Analysis
-
max time kernel
39s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 03:10
General
-
Target
888ce84266258342e3f3afbdbfde377b6dac2d47c4499b527a47f5f6f3a3af7d.exe
-
Size
1.8MB
-
MD5
bc5023306fc8985f32a0a9e78156e17e
-
SHA1
c0548bcd5649f2b2e394fddd2b2e51361096d21c
-
SHA256
888ce84266258342e3f3afbdbfde377b6dac2d47c4499b527a47f5f6f3a3af7d
-
SHA512
25d4b98401407d5beb5a57fc5b99bf5ee238db5beb54931a07772dd7e3cf93f7e8ac9a7bee64fad3075aaf50463f1147688fb8fc347980d0f96342c43905f46c
-
SSDEEP
24576:FgtslEnROL38/C/dS8x9zypcmv2AuFKi03Gua/r6kiLrj57stKvfXNGXlpuPt3:QnY38/8S8Lzr6bi03NbkiLHYK3XYpW
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
amadey
4.17
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888ce84266258342e3f3afbdbfde377b6dac2d47c4499b527a47f5f6f3a3af7d.exe"C:\Users\Admin\AppData\Local\Temp\888ce84266258342e3f3afbdbfde377b6dac2d47c4499b527a47f5f6f3a3af7d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main1⤵
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\497073144238_Desktop.zip' -CompressionLevel Optimal2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD5fef778db4cc8c3c34d51b0438c961148
SHA13e839f0d36c6c8a4f8ccbc91c18f6ec1c8423c83
SHA2560ffb3a16597a4dc8a095db745921957e9f7444aa44a74e604dfeb1d2e5d21791
SHA512742025ec7327ec8e3e4292ca56e2bdf37ee6c5196d4d8c4008b93ba0f914d1ff94a37708de3212b08e116a41a3d11976163cb451aa770efc953e7025c2e34ec3
-
Filesize
454KB
MD520974a7d5ca5709eb0ac4e1ba44722d3
SHA1bd5fc3dc4157fdf5994499a834038f6451ab4958
SHA256d145538457630072afc0d8665ceec840f373f89c30a96c2b7e8d3d8694cc2c55
SHA512eaedd2b6117c4e91760161822405db6438ceb462a4c2853c5c6a533ba68f984e32c7471f73f3f9e62059b44916d2199b98ef094edf71df7159e68b334aa9a5d0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
109KB
MD52afdbe3b99a4736083066a13e4b5d11a
SHA14d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA2568d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
-
Filesize
336KB
MD5000c61d2da7931881c8b732ed227d4b9
SHA1880d182b864facbacbc7dd90e24a48ce79a6e44b
SHA25663cf9e9f91e4ecfb8d331029ebc51368dd5ab31cfda1774a3a37900f97146638
SHA5123c881113a29a7382eac4737ab19635398594a1befb9e5dde323c8e145a43b7a9dac3fc4a44879909f801a9bf5acc43e59ca82eb1eb35e2e1060594cbda68c3ee
-
Filesize
169KB
MD5422a89f442a55dbf9d531462d735b733
SHA12cea38133a367c00c81bfe1d278a49a6c37f0dd6
SHA25636cd6dc89d0a1cd365c43f7a8b4cafafb2304e4ffa626614699177e5bba4c24e
SHA5122cf6b465cde12c4ff2e132002745ba30f00ee25a39a7f425ee5b138fc4444591a13a57b2a8a397299004483bea31c323b496226fa3352df789258afc0b80984a
-
Filesize
300KB
MD559cf7083e17e0e7183d7262a42606a23
SHA12af5b57f73c29386f4248b88f2b13e1d548b456b
SHA256fe297bec694d6b49429db2682fc8d6cd1ec7d7c9a8d1b8821c165f41f66e91b6
SHA512d58d432b67d85a678debb0fa93739bf6a7286c6b6b15cad2e4d82a15040d27671484427f044d65de7ff6441420074eaa7cefc5a84b6a3527a7f9c953c025c5fd
-
Filesize
195KB
MD54e164e238dbe7913e9b895919a19048d
SHA112b2b54e82617b55594730e9aae4b5bcba10cdd2
SHA2569e49feef6bf9919753fde7ab4908a301d4637ba36c9c01e65e6a584e19af19c2
SHA5120f20a90cb92b0b12e459841c585b3da5d386bfaae4fa8999c6b2038f037b6a61ffde2405f3248a603267162ceab86709f143741a7a759df8b126ee42455f18b2
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4KB