amadey | fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c

Analysis

max time kernel
171s
max time network
219s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe
Size

3.6MB
MD5

a2c7a93f123d477aeb5cd0c87e95711f
SHA1

d2159c9274e01d44217f04d7491a9ab899b6e1c2
SHA256

fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c
SHA512

ec89e133346ad53af32c584f27129cfd5d62d85b2990136f696b2dc3aba7b2919b3e30e8081b880fb219f694d56f3bb02eb03a8484f7c160ccee435f3aa21109

Score

10^/10

amadey fickerstealer evasion infostealer themida trojan

Malware Config

Extracted

Family

fickerstealer

194.99.20.202:80

Extracted

Family

amadey

Version

2.08

194.32.77.37/pPpfs3ds3Za/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

services.exesystem.exerween.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	services.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	system.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rween.exe

Executes dropped EXE 3 IoCs

Processes:

services.exesystem.exerween.exe

pid process

1316 services.exe
960 system.exe
336 rween.exe

pid	process
1316	services.exe
960	system.exe
336	rween.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

services.exesystem.exerween.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rween.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rween.exe

Loads dropped DLL 4 IoCs

Processes:

fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exesystem.exe

pid	process
1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe
1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe
1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe
960	system.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\services.exe	themida
C:\Users\Admin\AppData\Roaming\services.exe	themida
\Users\Admin\AppData\Roaming\services.exe	themida
\Users\Admin\AppData\Roaming\system.exe	themida
C:\Users\Admin\AppData\Roaming\system.exe	themida
behavioral1/memory/960-64-0x0000000000120000-0x0000000000593000-memory.dmp	themida
behavioral1/memory/960-65-0x0000000000120000-0x0000000000593000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\system.exe	themida
behavioral1/memory/1316-67-0x0000000000400000-0x000000000087E000-memory.dmp	themida
behavioral1/memory/960-68-0x0000000000120000-0x0000000000593000-memory.dmp	themida
\ProgramData\ba4c285d2a\rween.exe	themida
C:\ProgramData\ba4c285d2a\rween.exe	themida
behavioral1/memory/960-73-0x0000000000120000-0x0000000000593000-memory.dmp	themida
behavioral1/memory/336-74-0x0000000001240000-0x00000000016B3000-memory.dmp	themida
behavioral1/memory/336-75-0x0000000001240000-0x00000000016B3000-memory.dmp	themida
behavioral1/memory/336-76-0x0000000001240000-0x00000000016B3000-memory.dmp	themida
behavioral1/memory/1316-80-0x0000000000400000-0x000000000087E000-memory.dmp	themida
behavioral1/memory/336-81-0x0000000001240000-0x00000000016B3000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

services.exesystem.exerween.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	system.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rween.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
6	api.ipify.org

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exesystem.exerween.execmd.exe

description	pid	process	target process
PID 1724 wrote to memory of 1316	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	services.exe
PID 1724 wrote to memory of 1316	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	services.exe
PID 1724 wrote to memory of 1316	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	services.exe
PID 1724 wrote to memory of 1316	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	services.exe
PID 1724 wrote to memory of 960	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	system.exe
PID 1724 wrote to memory of 960	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	system.exe
PID 1724 wrote to memory of 960	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	system.exe
PID 1724 wrote to memory of 960	1724	fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe	system.exe
PID 960 wrote to memory of 336	960	system.exe	rween.exe
PID 960 wrote to memory of 336	960	system.exe	rween.exe
PID 960 wrote to memory of 336	960	system.exe	rween.exe
PID 960 wrote to memory of 336	960	system.exe	rween.exe
PID 336 wrote to memory of 1332	336	rween.exe	cmd.exe
PID 336 wrote to memory of 1332	336	rween.exe	cmd.exe
PID 336 wrote to memory of 1332	336	rween.exe	cmd.exe
PID 336 wrote to memory of 1332	336	rween.exe	cmd.exe
PID 1332 wrote to memory of 1380	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 1380	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 1380	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 1380	1332	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe
"C:\Users\Admin\AppData\Local\Temp\fbac8499f9b9374327cb08b0a19a09da2e26f464bf082708db77228a44277f0c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Roaming\services.exe
C:\Users\Admin\AppData\Roaming\services.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:1316

C:\Users\Admin\AppData\Roaming\system.exe
C:\Users\Admin\AppData\Roaming\system.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:960

C:\ProgramData\ba4c285d2a\rween.exe
"C:\ProgramData\ba4c285d2a\rween.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\ba4c285d2a\
4⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\ba4c285d2a\
5⤵
PID:1380

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\152122772184421199762539
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\ba4c285d2a\rween.exe
Filesize
1.9MB

MD5
bb915ef0b397fd1f08f7c2d14445713c

SHA1
9f19ba3c6a948c7802e616828cd0f1bbde29454a

SHA256
6087d1729f77ce678d03a30247cb6d1f455e8e264951643faf738efba17470c9

SHA512
ab05f3df1dd161636056e4571524fbe27149a542520d95dbe99c4e40baffebb06da2bbea8bb66d63a31de9092df34ac8ffc7568f86425edd23d4028731136331

