Analysis

  • max time kernel
    144s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 00:44

General

  • Target

    SecuriteInfo.com.Win32.TrojanX-gen.1033.1898.exe

  • Size

    1.9MB

  • MD5

    8b176c80a6ff69b7beb12254dfaac8ee

  • SHA1

    a51457eb62364526addd00b610cb1e16c7d3918d

  • SHA256

    773070e1373913ea1709dde27c293ceca45fa966a83cba6a0483954b94253f78

  • SHA512

    2eca1765e9d9ab3859fbcfa444125a396d420e194295ecd6f293e6b9d989de85e7b9fbeffe33590274c85ecdcb6939e81c2856c863a57f668df5b01ca0d66c0e

  • SSDEEP

    49152:2Tqur9h3ToEg0fCmS2tmjTNvlHSbF6X88nDQz90b5OrPsxQTrnaG:233ToEg0fFmjBvxSu88DQ90b5ODs0

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 16 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.1033.1898.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.1033.1898.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:688
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            5⤵
              PID:2716
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\658372521424_Desktop.zip' -CompressionLevel Optimal
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:844
        • C:\Users\Admin\AppData\Local\Temp\1000022001\28d3272688.exe
          "C:\Users\Admin\AppData\Local\Temp\1000022001\28d3272688.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          PID:3064
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:828
        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
          "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
          3⤵
            PID:556
          • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
            "C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            PID:2040

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

              Filesize

              1.1MB

              MD5

              f4f865456bc29caab6eb78f48bd3ce05

              SHA1

              20405be101f1fc067c89043db61e198b4b8b2170

              SHA256

              f127030eece82e15a979da5f5f51b4d15d8c6136d1628e4924b4c02955aba3b2

              SHA512

              2527392c1f773c72d16db9045fc31c239f56856f8f6bb8869c1ee9951f9026cb837c93c24e17dc3c7c9d4ecd2a004d2582e28a3d3246a1d0848d16fcf210b752

            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

              Filesize

              999KB

              MD5

              7dce24edd5c32b4c614e52dd5c9ac038

              SHA1

              c7e8d014bb7c9badce13d66befc13364e93767b3

              SHA256

              904258c59302a6bd0ef732f3c9d33f58680829362d4c0431505117d0232265f0

              SHA512

              62981dc3f9576d910744b20bad138736cb6dd197ee3c8af6155eb65a2f18932d04e9f9b26df8cc75aa2966b2d769c5d3df68c3fd0fee157998bec00a4448e019

            • C:\Users\Admin\AppData\Local\Temp\1000022001\28d3272688.exe

              Filesize

              2.6MB

              MD5

              21cf91eed95039c7a28baf8ff87cb0d0

              SHA1

              bb2e15ac74130520bc58542913b9336b81d6bc79

              SHA256

              cccbbd4790f205c6b50db8f744a4db6a848ae30d5a861ccb9c0447e4def69642

              SHA512

              997f390f8940a293b18098ecc575ac309ceae8019fa35e21409bedc93414a8197ca9d6180fe496f382068ad8e69f7e9262dabb249b35b5e14f06b463003ae16e

            • C:\Users\Admin\AppData\Local\Temp\1000022001\28d3272688.exe

              Filesize

              2.1MB

              MD5

              54ff67525dcadb18363d56d04add42b7

              SHA1

              2159fc0a4563a444c369e911bbf5e2d8a94f9237

              SHA256

              ca449e4da5ef008f70d38fd392eeb6ced6357790a2a8ec49e42ed89a0561d2f6

              SHA512

              4f095e4545bbf55249140404e184bcc9f24833c48eb8ff9fc6a77791f1d3ad21f803f80a36bb8a8597607b1a03fbc7a93c4b7035c332a0adaddfd87eaf091756

            • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe

              Filesize

              413KB

              MD5

              d467222c3bd563cb72fa49302f80b079

              SHA1

              9335e2a36abb8309d8a2075faf78d66b968b2a91

              SHA256

              fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

              SHA512

              484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

            • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

              Filesize

              109KB

              MD5

              726cd06231883a159ec1ce28dd538699

              SHA1

              404897e6a133d255ad5a9c26ac6414d7134285a2

              SHA256

              12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

              SHA512

              9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

            • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

              Filesize

              1.2MB

              MD5

              15a42d3e4579da615a384c717ab2109b

              SHA1

              22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

              SHA256

              3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

              SHA512

              1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

            • \Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

              Filesize

              1.9MB

              MD5

              8b176c80a6ff69b7beb12254dfaac8ee

              SHA1

              a51457eb62364526addd00b610cb1e16c7d3918d

              SHA256

              773070e1373913ea1709dde27c293ceca45fa966a83cba6a0483954b94253f78

              SHA512

              2eca1765e9d9ab3859fbcfa444125a396d420e194295ecd6f293e6b9d989de85e7b9fbeffe33590274c85ecdcb6939e81c2856c863a57f668df5b01ca0d66c0e

            • \Users\Admin\AppData\Local\Temp\1000022001\28d3272688.exe

              Filesize

              3.0MB

              MD5

              27a9ce635fc9442693225c3de5ff87c7

              SHA1

              0b3ae30da0d85fea761c10738984dede41990ec8

              SHA256

              78197da4786d151207b1cc66cfcec05ce6f6d900aeda3b48da3dd2b924ee7b89

              SHA512

              d9653cd99bf986c1c1b70e1e2f5c8f1aa3ea8f19a8673345fc6ba141c5ab97a391c734b7bbd08ee882109fb1a10c1ef0f30969fc52d702b98ccc1718fe236686

