Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 01:26

General

  • Target

    b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff.exe

  • Size

    1.8MB

  • MD5

    a087201fb2f1a935b37ea293c7378414

  • SHA1

    91b97b7262e239b7db77451ec577cd4cd826f722

  • SHA256

    b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff

  • SHA512

    f226178958168825273bfc0550708974619c6f6c746a311b6af5284bd3dc01155778e0cde31866876d8a216de4550e4b951d381c74eb5dc8321284463ee8defb

  • SSDEEP

    24576:qcD/4AaCf/X4d4L00p5dKNhtAw6UJxsU0joPOpI8hI9wifeptCLbW5Ru9YwDp:R/4At/M4wW8NjATUzwBimpmyTw

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff.exe
    "C:\Users\Admin\AppData\Local\Temp\b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:4952
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          4⤵
            PID:2448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\831553292808_Desktop.zip' -CompressionLevel Optimal
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2716
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:2720

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Unsecured Credentials

    3
    T1552

    Credentials In Files

    2
    T1552.001

    Credentials in Registry

    1
    T1552.002

    Discovery

    Query Registry

    4
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    3
    T1082

    Collection

    Data from Local System

    3
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      Filesize

      1.8MB

      MD5

      a087201fb2f1a935b37ea293c7378414

      SHA1

      91b97b7262e239b7db77451ec577cd4cd826f722

      SHA256

      b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff

      SHA512

      f226178958168825273bfc0550708974619c6f6c746a311b6af5284bd3dc01155778e0cde31866876d8a216de4550e4b951d381c74eb5dc8321284463ee8defb

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5xqpovh.15y.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
      Filesize

      109KB

      MD5

      2afdbe3b99a4736083066a13e4b5d11a

      SHA1

      4d4856cf02b3123ac16e63d4a448cdbcb1633546

      SHA256

      8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

      SHA512

      d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
      Filesize

      1.2MB

      MD5

      92fbdfccf6a63acef2743631d16652a7

      SHA1

      971968b1378dd89d59d7f84bf92f16fc68664506

      SHA256

      b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

      SHA512

      b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

    • memory/1488-79-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-20-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-81-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-78-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-82-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-66-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-65-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-54-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-83-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-84-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-19-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-80-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/1488-22-0x0000000005430000-0x0000000005431000-memory.dmp
      Filesize

      4KB

    • memory/1488-23-0x0000000005410000-0x0000000005411000-memory.dmp
      Filesize

      4KB

    • memory/1488-24-0x0000000005450000-0x0000000005451000-memory.dmp
      Filesize

      4KB

    • memory/1488-21-0x0000000005420000-0x0000000005421000-memory.dmp
      Filesize

      4KB

    • memory/1488-25-0x00000000053F0000-0x00000000053F1000-memory.dmp
      Filesize

      4KB

    • memory/1488-26-0x0000000005400000-0x0000000005401000-memory.dmp
      Filesize

      4KB

    • memory/1488-27-0x0000000005480000-0x0000000005481000-memory.dmp
      Filesize

      4KB

    • memory/1488-28-0x0000000005470000-0x0000000005471000-memory.dmp
      Filesize

      4KB

    • memory/1488-29-0x0000000000230000-0x00000000006EA000-memory.dmp
      Filesize

      4.7MB

    • memory/2716-57-0x0000018740380000-0x0000018740392000-memory.dmp
      Filesize

      72KB

    • memory/2716-58-0x000001873F870000-0x000001873F87A000-memory.dmp
      Filesize

      40KB

    • memory/2716-47-0x000001873F880000-0x000001873F8A2000-memory.dmp
      Filesize

      136KB

    • memory/2716-52-0x00007FFFCC0B0000-0x00007FFFCCB71000-memory.dmp
      Filesize

      10.8MB

    • memory/2716-64-0x00007FFFCC0B0000-0x00007FFFCCB71000-memory.dmp
      Filesize

      10.8MB

    • memory/2716-53-0x0000018727210000-0x0000018727220000-memory.dmp
      Filesize

      64KB

    • memory/2716-55-0x0000018727210000-0x0000018727220000-memory.dmp
      Filesize

      64KB

    • memory/2716-56-0x0000018727210000-0x0000018727220000-memory.dmp
      Filesize

      64KB

    • memory/4952-10-0x0000000005210000-0x0000000005211000-memory.dmp
      Filesize

      4KB

    • memory/4952-0-0x0000000000B00000-0x0000000000FBA000-memory.dmp
      Filesize

      4.7MB

    • memory/4952-11-0x0000000005200000-0x0000000005201000-memory.dmp
      Filesize

      4KB

    • memory/4952-16-0x0000000000B00000-0x0000000000FBA000-memory.dmp
      Filesize

      4.7MB

    • memory/4952-9-0x00000000051E0000-0x00000000051E1000-memory.dmp
      Filesize

      4KB

    • memory/4952-8-0x00000000051D0000-0x00000000051D1000-memory.dmp
      Filesize

      4KB

    • memory/4952-6-0x0000000005190000-0x0000000005191000-memory.dmp
      Filesize

      4KB

    • memory/4952-7-0x00000000051A0000-0x00000000051A1000-memory.dmp
      Filesize

      4KB

    • memory/4952-4-0x00000000051B0000-0x00000000051B1000-memory.dmp
      Filesize

      4KB

    • memory/4952-5-0x00000000051F0000-0x00000000051F1000-memory.dmp
      Filesize

      4KB

    • memory/4952-3-0x00000000051C0000-0x00000000051C1000-memory.dmp
      Filesize

      4KB

    • memory/4952-2-0x0000000000B00000-0x0000000000FBA000-memory.dmp
      Filesize

      4.7MB

    • memory/4952-1-0x00000000778A4000-0x00000000778A6000-memory.dmp
      Filesize

      8KB