Behavioral task
behavioral1
Sample
1660-2-0x0000000000D80000-0x0000000001256000-memory.exe
Resource
win7-20231215-en
General
-
Target
1660-2-0x0000000000D80000-0x0000000001256000-memory.dmp
-
Size
4.8MB
-
MD5
a5d31f83588bbfed5ff0378ab223ca63
-
SHA1
82f90932fe881a3a38a42c73ec3cf70dfad2edf7
-
SHA256
9234d6d8d8275e6c5c8278edea09681d3e61fb82b95dd8afbd79ca2c11b2cdac
-
SHA512
36031aee2f529ba1d6be90aecb8afd1e08d2ec9c13cb7e96fd0a87b4f7d2d99a10ec59e2ae86d2ff85ab941dcb6776833e1c451b4be411d48afb7f99697a15a6
-
SSDEEP
98304:XKrKhHpxV/akYoH3qR1LOJAcNESi5Z+E714xg9+c5Z6+gByy:XJqRwJtNTiL+E7og9+wo1Bh
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1660-2-0x0000000000D80000-0x0000000001256000-memory.dmp
Files
-
1660-2-0x0000000000D80000-0x0000000001256000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dvxtuamc Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jwjfusum Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE