Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
03/04/2024, 09:27
General
- Target 0795b2783451b8e182b7a13083e984667e59ef9cbd1f541c6264fcc0f386d911.exe
- Size 1.8MB
- Sample240403-lexf6abe3x
- SHA256 0795b2783451b8e182b7a13083e984667e59ef9cbd1f541c6264fcc0f386d911
Malware Config
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0795b2783451b8e182b7a13083e984667e59ef9cbd1f541c6264fcc0f386d911.exe"C:\Users\Admin\AppData\Local\Temp\0795b2783451b8e182b7a13083e984667e59ef9cbd1f541c6264fcc0f386d911.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorha.exe
memory/784-10-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/784-1-0x0000000077A46000-0x0000000077A48000-memory.dmp
memory/784-4-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/784-5-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/784-3-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/784-7-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/784-6-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/784-8-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/784-9-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/784-23-0x0000000000670000-0x0000000000B23000-memory.dmp
memory/784-2-0x0000000000670000-0x0000000000B23000-memory.dmp
memory/784-11-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/784-0-0x0000000000670000-0x0000000000B23000-memory.dmp
memory/1708-63-0x0000000000370000-0x0000000000823000-memory.dmp
memory/1708-62-0x0000000005160000-0x0000000005161000-memory.dmp
memory/1708-61-0x0000000005150000-0x0000000005151000-memory.dmp
memory/1708-60-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/1708-57-0x0000000005180000-0x0000000005181000-memory.dmp
memory/1708-59-0x0000000005170000-0x0000000005171000-memory.dmp
memory/1708-58-0x0000000005190000-0x0000000005191000-memory.dmp
memory/1708-56-0x0000000000370000-0x0000000000823000-memory.dmp
memory/1708-55-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-52-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-30-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/4112-35-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-36-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-37-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-68-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-67-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-66-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-65-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-64-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-24-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-29-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/4112-28-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/4112-34-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-48-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-49-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-50-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-51-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-33-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/4112-53-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-32-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/4112-31-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/4112-25-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4112-26-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/4112-27-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/4996-47-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4996-46-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/4996-45-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/4996-44-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/4996-43-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/4996-41-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/4996-42-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/4996-40-0x0000000000370000-0x0000000000823000-memory.dmp
memory/4996-39-0x0000000000370000-0x0000000000823000-memory.dmp