Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
03/04/2024, 08:42
General
- Target f5be9e6c908d3ea5a1ab0de7183aec4a7eff08881063c1b423aac4649f943fa5.exe
- Size 1.8MB
- Sample240403-kma3fsbg23
- SHA256 f5be9e6c908d3ea5a1ab0de7183aec4a7eff08881063c1b423aac4649f943fa5
Malware Config
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5be9e6c908d3ea5a1ab0de7183aec4a7eff08881063c1b423aac4649f943fa5.exe"C:\Users\Admin\AppData\Local\Temp\f5be9e6c908d3ea5a1ab0de7183aec4a7eff08881063c1b423aac4649f943fa5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorha.exe
memory/1632-40-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/1632-42-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/1632-36-0x0000000000180000-0x0000000000644000-memory.dmp
memory/1632-37-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/1632-38-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/1632-39-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/1632-35-0x0000000000180000-0x0000000000644000-memory.dmp
memory/1632-41-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/1632-43-0x0000000004F50000-0x0000000004F51000-memory.dmp
memory/1632-44-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2104-74-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/2104-75-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/2104-69-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2104-68-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2104-71-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/2104-70-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/2104-72-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/2104-76-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2104-73-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/2604-25-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/2604-63-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-32-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-33-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-30-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/2604-29-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/2604-28-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/2604-27-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/2604-66-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-26-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/2604-24-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/2604-23-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-65-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-21-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-45-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-46-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-47-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-48-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-49-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-51-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-64-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-31-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-62-0x0000000000180000-0x0000000000644000-memory.dmp
memory/2604-61-0x0000000000180000-0x0000000000644000-memory.dmp
memory/4140-6-0x0000000005460000-0x0000000005461000-memory.dmp
memory/4140-9-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/4140-1-0x00000000772A6000-0x00000000772A8000-memory.dmp
memory/4140-2-0x0000000000D90000-0x0000000001254000-memory.dmp
memory/4140-3-0x0000000005490000-0x0000000005491000-memory.dmp
memory/4140-4-0x0000000005480000-0x0000000005481000-memory.dmp
memory/4140-5-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/4140-8-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/4140-22-0x0000000000D90000-0x0000000001254000-memory.dmp
memory/4140-0-0x0000000000D90000-0x0000000001254000-memory.dmp
memory/4140-7-0x0000000005470000-0x0000000005471000-memory.dmp
memory/4732-54-0x0000000004B10000-0x0000000004B11000-memory.dmp
memory/4732-57-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/4732-53-0x0000000000180000-0x0000000000644000-memory.dmp
memory/4732-55-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/4732-56-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/4732-52-0x0000000000180000-0x0000000000644000-memory.dmp
memory/4732-60-0x0000000000180000-0x0000000000644000-memory.dmp
memory/4732-59-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/4732-58-0x0000000004AF0000-0x0000000004AF1000-memory.dmp