Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
22-03-2024 06:33
General
-
Target
a30c6660c036b492c4ee80b3cf305e972141f621cff9f58aeb880cf652d84e99.exe
-
Size
1.8MB
-
MD5
d8bcd072e4229035253b3252c0def657
-
SHA1
fc7bf50d9d709a4a08d167ca879d20e08ad458cd
-
SHA256
a30c6660c036b492c4ee80b3cf305e972141f621cff9f58aeb880cf652d84e99
-
SHA512
0a60ca9532a2b4c2a751a0e26552503428e7b75addcedcca886cc05602542b2f8ef05a3b73390ced707ea487fb746fe3bb71c1fdc7e45290efa51ecc8fbb1f6a
-
SSDEEP
49152:nlGSuMnsskUQeBljIsFLWH39Wl8LY3ID:l6MnjQeBqnH08Y3U
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a30c6660c036b492c4ee80b3cf305e972141f621cff9f58aeb880cf652d84e99.exe"C:\Users\Admin\AppData\Local\Temp\a30c6660c036b492c4ee80b3cf305e972141f621cff9f58aeb880cf652d84e99.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD538cb72342e189a6968cd8b316db4d269
SHA16516250ed502e4cacd1c7fbee4c69b313f536ea9
SHA256d8f8ba202e532a1b5e2b84e9346d57271f01a76c134a5c20ff59025c9d2f0335
SHA5120b757c563d1cb3084a2789b06f7626817e5aa0861806c0a6a28a83eefa6d7bb8d374928e5f0f8fad22d03998b6883e705614246eca8bfd9b004b0c1f1955a28b
-
Filesize
896KB
MD582aa306d5b2a85d198156b97dc2e4e0b
SHA15c65944b1edb0b85885c37de1b26b614c28c87ef
SHA256f37e90cf65295ca07aadccb2485fabcda8f14caa3c79cc3cb3ec22e3fe7372da
SHA5129fbff2e4846d69262f1ef3bd3402c64469ebe92208cea83ab3a87af840532d73400f870c96115d39dca7ee673e01de0f815aff8317486a0191e288bf930e040a
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
8KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB