Analysis
- max time kernel
292s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
28/03/2024, 22:42
General
- Target bfaaa91e8792e01743c34c2516b547639f8bf808c06a38fe40dc79411cf121b8.exe
- Size 1.8MB
- Sample240328-2mxpwsbd35
- SHA256 bfaaa91e8792e01743c34c2516b547639f8bf808c06a38fe40dc79411cf121b8
Malware Config
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 6 IoCs
- Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfaaa91e8792e01743c34c2516b547639f8bf808c06a38fe40dc79411cf121b8.exe"C:\Users\Admin\AppData\Local\Temp\bfaaa91e8792e01743c34c2516b547639f8bf808c06a38fe40dc79411cf121b8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\281913400149_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorha.exe
__PSScriptPolicyTest_lforlkdk.rho.ps1
clip64.dll
cred64.dll
memory/784-118-0x0000000005140000-0x0000000005141000-memory.dmp
memory/784-119-0x0000000005120000-0x0000000005121000-memory.dmp
memory/784-120-0x0000000005160000-0x0000000005161000-memory.dmp
memory/784-117-0x0000000005130000-0x0000000005131000-memory.dmp
memory/784-116-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/784-115-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/784-121-0x0000000005100000-0x0000000005101000-memory.dmp
memory/784-123-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/784-122-0x0000000005110000-0x0000000005111000-memory.dmp
memory/2428-9-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/2428-7-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/2428-1-0x0000000077984000-0x0000000077985000-memory.dmp
memory/2428-2-0x0000000000C60000-0x000000000111A000-memory.dmp
memory/2428-3-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/2428-4-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/2428-5-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/2428-19-0x0000000000C60000-0x000000000111A000-memory.dmp
memory/2428-6-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/2428-8-0x00000000011A0000-0x00000000011A1000-memory.dmp
memory/2428-11-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/2428-0-0x0000000000C60000-0x000000000111A000-memory.dmp
memory/2428-12-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/2448-146-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/2448-150-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/2448-148-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/2448-141-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/2448-149-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/2448-142-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/2448-143-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/2448-144-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/2448-145-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/2448-147-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/3144-51-0x0000027E38500000-0x0000027E38510000-memory.dmp
memory/3144-49-0x0000027E20410000-0x0000027E20432000-memory.dmp
memory/3144-112-0x00007FFB7ADA0000-0x00007FFB7B78C000-memory.dmp
memory/3144-90-0x0000027E38750000-0x0000027E38762000-memory.dmp
memory/3144-103-0x0000027E384E0000-0x0000027E384EA000-memory.dmp
memory/3144-77-0x0000027E38500000-0x0000027E38510000-memory.dmp
memory/3144-55-0x0000027E38790000-0x0000027E38806000-memory.dmp
memory/3144-52-0x0000027E38500000-0x0000027E38510000-memory.dmp
memory/3144-50-0x00007FFB7ADA0000-0x00007FFB7B78C000-memory.dmp
memory/3752-175-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/3752-177-0x0000000005360000-0x0000000005361000-memory.dmp
memory/3752-183-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/3752-176-0x0000000005350000-0x0000000005351000-memory.dmp
memory/3752-178-0x0000000005340000-0x0000000005341000-memory.dmp
memory/3752-179-0x0000000005380000-0x0000000005381000-memory.dmp
memory/4140-199-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4248-161-0x0000000004A80000-0x0000000004A81000-memory.dmp
memory/4248-160-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/4248-167-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4248-165-0x0000000004A50000-0x0000000004A51000-memory.dmp
memory/4248-158-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4248-159-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4248-164-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/4248-166-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/4248-162-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/4248-163-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/4328-31-0x0000000005330000-0x0000000005331000-memory.dmp
memory/4328-139-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-138-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-151-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-152-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-153-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-154-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-155-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-156-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-137-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-136-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-135-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-134-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-113-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-48-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-32-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-30-0x0000000005340000-0x0000000005341000-memory.dmp
memory/4328-22-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-23-0x00000000052F0000-0x00000000052F1000-memory.dmp
memory/4328-168-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-169-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-170-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-171-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-172-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-173-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-24-0x0000000005300000-0x0000000005301000-memory.dmp
memory/4328-25-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/4328-28-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/4328-29-0x0000000005310000-0x0000000005311000-memory.dmp
memory/4328-26-0x0000000005320000-0x0000000005321000-memory.dmp
memory/4328-27-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/4328-184-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-185-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-186-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-187-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-188-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-189-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-20-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-200-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-201-0x00000000012C0000-0x000000000177A000-memory.dmp
memory/4328-202-0x00000000012C0000-0x000000000177A000-memory.dmp