Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2023, 21:36

General

  • Target

    NEAS.eb4f61cdbba43d2b9b567e06a981f760.exe

  • Size

    243KB

  • MD5

    eb4f61cdbba43d2b9b567e06a981f760

  • SHA1

    b9738f36b4fb5451fa28cc23f0eff794d7b6b647

  • SHA256

    27a59b0d52380734f65d86eec8562d206300e3b64500017ba0157a17bd458359

  • SHA512

    433473687f20b4c6de30e3f43625419c3c02fa4ee39989b599ffee3446ec2acf2f30ee94d375a55eb06ad0d8cb0ae06b6a5fe11e76f70d7a132d6b3ece23a4ca

  • SSDEEP

    6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.eb4f61cdbba43d2b9b567e06a981f760.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.eb4f61cdbba43d2b9b567e06a981f760.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
      "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2924
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2920
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:5048
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "explothe.exe" /P "Admin:N"
            4⤵
              PID:2848
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "explothe.exe" /P "Admin:R" /E
              4⤵
                PID:1208
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\fefffe8cea" /P "Admin:N"
                4⤵
                  PID:2888
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  4⤵
                    PID:4456
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\fefffe8cea" /P "Admin:R" /E
                    4⤵
                      PID:1472
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:2180
              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                1⤵
                • Executes dropped EXE
                PID:4832
              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                1⤵
                • Executes dropped EXE
                PID:2820

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                243KB

                MD5

                eb4f61cdbba43d2b9b567e06a981f760

                SHA1

                b9738f36b4fb5451fa28cc23f0eff794d7b6b647

                SHA256

                27a59b0d52380734f65d86eec8562d206300e3b64500017ba0157a17bd458359

                SHA512

                433473687f20b4c6de30e3f43625419c3c02fa4ee39989b599ffee3446ec2acf2f30ee94d375a55eb06ad0d8cb0ae06b6a5fe11e76f70d7a132d6b3ece23a4ca

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                243KB

                MD5

                eb4f61cdbba43d2b9b567e06a981f760

                SHA1

                b9738f36b4fb5451fa28cc23f0eff794d7b6b647

                SHA256

                27a59b0d52380734f65d86eec8562d206300e3b64500017ba0157a17bd458359

                SHA512

                433473687f20b4c6de30e3f43625419c3c02fa4ee39989b599ffee3446ec2acf2f30ee94d375a55eb06ad0d8cb0ae06b6a5fe11e76f70d7a132d6b3ece23a4ca

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                243KB

                MD5

                eb4f61cdbba43d2b9b567e06a981f760

                SHA1

                b9738f36b4fb5451fa28cc23f0eff794d7b6b647

                SHA256

                27a59b0d52380734f65d86eec8562d206300e3b64500017ba0157a17bd458359

                SHA512

                433473687f20b4c6de30e3f43625419c3c02fa4ee39989b599ffee3446ec2acf2f30ee94d375a55eb06ad0d8cb0ae06b6a5fe11e76f70d7a132d6b3ece23a4ca

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                243KB

                MD5

                eb4f61cdbba43d2b9b567e06a981f760

                SHA1

                b9738f36b4fb5451fa28cc23f0eff794d7b6b647

                SHA256

                27a59b0d52380734f65d86eec8562d206300e3b64500017ba0157a17bd458359

                SHA512

                433473687f20b4c6de30e3f43625419c3c02fa4ee39989b599ffee3446ec2acf2f30ee94d375a55eb06ad0d8cb0ae06b6a5fe11e76f70d7a132d6b3ece23a4ca

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                243KB

                MD5

                eb4f61cdbba43d2b9b567e06a981f760

                SHA1

                b9738f36b4fb5451fa28cc23f0eff794d7b6b647

                SHA256

                27a59b0d52380734f65d86eec8562d206300e3b64500017ba0157a17bd458359

                SHA512

                433473687f20b4c6de30e3f43625419c3c02fa4ee39989b599ffee3446ec2acf2f30ee94d375a55eb06ad0d8cb0ae06b6a5fe11e76f70d7a132d6b3ece23a4ca

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                e913b0d252d36f7c9b71268df4f634fb

                SHA1

                5ac70d8793712bcd8ede477071146bbb42d3f018

                SHA256

                4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

                SHA512

                3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                e913b0d252d36f7c9b71268df4f634fb

                SHA1

                5ac70d8793712bcd8ede477071146bbb42d3f018

                SHA256

                4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

                SHA512

                3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                e913b0d252d36f7c9b71268df4f634fb

                SHA1

                5ac70d8793712bcd8ede477071146bbb42d3f018

                SHA256

                4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

                SHA512

                3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                a5b509a3fb95cc3c8d89cd39fc2a30fb

                SHA1

                5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

                SHA256

                5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

                SHA512

                3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9