Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 02:14

General

  • Target

    4404db31fa92a0ed3c3f8578f3f1d3992428f84b5b5aba4572acd39d194e8a22.exe

  • Size

    1.8MB

  • MD5

    4f536e229f67740ba94aa84353c5752d

  • SHA1

    4c92d375db8f1f208f92d6aa73b9c2969dbd38e4

  • SHA256

    4404db31fa92a0ed3c3f8578f3f1d3992428f84b5b5aba4572acd39d194e8a22

  • SHA512

    cfe3196b93d805d1f0597677892b9ca178c50ed0689f324e84a73a436c4e41d108869a29bab0aabd7942afcf803f2e3cdc7fdf357f7ddca2ab86c05c53eff35a

  • SSDEEP

    49152:SVro5A0GsNjweltYGBRCQ8BYJ5de7rBEPdVs7jr2:hG0zjwe3YuCGJPexEPdujK

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4404db31fa92a0ed3c3f8578f3f1d3992428f84b5b5aba4572acd39d194e8a22.exe
    "C:\Users\Admin\AppData\Local\Temp\4404db31fa92a0ed3c3f8578f3f1d3992428f84b5b5aba4572acd39d194e8a22.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:3892
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          4⤵
            PID:4472
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1388
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:3604
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4572

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      2
      T1552.001

      Credentials in Registry

      1
      T1552.002

      Discovery

      Query Registry

      4
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      3
      T1082

      Collection

      Data from Local System

      3
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
        Filesize

        1.3MB

        MD5

        00491c484745d9a9a4732adf272f4600

        SHA1

        08d3c7b67912f527940bb835b65af23d3049382a

        SHA256

        e65370bbea636eef8c896cbbd13796f139af910c9e0e156d17ddaa75d00592e1

        SHA512

        4612983e3ad5f2b7e5c78be2ac2e4ad879c829a89c02386f5f374b11ab3eeb447c27bdd7f215cbe0d36cf3c2426413562e3d2a22cdf51f827883de05d2a0302d

      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
        Filesize

        1.2MB

        MD5

        9c18bcd8581022c566d0e244b12b2226

        SHA1

        4befb7c2c033159d560ae5c73cbd683d4f8e2352

        SHA256

        dcdb1f54e1e231aa7f039c9bb0b261f54c70f07064a62a1084c3047697b108cf

        SHA512

        763d7a455d02da1b6902db6f21ac95dafaac7cf27a1aa650d972b384e867b06ccb989f22b3fe938ec5dc041bcc866332714ba564a8597af5458c5367ad995d43

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtdjwxma.r2g.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
        Filesize

        109KB

        MD5

        2afdbe3b99a4736083066a13e4b5d11a

        SHA1

        4d4856cf02b3123ac16e63d4a448cdbcb1633546

        SHA256

        8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

        SHA512

        d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
        Filesize

        1.2MB

        MD5

        92fbdfccf6a63acef2743631d16652a7

        SHA1

        971968b1378dd89d59d7f84bf92f16fc68664506

        SHA256

        b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

        SHA512

        b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
        Filesize

        1.1MB

        MD5

        16bfad66fcdd1716f47e3345bd0dcd6f

        SHA1

        50a2ea644fb9be60277c1a310cf39a767c3fdaf9

        SHA256

        4b11966fe30d57794ca430135eb1729c9d0e5d552e86198d70e71a3723b1fa56

        SHA512

        b5f7b10b181a3b0b3d269a96436a6d57965f2270a1effb60ef54cddb1a6f496f0a7bc5fa4d1505683050d35c6f128036aa5bbf073658e474402b8afe6e5f0871

      • memory/1388-63-0x00007FFC3B8F0000-0x00007FFC3C3B1000-memory.dmp
        Filesize

        10.8MB

      • memory/1388-42-0x0000026D62AC0000-0x0000026D62AE2000-memory.dmp
        Filesize

        136KB

      • memory/1388-57-0x0000026D4A980000-0x0000026D4A98A000-memory.dmp
        Filesize

        40KB

      • memory/1388-56-0x0000026D62E30000-0x0000026D62E42000-memory.dmp
        Filesize

        72KB

      • memory/1388-54-0x0000026D62AB0000-0x0000026D62AC0000-memory.dmp
        Filesize

        64KB

      • memory/1388-53-0x0000026D62AB0000-0x0000026D62AC0000-memory.dmp
        Filesize

        64KB

      • memory/1388-52-0x00007FFC3B8F0000-0x00007FFC3C3B1000-memory.dmp
        Filesize

        10.8MB

      • memory/3460-77-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-78-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-19-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-20-0x0000000004A40000-0x0000000004A41000-memory.dmp
        Filesize

        4KB

      • memory/3460-21-0x0000000004A50000-0x0000000004A51000-memory.dmp
        Filesize

        4KB

      • memory/3460-22-0x0000000004A30000-0x0000000004A31000-memory.dmp
        Filesize

        4KB

      • memory/3460-23-0x0000000004A80000-0x0000000004A81000-memory.dmp
        Filesize

        4KB

      • memory/3460-24-0x0000000004A10000-0x0000000004A11000-memory.dmp
        Filesize

        4KB

      • memory/3460-26-0x0000000004A70000-0x0000000004A71000-memory.dmp
        Filesize

        4KB

      • memory/3460-25-0x0000000004A20000-0x0000000004A21000-memory.dmp
        Filesize

        4KB

      • memory/3460-27-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
        Filesize

        4KB

      • memory/3460-28-0x0000000004A90000-0x0000000004A91000-memory.dmp
        Filesize

        4KB

      • memory/3460-29-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-87-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-86-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-85-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-84-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-83-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-82-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-81-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-55-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-80-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-79-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-18-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-64-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3460-65-0x00000000000E0000-0x0000000000593000-memory.dmp
        Filesize

        4.7MB

      • memory/3892-1-0x0000000077C34000-0x0000000077C36000-memory.dmp
        Filesize

        8KB

      • memory/3892-7-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
        Filesize

        4KB

      • memory/3892-0-0x0000000000730000-0x0000000000BE3000-memory.dmp
        Filesize

        4.7MB

      • memory/3892-8-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
        Filesize

        4KB

      • memory/3892-9-0x0000000004F60000-0x0000000004F61000-memory.dmp
        Filesize

        4KB

      • memory/3892-10-0x0000000004F50000-0x0000000004F51000-memory.dmp
        Filesize

        4KB

      • memory/3892-15-0x0000000000730000-0x0000000000BE3000-memory.dmp
        Filesize

        4.7MB

      • memory/3892-6-0x0000000004F30000-0x0000000004F31000-memory.dmp
        Filesize

        4KB

      • memory/3892-2-0x0000000000730000-0x0000000000BE3000-memory.dmp
        Filesize

        4.7MB

      • memory/3892-4-0x0000000004F10000-0x0000000004F11000-memory.dmp
        Filesize

        4KB

      • memory/3892-3-0x0000000004F00000-0x0000000004F01000-memory.dmp
        Filesize

        4KB

      • memory/3892-5-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
        Filesize

        4KB