Analysis
- max time kernel
163s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
18/04/2024, 09:38
General
- Target ENSIQN0KHEXYPTFZ.exe
- Size 10.0MB
- Sample240418-ll3azshc67
- SHA256 25968163342bed863fc06bd9559d0b6caf0e8f6fbeaca0cbc4d9438d34642930
Malware Config
Extracted
-
amadey
-
4.19
-
http://kindofwelcomeperspective.com
-
install_dir
6f2bbbd7ea
-
install_file
Dctooux.exe
-
strings_key
20324a9a8b834f9495c3cd9f5d1f1b02
-
url_paths
/8BvxwQdec3/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 22 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ENSIQN0KHEXYPTFZ.exe"C:\Users\Admin\AppData\Local\Temp\ENSIQN0KHEXYPTFZ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ftp.exeC:\Windows\SysWOW64\ftp.exe2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000427001\ma.exe"C:\Users\Admin\AppData\Local\Temp\1000427001\ma.exe"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ma.exe
3a143496
3c4b308e
memory/548-29-0x00000000012A0000-0x000000000130F000-memory.dmp
memory/548-31-0x00007FFF3ECF0000-0x00007FFF3EEE5000-memory.dmp
memory/548-32-0x00000000012A0000-0x000000000130F000-memory.dmp
memory/2368-10-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/2368-11-0x0000000000400000-0x0000000000E20000-memory.dmp
memory/2368-12-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/2368-0-0x0000000000400000-0x0000000000E20000-memory.dmp
memory/2368-9-0x00007FFF3ECF0000-0x00007FFF3EEE5000-memory.dmp
memory/2368-8-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/2368-3-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/2368-1-0x0000000000400000-0x0000000000E20000-memory.dmp
memory/3220-83-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-79-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-109-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-107-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-105-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-103-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-64-0x000002095C3D0000-0x000002095C670000-memory.dmp
memory/3220-65-0x0000020976B10000-0x0000020976D2E000-memory.dmp
memory/3220-66-0x00007FFF20500000-0x00007FFF20FC1000-memory.dmp
memory/3220-68-0x000002095CA00000-0x000002095CA10000-memory.dmp
memory/3220-67-0x0000020976D30000-0x0000020976F4E000-memory.dmp
memory/3220-69-0x0000020976F50000-0x000002097716E000-memory.dmp
memory/3220-70-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-71-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-73-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-75-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-77-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-101-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-81-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-99-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-85-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-87-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-89-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-91-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-93-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-95-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3220-97-0x0000020976F50000-0x0000020977168000-memory.dmp
memory/3772-14-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/3772-25-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/3772-17-0x00007FFF3ECF0000-0x00007FFF3EEE5000-memory.dmp
memory/3772-18-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/3772-19-0x0000000073B80000-0x0000000073CFB000-memory.dmp
memory/3772-24-0x0000000073B80000-0x0000000073CFB000-memory.dmp