Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240319-en
  • resource tags

    arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/03/2024, 01:50

General

  • Target

    c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee.exe

  • Size

    1.8MB

  • MD5

    2bb882f05824de9a479e3b8351cdf58d

  • SHA1

    153c24fd281341558e3c307a3c13fcf78a30071b

  • SHA256

    c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee

  • SHA512

    3742e1d6919e2f4c68f34bcebb43d189e7f28323a5a8fd4d081f12957fc319842c2592d191f99f4f28997ad566c67d7d4b75e42e657ce4ab4bca6ad89bc9001c

  • SSDEEP

    49152:dMpkyAxbCDuZJfaJqYvdL3bRHhfJi2K1GFlE:+tAxbCqZCqYVL3b1RJv0GE

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee.exe
    "C:\Users\Admin\AppData\Local\Temp\c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:236
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5728
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5724
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          4⤵
            PID:1952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\233663403127_Desktop.zip' -CompressionLevel Optimal
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5376
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:3664
      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
        "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:968

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

            Filesize

            1.8MB

            MD5

            2bb882f05824de9a479e3b8351cdf58d

            SHA1

            153c24fd281341558e3c307a3c13fcf78a30071b

            SHA256

            c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee

            SHA512

            3742e1d6919e2f4c68f34bcebb43d189e7f28323a5a8fd4d081f12957fc319842c2592d191f99f4f28997ad566c67d7d4b75e42e657ce4ab4bca6ad89bc9001c

          • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

            Filesize

            1024KB

            MD5

            8f216f946becf1a5083d738f5af6c913

            SHA1

            0f6f77e898482476b850d613dbe8c2b98626315e

            SHA256

            f9d83a881ae8541c5be30b13b24dbfeb688df14a83680d5a4df2f1f242a2dc7a

            SHA512

            982a77b5ad1bcf02e88523dc080e9bf12960b0af4aff383b7e3717abe98601da01adafa32ede1729b99bc35721461915f34289c520b631b469da9a9195859914

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0okmttqq.rqr.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

            Filesize

            109KB

            MD5

            2afdbe3b99a4736083066a13e4b5d11a

            SHA1

            4d4856cf02b3123ac16e63d4a448cdbcb1633546

            SHA256

            8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

            SHA512

            d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

          • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

            Filesize

            1.2MB

            MD5

            92fbdfccf6a63acef2743631d16652a7

            SHA1

            971968b1378dd89d59d7f84bf92f16fc68664506

            SHA256

            b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

            SHA512

            b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

          • memory/236-3-0x0000000004C80000-0x0000000004C81000-memory.dmp

            Filesize

            4KB

          • memory/236-2-0x00000000000C0000-0x000000000056B000-memory.dmp

            Filesize

            4.7MB

          • memory/236-4-0x0000000004C70000-0x0000000004C71000-memory.dmp

            Filesize

            4KB

          • memory/236-1-0x0000000077726000-0x0000000077728000-memory.dmp

            Filesize

            8KB

          • memory/236-6-0x0000000004C50000-0x0000000004C51000-memory.dmp

            Filesize

            4KB

          • memory/236-7-0x0000000004C60000-0x0000000004C61000-memory.dmp

            Filesize

            4KB

          • memory/236-5-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

            Filesize

            4KB

          • memory/236-8-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

            Filesize

            4KB

          • memory/236-9-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

            Filesize

            4KB

          • memory/236-14-0x00000000000C0000-0x000000000056B000-memory.dmp

            Filesize

            4.7MB

          • memory/236-0-0x00000000000C0000-0x000000000056B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-78-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-17-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-20-0x0000000004D30000-0x0000000004D31000-memory.dmp

            Filesize

            4KB

          • memory/580-21-0x0000000004D10000-0x0000000004D11000-memory.dmp

            Filesize

            4KB

          • memory/580-22-0x0000000004D50000-0x0000000004D51000-memory.dmp

            Filesize

            4KB

          • memory/580-23-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

            Filesize

            4KB

          • memory/580-24-0x0000000004D00000-0x0000000004D01000-memory.dmp

            Filesize

            4KB

          • memory/580-26-0x0000000004D70000-0x0000000004D71000-memory.dmp

            Filesize

            4KB

          • memory/580-25-0x0000000004D80000-0x0000000004D81000-memory.dmp

            Filesize

            4KB

          • memory/580-27-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-40-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-62-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-122-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-121-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-120-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-19-0x0000000004D20000-0x0000000004D21000-memory.dmp

            Filesize

            4KB

          • memory/580-83-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-82-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-80-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-18-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-74-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-75-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-76-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/580-77-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/968-109-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-105-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-123-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-119-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-86-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-90-0x0000000000EA0000-0x000000000134B000-memory.dmp

            Filesize

            4.7MB

          • memory/968-89-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-91-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-92-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-93-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-94-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-95-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-96-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-97-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-98-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-99-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-100-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-102-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-101-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-103-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-104-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-118-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-106-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-107-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-108-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-117-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-110-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-111-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-113-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-112-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-114-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-115-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/968-116-0x0000000000400000-0x000000000090F000-memory.dmp

            Filesize

            5.1MB

          • memory/5376-52-0x00000208A3AF0000-0x00000208A3B00000-memory.dmp

            Filesize

            64KB

          • memory/5376-55-0x00000208A3AA0000-0x00000208A3AAA000-memory.dmp

            Filesize

            40KB

          • memory/5376-53-0x00000208A3AF0000-0x00000208A3B00000-memory.dmp

            Filesize

            64KB

          • memory/5376-51-0x00000208A3AF0000-0x00000208A3B00000-memory.dmp

            Filesize

            64KB

          • memory/5376-50-0x00007FFD0B9E0000-0x00007FFD0C4A2000-memory.dmp

            Filesize

            10.8MB

          • memory/5376-46-0x000002088B990000-0x000002088B9B2000-memory.dmp

            Filesize

            136KB

          • memory/5376-54-0x00000208A3AC0000-0x00000208A3AD2000-memory.dmp

            Filesize

            72KB

          • memory/5376-61-0x00007FFD0B9E0000-0x00007FFD0C4A2000-memory.dmp

            Filesize

            10.8MB