Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 14:10

General

  • Target

    NEAS.64fd68d92d8b8c0a516b87584f97a8a0.exe

  • Size

    220KB

  • MD5

    64fd68d92d8b8c0a516b87584f97a8a0

  • SHA1

    68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

  • SHA256

    6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

  • SHA512

    f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

  • SSDEEP

    6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.64fd68d92d8b8c0a516b87584f97a8a0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.64fd68d92d8b8c0a516b87584f97a8a0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
      "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:4140
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:4216
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "explothe.exe" /P "Admin:N"
            4⤵
              PID:5096
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "explothe.exe" /P "Admin:R" /E
              4⤵
                PID:3036
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "..\fefffe8cea" /P "Admin:N"
                4⤵
                  PID:4864
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  4⤵
                    PID:4352
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\fefffe8cea" /P "Admin:R" /E
                    4⤵
                      PID:1384
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:3588
              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                1⤵
                • Executes dropped EXE
                PID:3448
              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                1⤵
                • Executes dropped EXE
                PID:4268
              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
                1⤵
                • Executes dropped EXE
                PID:3112

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                220KB

                MD5

                64fd68d92d8b8c0a516b87584f97a8a0

                SHA1

                68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

                SHA256

                6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

                SHA512

                f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                220KB

                MD5

                64fd68d92d8b8c0a516b87584f97a8a0

                SHA1

                68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

                SHA256

                6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

                SHA512

                f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                220KB

                MD5

                64fd68d92d8b8c0a516b87584f97a8a0

                SHA1

                68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

                SHA256

                6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

                SHA512

                f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                220KB

                MD5

                64fd68d92d8b8c0a516b87584f97a8a0

                SHA1

                68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

                SHA256

                6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

                SHA512

                f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                220KB

                MD5

                64fd68d92d8b8c0a516b87584f97a8a0

                SHA1

                68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

                SHA256

                6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

                SHA512

                f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

              • C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

                Filesize

                220KB

                MD5

                64fd68d92d8b8c0a516b87584f97a8a0

                SHA1

                68a3d4ecee0a7d38cf830c8ea9d8b5743903f1b9

                SHA256

                6ff9140480c21154a131767079789c6ad25c5b9c83c99e65d62b72f7e09d0349

                SHA512

                f8a56eeb2fbf71ed34ec82ffff5aedbeb9052504dcbbc37cf1360a11756f658f8297b87a3fa1f5ff1424aca277747cf929d48a0674499df65b165f9dfd82d3d4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                e913b0d252d36f7c9b71268df4f634fb

                SHA1

                5ac70d8793712bcd8ede477071146bbb42d3f018

                SHA256

                4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

                SHA512

                3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                e913b0d252d36f7c9b71268df4f634fb

                SHA1

                5ac70d8793712bcd8ede477071146bbb42d3f018

                SHA256

                4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

                SHA512

                3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                e913b0d252d36f7c9b71268df4f634fb

                SHA1

                5ac70d8793712bcd8ede477071146bbb42d3f018

                SHA256

                4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

                SHA512

                3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                a5b509a3fb95cc3c8d89cd39fc2a30fb

                SHA1

                5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

                SHA256

                5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

                SHA512

                3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9