Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-04-2024 15:46
Static task
static1
Behavioral task
behavioral1
Sample
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe
Resource
win10v2004-20240426-en
General
-
Target
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe
-
Size
1.8MB
-
MD5
d63ebfda93fffc3cba2ebbf7771f6de8
-
SHA1
f91261190a4af4d85bb39e8becff4a501fe9dd70
-
SHA256
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab
-
SHA512
e96f50b5a67866446197befb8b483f7974714bed3708557d5251d28064873949b06e873374422aa3fda1360fa59608eceab16de30eb73be2d03205ff437043cd
-
SSDEEP
49152:G3/bn64QhkUJoQGSME4Qfa+Cr9e9ugrF7+3:Gjn64ykUJolOLa+CrY9P7+
Malware Config
Extracted
amadey
4.20
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
explorta.exeexplorta.exe6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exeexplorta.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorta.exeexplorta.exe6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exeexplorta.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe -
Executes dropped EXE 3 IoCs
Processes:
explorta.exeexplorta.exeexplorta.exepid process 4240 explorta.exe 1460 explorta.exe 3320 explorta.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exeexplorta.exeexplorta.exeexplorta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Wine 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe Key opened \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Wine explorta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exeexplorta.exeexplorta.exeexplorta.exepid process 648 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe 4240 explorta.exe 1460 explorta.exe 3320 explorta.exe -
Drops file in Windows directory 1 IoCs
Processes:
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exedescription ioc process File created C:\Windows\Tasks\explorta.job 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exeexplorta.exeexplorta.exeexplorta.exepid process 648 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe 648 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe 4240 explorta.exe 4240 explorta.exe 1460 explorta.exe 1460 explorta.exe 3320 explorta.exe 3320 explorta.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exedescription pid process target process PID 648 wrote to memory of 4240 648 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe explorta.exe PID 648 wrote to memory of 4240 648 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe explorta.exe PID 648 wrote to memory of 4240 648 6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe explorta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe"C:\Users\Admin\AppData\Local\Temp\6ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeFilesize
1.8MB
MD5d63ebfda93fffc3cba2ebbf7771f6de8
SHA1f91261190a4af4d85bb39e8becff4a501fe9dd70
SHA2566ca8365acc68dc4b145956b163c463d14768143b069bd009a6aa209a08f8adab
SHA512e96f50b5a67866446197befb8b483f7974714bed3708557d5251d28064873949b06e873374422aa3fda1360fa59608eceab16de30eb73be2d03205ff437043cd
-
memory/648-10-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/648-8-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/648-23-0x00000000005D0000-0x0000000000A7C000-memory.dmpFilesize
4.7MB
-
memory/648-7-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/648-6-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/648-5-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/648-3-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/648-4-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/648-1-0x00000000770D6000-0x00000000770D8000-memory.dmpFilesize
8KB
-
memory/648-9-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/648-0-0x00000000005D0000-0x0000000000A7C000-memory.dmpFilesize
4.7MB
-
memory/648-2-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/1460-37-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/1460-44-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/1460-40-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/1460-41-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1460-42-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/1460-43-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/1460-39-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/1460-38-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/3320-52-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/3320-53-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-33-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-35-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-34-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-32-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-30-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/4240-31-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/4240-25-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/4240-26-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/4240-27-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/4240-28-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/4240-45-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-46-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-47-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-48-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-49-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-50-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-29-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4240-24-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-54-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-55-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-56-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-57-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB
-
memory/4240-58-0x0000000000430000-0x00000000008DC000-memory.dmpFilesize
4.7MB