Analysis

  • max time kernel
    141s
  • max time network
    130s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-04-2024 04:52

General

  • Target

    ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe

  • Size

    1.8MB

  • MD5

    d0593c9c56d1f897206d9e748570a458

  • SHA1

    7d9311edff37e0a3ff87b4a6f29ff132455cb86e

  • SHA256

    ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6

  • SHA512

    caec9aaa4467af46efc31b86e0a6acb2edc08e3ea64fc286cdc02d84fd804160d4fd01d383c900238e93e66900185e75ca495735d6054a5e7a693ecb62004309

  • SSDEEP

    49152:STq1WoYcSibgIlCRMu6a8ge+aWstKFbUELMfpiL7Gj4:0ibg/NCDKBLMf9

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe
    "C:\Users\Admin\AppData\Local\Temp\ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2012
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3088

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    Filesize

    1.8MB

    MD5

    d0593c9c56d1f897206d9e748570a458

    SHA1

    7d9311edff37e0a3ff87b4a6f29ff132455cb86e

    SHA256

    ea58b781b3e142012c522bc21df755b13f267eb652a8f0a2cfb21c4739e666b6

    SHA512

    caec9aaa4467af46efc31b86e0a6acb2edc08e3ea64fc286cdc02d84fd804160d4fd01d383c900238e93e66900185e75ca495735d6054a5e7a693ecb62004309

  • memory/2012-5-0x0000000005260000-0x0000000005261000-memory.dmp
    Filesize

    4KB

  • memory/2012-2-0x0000000000F50000-0x00000000013F9000-memory.dmp
    Filesize

    4.7MB

  • memory/2012-8-0x0000000005240000-0x0000000005241000-memory.dmp
    Filesize

    4KB

  • memory/2012-7-0x0000000005210000-0x0000000005211000-memory.dmp
    Filesize

    4KB

  • memory/2012-6-0x0000000005200000-0x0000000005201000-memory.dmp
    Filesize

    4KB

  • memory/2012-0-0x0000000000F50000-0x00000000013F9000-memory.dmp
    Filesize

    4.7MB

  • memory/2012-4-0x0000000005220000-0x0000000005221000-memory.dmp
    Filesize

    4KB

  • memory/2012-3-0x0000000005230000-0x0000000005231000-memory.dmp
    Filesize

    4KB

  • memory/2012-9-0x0000000005290000-0x0000000005291000-memory.dmp
    Filesize

    4KB

  • memory/2012-10-0x0000000005280000-0x0000000005281000-memory.dmp
    Filesize

    4KB

  • memory/2012-16-0x0000000000F50000-0x00000000013F9000-memory.dmp
    Filesize

    4.7MB

  • memory/2012-1-0x0000000077736000-0x0000000077738000-memory.dmp
    Filesize

    8KB

  • memory/3088-22-0x0000000004B20000-0x0000000004B21000-memory.dmp
    Filesize

    4KB

  • memory/3088-28-0x0000000004B80000-0x0000000004B81000-memory.dmp
    Filesize

    4KB

  • memory/3088-21-0x0000000004B30000-0x0000000004B31000-memory.dmp
    Filesize

    4KB

  • memory/3088-19-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-24-0x0000000004B00000-0x0000000004B01000-memory.dmp
    Filesize

    4KB

  • memory/3088-23-0x0000000004B60000-0x0000000004B61000-memory.dmp
    Filesize

    4KB

  • memory/3088-25-0x0000000004B10000-0x0000000004B11000-memory.dmp
    Filesize

    4KB

  • memory/3088-26-0x0000000004B40000-0x0000000004B41000-memory.dmp
    Filesize

    4KB

  • memory/3088-27-0x0000000004B90000-0x0000000004B91000-memory.dmp
    Filesize

    4KB

  • memory/3088-20-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-29-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-30-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-31-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-32-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-33-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-34-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-35-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-36-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-37-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB

  • memory/3088-38-0x0000000000CE0000-0x0000000001189000-memory.dmp
    Filesize

    4.7MB