Analysis
- max time kernel
145s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
28/03/2024, 18:05
General
- Target 2b4c2adc6535d248c8ea20f2107339102e2215efb6dfbda9110fa7a1c28361aa.exe
- Size 1.8MB
- Sample240328-wpnl4sdd93
- SHA256 2b4c2adc6535d248c8ea20f2107339102e2215efb6dfbda9110fa7a1c28361aa
Malware Config
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4c2adc6535d248c8ea20f2107339102e2215efb6dfbda9110fa7a1c28361aa.exe"C:\Users\Admin\AppData\Local\Temp\2b4c2adc6535d248c8ea20f2107339102e2215efb6dfbda9110fa7a1c28361aa.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000041001\edf416f73d.exe"C:\Users\Admin\AppData\Local\Temp\1000041001\edf416f73d.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\594324687199_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
explorha.exe
edf416f73d.exe
__PSScriptPolicyTest_dciixa5l.bop.ps1
clip64.dll
cred64.dll
memory/1792-116-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/1792-114-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/1792-118-0x0000000005830000-0x0000000005831000-memory.dmp
memory/1792-113-0x0000000005810000-0x0000000005811000-memory.dmp
memory/1792-111-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/1792-110-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/1792-115-0x0000000005840000-0x0000000005841000-memory.dmp
memory/1792-117-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/1792-119-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/1792-112-0x0000000005800000-0x0000000005801000-memory.dmp
memory/2940-89-0x0000000002450000-0x000000000258B000-memory.dmp
memory/2940-65-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2940-91-0x0000000002340000-0x00000000023ED000-memory.dmp
memory/2940-52-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2940-51-0x0000000002450000-0x000000000258B000-memory.dmp
memory/2940-50-0x0000000002340000-0x00000000023ED000-memory.dmp
memory/3092-81-0x00000283FDEB0000-0x00000283FDEBA000-memory.dmp
memory/3092-75-0x00000283FF6A0000-0x00000283FF6C2000-memory.dmp
memory/3092-87-0x00007FFC81870000-0x00007FFC82332000-memory.dmp
memory/3092-80-0x00000283FF670000-0x00000283FF682000-memory.dmp
memory/3092-79-0x0000028398480000-0x0000028398490000-memory.dmp
memory/3092-78-0x0000028398480000-0x0000028398490000-memory.dmp
memory/3092-77-0x0000028398480000-0x0000028398490000-memory.dmp
memory/3092-76-0x00007FFC81870000-0x00007FFC82332000-memory.dmp
memory/3316-107-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-128-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-66-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-26-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/3316-31-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/3316-53-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-30-0x0000000005980000-0x0000000005981000-memory.dmp
memory/3316-29-0x0000000005970000-0x0000000005971000-memory.dmp
memory/3316-28-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/3316-146-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-27-0x0000000005990000-0x0000000005991000-memory.dmp
memory/3316-33-0x00000000059F0000-0x00000000059F1000-memory.dmp
memory/3316-88-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-24-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-90-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-23-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-144-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-103-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-105-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-32-0x0000000005A00000-0x0000000005A01000-memory.dmp
memory/3316-134-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-130-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-25-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/3316-126-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-124-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-122-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3316-120-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3948-133-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3948-142-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/3948-138-0x0000000005370000-0x0000000005371000-memory.dmp
memory/3948-139-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/3948-140-0x0000000005350000-0x0000000005351000-memory.dmp
memory/3948-141-0x0000000005360000-0x0000000005361000-memory.dmp
memory/3948-136-0x0000000005380000-0x0000000005381000-memory.dmp
memory/3948-137-0x0000000005390000-0x0000000005391000-memory.dmp
memory/3948-135-0x0000000000F20000-0x00000000013DE000-memory.dmp
memory/4248-6-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/4248-10-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/4248-9-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/4248-8-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/4248-7-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/4248-4-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/4248-5-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/4248-3-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/4248-1-0x00000000773E6000-0x00000000773E8000-memory.dmp
memory/4248-2-0x00000000001E0000-0x000000000069E000-memory.dmp
memory/4248-22-0x00000000001E0000-0x000000000069E000-memory.dmp
memory/4248-0-0x00000000001E0000-0x000000000069E000-memory.dmp