            • memory/844-87-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

              Filesize

              9.6MB

            • memory/844-83-0x00000000026D0000-0x0000000002750000-memory.dmp

              Filesize

              512KB

            • memory/844-89-0x00000000026D0000-0x0000000002750000-memory.dmp

              Filesize

              512KB

            • memory/844-91-0x00000000026D0000-0x0000000002750000-memory.dmp

              Filesize

              512KB

            • memory/844-93-0x00000000026D0000-0x0000000002750000-memory.dmp

              Filesize

              512KB

            • memory/844-94-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

              Filesize

              9.6MB

            • memory/844-81-0x00000000023A0000-0x00000000023A8000-memory.dmp

              Filesize

              32KB

            • memory/844-72-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

              Filesize

              9.6MB

            • memory/844-71-0x000000001B360000-0x000000001B642000-memory.dmp

              Filesize

              2.9MB

            • memory/1736-5-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

              Filesize

              4KB

            • memory/1736-3-0x0000000000CE0000-0x0000000000CE2000-memory.dmp

              Filesize

              8KB

            • memory/1736-1-0x0000000077E60000-0x0000000077E62000-memory.dmp

              Filesize

              8KB

            • memory/1736-25-0x0000000000CF0000-0x00000000011C3000-memory.dmp

              Filesize

              4.8MB

            • memory/1736-0-0x0000000000CF0000-0x00000000011C3000-memory.dmp

              Filesize

              4.8MB

            • memory/1736-16-0x0000000002C80000-0x0000000002C81000-memory.dmp

              Filesize

              4KB

            • memory/1736-15-0x0000000000670000-0x0000000000671000-memory.dmp

              Filesize

              4KB

            • memory/1736-13-0x00000000027B0000-0x00000000027B1000-memory.dmp

              Filesize

              4KB

            • memory/1736-12-0x0000000000A20000-0x0000000000A21000-memory.dmp

              Filesize

              4KB

            • memory/1736-26-0x00000000066C0000-0x0000000006B93000-memory.dmp

              Filesize

              4.8MB

            • memory/1736-4-0x00000000025E0000-0x00000000025E1000-memory.dmp

              Filesize

              4KB

            • memory/1736-6-0x0000000002790000-0x0000000002791000-memory.dmp

              Filesize

              4KB

            • memory/1736-7-0x0000000000A00000-0x0000000000A01000-memory.dmp

              Filesize

              4KB

            • memory/1736-8-0x0000000000A70000-0x0000000000A71000-memory.dmp

              Filesize

              4KB

            • memory/1736-9-0x0000000000A10000-0x0000000000A11000-memory.dmp

              Filesize

              4KB

            • memory/1736-10-0x0000000000660000-0x0000000000661000-memory.dmp

              Filesize

              4KB

            • memory/1736-11-0x00000000006C0000-0x00000000006C1000-memory.dmp

              Filesize

              4KB

            • memory/1736-2-0x0000000000CF0000-0x00000000011C3000-memory.dmp

              Filesize

              4.8MB

            • memory/2040-129-0x00000000001F0000-0x00000000001F1000-memory.dmp

              Filesize

              4KB

            • memory/2644-35-0x0000000002230000-0x0000000002231000-memory.dmp

              Filesize

              4KB

            • memory/2644-28-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-46-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-47-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-48-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-44-0x0000000002860000-0x0000000002861000-memory.dmp

              Filesize

              4KB

            • memory/2644-70-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-43-0x0000000002810000-0x0000000002811000-memory.dmp

              Filesize

              4KB

            • memory/2644-42-0x0000000002250000-0x0000000002251000-memory.dmp

              Filesize

              4KB

            • memory/2644-40-0x0000000002240000-0x0000000002241000-memory.dmp

              Filesize

              4KB

            • memory/2644-39-0x00000000021E0000-0x00000000021E1000-memory.dmp

              Filesize

              4KB

            • memory/2644-38-0x00000000026F0000-0x00000000026F1000-memory.dmp

              Filesize

              4KB

            • memory/2644-37-0x00000000022B0000-0x00000000022B1000-memory.dmp

              Filesize

              4KB

            • memory/2644-36-0x00000000022A0000-0x00000000022A1000-memory.dmp

              Filesize

              4KB

            • memory/2644-29-0x00000000025E0000-0x00000000025E1000-memory.dmp

              Filesize

              4KB

            • memory/2644-30-0x0000000002600000-0x0000000002601000-memory.dmp

              Filesize

              4KB

            • memory/2644-155-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-31-0x0000000002300000-0x0000000002301000-memory.dmp

              Filesize

              4KB

            • memory/2644-92-0x0000000006230000-0x00000000065D9000-memory.dmp

              Filesize

              3.7MB

            • memory/2644-32-0x0000000002700000-0x0000000002701000-memory.dmp

              Filesize

              4KB

            • memory/2644-33-0x0000000000900000-0x0000000000901000-memory.dmp

              Filesize

              4KB

            • memory/2644-153-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-96-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-34-0x0000000002410000-0x0000000002411000-memory.dmp

              Filesize

              4KB

            • memory/2644-151-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-114-0x0000000009F30000-0x000000000A403000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-45-0x0000000000910000-0x0000000000911000-memory.dmp

              Filesize

              4KB

            • memory/2644-27-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-149-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-135-0x0000000006230000-0x00000000065D9000-memory.dmp

              Filesize

              3.7MB

            • memory/2644-136-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-147-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-138-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-145-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-140-0x0000000009F30000-0x000000000A403000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-141-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/2644-143-0x0000000000230000-0x0000000000703000-memory.dmp

              Filesize

              4.8MB

            • memory/3064-134-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-90-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-139-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-146-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-137-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-148-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-113-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-142-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-144-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-152-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-95-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-154-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-150-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB

            • memory/3064-156-0x0000000000C20000-0x0000000000FC9000-memory.dmp

              Filesize

              3.7MB