Analysis
-
max time kernel
143s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:34
Static task
static1
Behavioral task
behavioral1
Sample
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe
Resource
win11-20240426-en
General
-
Target
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe
-
Size
1.8MB
-
MD5
b9b1e4b2d6a24099e21fe77067dd7098
-
SHA1
bc5b3fd64b2ad7215fb8176ab4022ec9c8b664b2
-
SHA256
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350
-
SHA512
a183e65e7f8f50cbc952db6bcd1378d1d68604e355cec3c9cbd7e34acb350a883a3de42764de5cdd91675ca028aa9cd179f61bfb402f07a0af6368d3a351b5d5
-
SSDEEP
49152:O3/bnp8W4MEx3c5tOnhRcns+n5I8MXTeGTp6gg/VSmk:Ojnpzyx3c5Mzcv5I8MX6GTYSf
Malware Config
Extracted
amadey
4.20
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exeexplorta.exeexplorta.exeexplorta.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorta.exeexplorta.exe6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exeexplorta.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe -
Executes dropped EXE 3 IoCs
Processes:
explorta.exeexplorta.exeexplorta.exepid process 1568 explorta.exe 1652 explorta.exe 936 explorta.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exeexplorta.exeexplorta.exeexplorta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Wine 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Wine explorta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exeexplorta.exeexplorta.exeexplorta.exepid process 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe 1568 explorta.exe 1652 explorta.exe 936 explorta.exe -
Drops file in Windows directory 1 IoCs
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exedescription ioc process File created C:\Windows\Tasks\explorta.job 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exeexplorta.exeexplorta.exeexplorta.exepid process 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe 1568 explorta.exe 1568 explorta.exe 1652 explorta.exe 1652 explorta.exe 936 explorta.exe 936 explorta.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exepid process 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exedescription pid process target process PID 2868 wrote to memory of 1568 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe explorta.exe PID 2868 wrote to memory of 1568 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe explorta.exe PID 2868 wrote to memory of 1568 2868 6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe explorta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe"C:\Users\Admin\AppData\Local\Temp\6ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeFilesize
1.8MB
MD5b9b1e4b2d6a24099e21fe77067dd7098
SHA1bc5b3fd64b2ad7215fb8176ab4022ec9c8b664b2
SHA2566ff71066514f9902a3764a55ad402c6e02a80664c2edfd33984f34a61852f350
SHA512a183e65e7f8f50cbc952db6bcd1378d1d68604e355cec3c9cbd7e34acb350a883a3de42764de5cdd91675ca028aa9cd179f61bfb402f07a0af6368d3a351b5d5
-
memory/936-56-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/936-55-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-49-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-60-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-61-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-36-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-37-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-59-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-58-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-57-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-53-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-52-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-24-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-26-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/1568-27-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/1568-25-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/1568-29-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/1568-28-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/1568-31-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1568-51-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-32-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/1568-33-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1568-34-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-35-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-50-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-48-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1568-30-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/1652-44-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/1652-40-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/1652-41-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/1652-39-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1652-43-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/1652-45-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1652-47-0x0000000000410000-0x00000000008D0000-memory.dmpFilesize
4.8MB
-
memory/1652-42-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/2868-3-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/2868-5-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/2868-8-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/2868-7-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/2868-2-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/2868-6-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/2868-1-0x0000000077674000-0x0000000077676000-memory.dmpFilesize
8KB
-
memory/2868-9-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/2868-10-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/2868-23-0x00000000000F0000-0x00000000005B0000-memory.dmpFilesize
4.8MB
-
memory/2868-4-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/2868-0-0x00000000000F0000-0x00000000005B0000-memory.dmpFilesize
4.8MB