Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
23/04/2024, 19:33
General
- Target file.exe
- Size 1.8MB
- Sample240423-x9hr2abc26
- SHA256 f2f647ba7ca2104c8d5aa7130502eb7a48ce1ae629ee33abf1efcc07f172c449
Malware Config
Extracted
-
amadey
-
4.20
-
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorta.exe
memory/1372-44-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/1372-47-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/1372-40-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1372-41-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1372-46-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/1372-45-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/1372-38-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/1372-43-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/1372-42-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/2580-57-0x0000000005530000-0x0000000005531000-memory.dmp
memory/2580-61-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/2580-60-0x0000000005520000-0x0000000005521000-memory.dmp
memory/2580-55-0x0000000005540000-0x0000000005541000-memory.dmp
memory/2580-56-0x0000000005550000-0x0000000005551000-memory.dmp
memory/2580-58-0x0000000005570000-0x0000000005571000-memory.dmp
memory/2580-59-0x0000000005510000-0x0000000005511000-memory.dmp
memory/4420-35-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-21-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-29-0x0000000005430000-0x0000000005431000-memory.dmp
memory/4420-30-0x0000000005460000-0x0000000005461000-memory.dmp
memory/4420-31-0x0000000005450000-0x0000000005451000-memory.dmp
memory/4420-32-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-33-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-34-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-64-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-36-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-27-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/4420-39-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-26-0x0000000005440000-0x0000000005441000-memory.dmp
memory/4420-25-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/4420-23-0x0000000005400000-0x0000000005401000-memory.dmp
memory/4420-24-0x0000000005410000-0x0000000005411000-memory.dmp
memory/4420-63-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-28-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/4420-62-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-54-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-48-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-49-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-50-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-51-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/4420-52-0x0000000000BA0000-0x0000000001062000-memory.dmp
memory/5016-8-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/5016-6-0x0000000005150000-0x0000000005151000-memory.dmp
memory/5016-7-0x0000000005140000-0x0000000005141000-memory.dmp
memory/5016-5-0x0000000005130000-0x0000000005131000-memory.dmp
memory/5016-4-0x0000000005190000-0x0000000005191000-memory.dmp
memory/5016-3-0x0000000005160000-0x0000000005161000-memory.dmp
memory/5016-2-0x0000000005170000-0x0000000005171000-memory.dmp
memory/5016-1-0x00000000776F4000-0x00000000776F6000-memory.dmp
memory/5016-9-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/5016-22-0x0000000000D70000-0x0000000001232000-memory.dmp
memory/5016-0-0x0000000000D70000-0x0000000001232000-memory.dmp