Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/04/2024, 17:25

General

  • Target

    217534469e02f0637a69df31094188ed270d523f9259140b2cfaa3c74ff87854.exe

  • Size

    1.8MB

  • MD5

    8facf6d258ba6125d842d5e0d5469bfb

  • SHA1

    4374fc7f57ea001165cdcf36bbc6f6015203ef05

  • SHA256

    217534469e02f0637a69df31094188ed270d523f9259140b2cfaa3c74ff87854

  • SHA512

    41c9e23c7b29c8901bd7fcf3932f44144116faa5505c33e0572d4c2b6ef687ddda8b77559cc4187007abcdb74620d1740c3075b9601c39a700a17f792555de8f

  • SSDEEP

    24576:hUzyuEf7LB7EMsFYxUoPXvwRUJIu9iYOBlyId1NW/0j6qUYAliVNbr6wHMb2Mjs2:kyuoBUFgQSJR9fOr3qO6q/dDHCsEJVd

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\217534469e02f0637a69df31094188ed270d523f9259140b2cfaa3c74ff87854.exe
    "C:\Users\Admin\AppData\Local\Temp\217534469e02f0637a69df31094188ed270d523f9259140b2cfaa3c74ff87854.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4476
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          4⤵
            PID:4128
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zip' -CompressionLevel Optimal
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5032
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:4020

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

            Filesize

            1.8MB

            MD5

            8facf6d258ba6125d842d5e0d5469bfb

            SHA1

            4374fc7f57ea001165cdcf36bbc6f6015203ef05

            SHA256

            217534469e02f0637a69df31094188ed270d523f9259140b2cfaa3c74ff87854

            SHA512

            41c9e23c7b29c8901bd7fcf3932f44144116faa5505c33e0572d4c2b6ef687ddda8b77559cc4187007abcdb74620d1740c3075b9601c39a700a17f792555de8f

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_531baetu.ovt.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

            Filesize

            109KB

            MD5

            154c3f1334dd435f562672f2664fea6b

            SHA1

            51dd25e2ba98b8546de163b8f26e2972a90c2c79

            SHA256

            5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

            SHA512

            1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

          • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

            Filesize

            1.2MB

            MD5

            f35b671fda2603ec30ace10946f11a90

            SHA1

            059ad6b06559d4db581b1879e709f32f80850872

            SHA256

            83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

            SHA512

            b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

          • memory/1932-77-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-20-0x0000000005640000-0x0000000005641000-memory.dmp

            Filesize

            4KB

          • memory/1932-52-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-76-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-75-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-79-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-63-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-62-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-80-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-18-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-19-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-78-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-21-0x0000000005650000-0x0000000005651000-memory.dmp

            Filesize

            4KB

          • memory/1932-22-0x0000000005670000-0x0000000005671000-memory.dmp

            Filesize

            4KB

          • memory/1932-23-0x0000000005610000-0x0000000005611000-memory.dmp

            Filesize

            4KB

          • memory/1932-24-0x0000000005630000-0x0000000005631000-memory.dmp

            Filesize

            4KB

          • memory/1932-25-0x0000000005620000-0x0000000005621000-memory.dmp

            Filesize

            4KB

          • memory/1932-26-0x00000000056A0000-0x00000000056A1000-memory.dmp

            Filesize

            4KB

          • memory/1932-27-0x0000000005690000-0x0000000005691000-memory.dmp

            Filesize

            4KB

          • memory/1932-28-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-81-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/1932-82-0x0000000000D30000-0x00000000011F2000-memory.dmp

            Filesize

            4.8MB

          • memory/4476-15-0x0000000000EB0000-0x0000000001372000-memory.dmp

            Filesize

            4.8MB

          • memory/4476-7-0x00000000057D0000-0x00000000057D1000-memory.dmp

            Filesize

            4KB

          • memory/4476-1-0x00000000777F6000-0x00000000777F8000-memory.dmp

            Filesize

            8KB

          • memory/4476-2-0x0000000000EB0000-0x0000000001372000-memory.dmp

            Filesize

            4.8MB

          • memory/4476-4-0x0000000005810000-0x0000000005811000-memory.dmp

            Filesize

            4KB

          • memory/4476-3-0x0000000005800000-0x0000000005801000-memory.dmp

            Filesize

            4KB

          • memory/4476-6-0x0000000005830000-0x0000000005831000-memory.dmp

            Filesize

            4KB

          • memory/4476-5-0x00000000057F0000-0x00000000057F1000-memory.dmp

            Filesize

            4KB

          • memory/4476-0-0x0000000000EB0000-0x0000000001372000-memory.dmp

            Filesize

            4.8MB

          • memory/4476-10-0x0000000005850000-0x0000000005851000-memory.dmp

            Filesize

            4KB

          • memory/4476-9-0x0000000005860000-0x0000000005861000-memory.dmp

            Filesize

            4KB

          • memory/4476-8-0x00000000057E0000-0x00000000057E1000-memory.dmp

            Filesize

            4KB

          • memory/5032-61-0x00007FFF14B10000-0x00007FFF155D2000-memory.dmp

            Filesize

            10.8MB

          • memory/5032-50-0x00007FFF14B10000-0x00007FFF155D2000-memory.dmp

            Filesize

            10.8MB

          • memory/5032-55-0x0000021CCF460000-0x0000021CCF46A000-memory.dmp

            Filesize

            40KB

          • memory/5032-54-0x0000021CCF650000-0x0000021CCF662000-memory.dmp

            Filesize

            72KB

          • memory/5032-53-0x0000021CB7110000-0x0000021CB7120000-memory.dmp

            Filesize

            64KB

          • memory/5032-49-0x0000021CCF470000-0x0000021CCF492000-memory.dmp

            Filesize

            136KB

          • memory/5032-51-0x0000021CB7110000-0x0000021CB7120000-memory.dmp

            Filesize

            64KB