multi AV Scanner detection for dropped file
              Source: C:\Users\user\AppData\Local\Temp\03bd543fce\gntuud.exeReversingLabs: Detection: 35%
              Source: 12.2.gntuud.exe.1280000.0.unpackMalware Configuration Extractor: Amadey {"C2 url": "85.209.135.109/jg94cVd30f/index.php", "Version": "3.50"}
              Source: q3oUuJIXkc.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: q3oUuJIXkc.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: q3oUuJIXkc.exe, gntuud.exe.0.dr

              Networking

              bar