Resubmissions

27-04-2024 17:18

240427-vvfysadg4x 10

27-04-2024 13:30

240427-qr4hfsca2v 10

Analysis

  • max time kernel
    3s
  • max time network
    5s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27-04-2024 17:18

General

  • Target

    c81600b4e9f10f09529b539f4440225522777ad2d6b58400e4081f3117af7b12.exe

  • Size

    1.8MB

  • MD5

    00d2b75c4c3e234c8576a67d24849596

  • SHA1

    d5badbb62b2adbcef7e01b3b5bd342d11c09cdb5

  • SHA256

    c81600b4e9f10f09529b539f4440225522777ad2d6b58400e4081f3117af7b12

  • SHA512

    0fa5377df174c92130fea3352e60a9571e6724c39fb5397a94d93d84fec3b044ad3935a1ba5ab9243a66d2b5dc02756aeb087118e6a7097b810c01da6813cd7d

  • SSDEEP

    49152:g3/bnubds8ARZks8cBX2uYpSRFtbq9XHO:gjnu72QRGt

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c81600b4e9f10f09529b539f4440225522777ad2d6b58400e4081f3117af7b12.exe
    "C:\Users\Admin\AppData\Local\Temp\c81600b4e9f10f09529b539f4440225522777ad2d6b58400e4081f3117af7b12.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

    Filesize

    1.8MB

    MD5

    00d2b75c4c3e234c8576a67d24849596

    SHA1

    d5badbb62b2adbcef7e01b3b5bd342d11c09cdb5

    SHA256

    c81600b4e9f10f09529b539f4440225522777ad2d6b58400e4081f3117af7b12

    SHA512

    0fa5377df174c92130fea3352e60a9571e6724c39fb5397a94d93d84fec3b044ad3935a1ba5ab9243a66d2b5dc02756aeb087118e6a7097b810c01da6813cd7d

  • memory/2536-35-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/2536-31-0x0000000000E20000-0x0000000000E21000-memory.dmp

    Filesize

    4KB

  • memory/2536-43-0x0000000000970000-0x0000000000971000-memory.dmp

    Filesize

    4KB

  • memory/2536-29-0x0000000000F30000-0x00000000013E9000-memory.dmp

    Filesize

    4.7MB

  • memory/2536-44-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

  • memory/2536-45-0x0000000002A00000-0x0000000002A01000-memory.dmp

    Filesize

    4KB

  • memory/2536-46-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2536-41-0x00000000006D0000-0x00000000006D1000-memory.dmp

    Filesize

    4KB

  • memory/2536-40-0x0000000000460000-0x0000000000461000-memory.dmp

    Filesize

    4KB

  • memory/2536-37-0x0000000000A40000-0x0000000000A41000-memory.dmp

    Filesize

    4KB

  • memory/2536-39-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/2536-38-0x0000000000B50000-0x0000000000B51000-memory.dmp

    Filesize

    4KB

  • memory/2536-36-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/2536-34-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2536-33-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/2536-30-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

    Filesize

    4KB

  • memory/2536-32-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

    Filesize

    4KB

  • memory/3040-8-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/3040-0-0x00000000009E0000-0x0000000000E99000-memory.dmp

    Filesize

    4.7MB

  • memory/3040-25-0x0000000007040000-0x00000000074F9000-memory.dmp

    Filesize

    4.7MB

  • memory/3040-3-0x0000000002760000-0x0000000002761000-memory.dmp

    Filesize

    4KB

  • memory/3040-4-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/3040-17-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/3040-16-0x0000000002360000-0x0000000002361000-memory.dmp

    Filesize

    4KB

  • memory/3040-14-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/3040-15-0x0000000002970000-0x0000000002971000-memory.dmp

    Filesize

    4KB

  • memory/3040-2-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/3040-7-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/3040-6-0x0000000000950000-0x0000000000951000-memory.dmp

    Filesize

    4KB

  • memory/3040-28-0x00000000009E0000-0x0000000000E99000-memory.dmp

    Filesize

    4.7MB

  • memory/3040-9-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/3040-10-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/3040-11-0x0000000002380000-0x0000000002381000-memory.dmp

    Filesize

    4KB

  • memory/3040-12-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/3040-5-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/3040-1-0x0000000077E00000-0x0000000077E02000-memory.dmp

    Filesize

    8KB