Analysis
- max time kernel
162s - max time network
168s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
06/03/2022, 22:12
General
- Target a0a99841ac66d40954d49f6f276234a122d0454f9ce7a059c6d471d38f06a05d.exe
- Size 11.8MB
- Sample220306-14fx2ahdbn
- SHA256 a0a99841ac66d40954d49f6f276234a122d0454f9ce7a059c6d471d38f06a05d
Malware Config
Extracted
-
amadey
-
2.06
-
217.8.117.207/gb2pnjsjcs/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Taurus Stealer
Taurus is an infostealer first seen in June 2020.
- Taurus Stealer Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Executes dropped EXE 5 IoCs
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0a99841ac66d40954d49f6f276234a122d0454f9ce7a059c6d471d38f06a05d.exe"C:\Users\Admin\AppData\Local\Temp\a0a99841ac66d40954d49f6f276234a122d0454f9ce7a059c6d471d38f06a05d.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Puddle\Arch_40.exe"C:\Users\Admin\AppData\Roaming\Puddle\Arch_40.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Realtek Sound Blaster\RealtekSb.exe"C:\Users\Admin\AppData\Roaming\Realtek Sound Blaster\RealtekSb.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Roaming\Software\Permit_17.exe"C:\Users\Admin\AppData\Roaming\Software\Permit_17.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\97fd00311d\bween.exe"C:\ProgramData\97fd00311d\bween.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Software\Bid_19.exe"C:\Users\Admin\AppData\Roaming\Software\Bid_19.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/312-148-0x0000000003350000-0x0000000003351000-memory.dmp
memory/312-151-0x00000000007C0000-0x0000000000E54000-memory.dmp
memory/312-150-0x0000000003360000-0x0000000003361000-memory.dmp
memory/312-140-0x0000000077230000-0x00000000773D3000-memory.dmp
memory/360-176-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/360-177-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/360-173-0x0000000000250000-0x00000000008D5000-memory.dmp
memory/360-180-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/360-178-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/360-174-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/360-179-0x0000000002E40000-0x0000000002E41000-memory.dmp
memory/360-171-0x0000000077230000-0x00000000773D3000-memory.dmp
memory/360-175-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/2124-141-0x0000000003AB0000-0x0000000003AB1000-memory.dmp
memory/2124-137-0x0000000077230000-0x00000000773D3000-memory.dmp
memory/2124-144-0x0000000003A70000-0x0000000003A71000-memory.dmp
memory/2124-145-0x0000000003A90000-0x0000000003A91000-memory.dmp
memory/2124-143-0x0000000003AA0000-0x0000000003AA1000-memory.dmp
memory/2124-142-0x0000000003AC0000-0x0000000003AC1000-memory.dmp
memory/2124-139-0x0000000000EB0000-0x000000000184B000-memory.dmp
memory/2904-154-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/2904-158-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/2904-138-0x0000000077230000-0x00000000773D3000-memory.dmp
memory/2904-149-0x0000000001000000-0x0000000001685000-memory.dmp
memory/2904-152-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/2904-153-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
memory/2904-156-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
memory/2904-155-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/2904-157-0x0000000000FC0000-0x0000000000FC1000-memory.dmp
memory/3732-167-0x0000000003630000-0x0000000003631000-memory.dmp
memory/3732-161-0x0000000077230000-0x00000000773D3000-memory.dmp
memory/3732-162-0x0000000000920000-0x00000000012BB000-memory.dmp
memory/3732-170-0x0000000003650000-0x0000000003651000-memory.dmp
memory/3732-169-0x0000000003640000-0x0000000003641000-memory.dmp
memory/3732-168-0x0000000003670000-0x0000000003671000-memory.dmp
memory/3732-163-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/3732-166-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/3732-165-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3732-164-0x0000000003620000-0x0000000003621000-memory.dmp