Download Submit
C:\Users\Admin\AppData\Roaming\services.exe
Filesize
1.9MB

MD5
a9ba96d43fb37bb2ce34b3de9fe25ddb

SHA1
b9d9e46bd77758e70c77ab743f54c06c395f9efd

SHA256
accad4dff29fa37e1bf34e050f6eedefe3ae4f114d1781334ea385a09ac48dec

SHA512
7c71844652ec46a5a69a6f5879b318cf0dd66bc2747b0f825e677f3492c380be1594d7909d3128b25133ff4a9a6d33ce9a7ffdfb9b21891d9aa7e985c51b0fc7

Download Submit
C:\Users\Admin\AppData\Roaming\system.exe
Filesize
1.9MB

MD5
bb915ef0b397fd1f08f7c2d14445713c

SHA1
9f19ba3c6a948c7802e616828cd0f1bbde29454a

SHA256
6087d1729f77ce678d03a30247cb6d1f455e8e264951643faf738efba17470c9

SHA512
ab05f3df1dd161636056e4571524fbe27149a542520d95dbe99c4e40baffebb06da2bbea8bb66d63a31de9092df34ac8ffc7568f86425edd23d4028731136331

Download Submit
C:\Users\Admin\AppData\Roaming\system.exe
Filesize
1.9MB

MD5
bb915ef0b397fd1f08f7c2d14445713c

SHA1
9f19ba3c6a948c7802e616828cd0f1bbde29454a

SHA256
6087d1729f77ce678d03a30247cb6d1f455e8e264951643faf738efba17470c9

SHA512
ab05f3df1dd161636056e4571524fbe27149a542520d95dbe99c4e40baffebb06da2bbea8bb66d63a31de9092df34ac8ffc7568f86425edd23d4028731136331

Download Submit
\ProgramData\ba4c285d2a\rween.exe
Filesize
1.9MB

MD5
bb915ef0b397fd1f08f7c2d14445713c

SHA1
9f19ba3c6a948c7802e616828cd0f1bbde29454a

SHA256
6087d1729f77ce678d03a30247cb6d1f455e8e264951643faf738efba17470c9

SHA512
ab05f3df1dd161636056e4571524fbe27149a542520d95dbe99c4e40baffebb06da2bbea8bb66d63a31de9092df34ac8ffc7568f86425edd23d4028731136331

Download Submit
\Users\Admin\AppData\Roaming\services.exe
Filesize
1.9MB

MD5
a9ba96d43fb37bb2ce34b3de9fe25ddb

SHA1
b9d9e46bd77758e70c77ab743f54c06c395f9efd

SHA256
accad4dff29fa37e1bf34e050f6eedefe3ae4f114d1781334ea385a09ac48dec

SHA512
7c71844652ec46a5a69a6f5879b318cf0dd66bc2747b0f825e677f3492c380be1594d7909d3128b25133ff4a9a6d33ce9a7ffdfb9b21891d9aa7e985c51b0fc7

Download Submit
\Users\Admin\AppData\Roaming\services.exe
Filesize
1.9MB

MD5
a9ba96d43fb37bb2ce34b3de9fe25ddb

SHA1
b9d9e46bd77758e70c77ab743f54c06c395f9efd

SHA256
accad4dff29fa37e1bf34e050f6eedefe3ae4f114d1781334ea385a09ac48dec

SHA512
7c71844652ec46a5a69a6f5879b318cf0dd66bc2747b0f825e677f3492c380be1594d7909d3128b25133ff4a9a6d33ce9a7ffdfb9b21891d9aa7e985c51b0fc7

Download Submit
\Users\Admin\AppData\Roaming\system.exe
Filesize
1.9MB

MD5
bb915ef0b397fd1f08f7c2d14445713c

SHA1
9f19ba3c6a948c7802e616828cd0f1bbde29454a

SHA256
6087d1729f77ce678d03a30247cb6d1f455e8e264951643faf738efba17470c9

SHA512
ab05f3df1dd161636056e4571524fbe27149a542520d95dbe99c4e40baffebb06da2bbea8bb66d63a31de9092df34ac8ffc7568f86425edd23d4028731136331

Download Submit
memory/336-70-0x0000000000000000-mapping.dmp

Download
memory/336-81-0x0000000001240000-0x00000000016B3000-memory.dmp

Filesize
4.4MB

Download
memory/336-76-0x0000000001240000-0x00000000016B3000-memory.dmp

Filesize
4.4MB

Download
memory/336-75-0x0000000001240000-0x00000000016B3000-memory.dmp

Filesize
4.4MB

Download
memory/336-74-0x0000000001240000-0x00000000016B3000-memory.dmp

Filesize
4.4MB

Download
memory/960-61-0x0000000000000000-mapping.dmp

Download
memory/960-68-0x0000000000120000-0x0000000000593000-memory.dmp

Filesize
4.4MB

Download
memory/960-73-0x0000000000120000-0x0000000000593000-memory.dmp

Filesize
4.4MB

Download
memory/960-65-0x0000000000120000-0x0000000000593000-memory.dmp

Filesize
4.4MB

Download
memory/960-64-0x0000000000120000-0x0000000000593000-memory.dmp

Filesize
4.4MB

Download
memory/1316-67-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download
memory/1316-80-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download
memory/1316-57-0x0000000000000000-mapping.dmp

Download
memory/1332-78-0x0000000000000000-mapping.dmp

Download
memory/1380-79-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download