Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-03-2024 22:21
General
-
Target
13cac8771d5bdf04a533f9d4af84f8d0aa240a2cfe85603beb9782c5261a4216.exe
-
Size
1.8MB
-
MD5
766b871e4a0cb690ef3697fd81f3f2d8
-
SHA1
ce86761569a375c6dfa22bd5707125b05207e3dd
-
SHA256
13cac8771d5bdf04a533f9d4af84f8d0aa240a2cfe85603beb9782c5261a4216
-
SHA512
a32336ad9b4fec2697de85af6404a69f0b9ab0390fb16f7206c2090911afadc60677b72c790e135993048e5663efbbe86b192d020b1644b5ec2db0e8b9d4cc7c
-
SSDEEP
49152:8o2laJ5uUQi8UU1k60147XalQIhYMNm8w0S/W6:8VaGUQi8UU1kF14TpuKUS/W6
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13cac8771d5bdf04a533f9d4af84f8d0aa240a2cfe85603beb9782c5261a4216.exe"C:\Users\Admin\AppData\Local\Temp\13cac8771d5bdf04a533f9d4af84f8d0aa240a2cfe85603beb9782c5261a4216.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
-
Filesize
8KB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.7MB