Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 07:08

General

  • Target

    b1f147ef5fbdda670b5d98188bf085838598897cb5b09d316000071995bb185f.exe

  • Size

    1.9MB

  • MD5

    0e007067234be3bc281e4e48e6429670

  • SHA1

    fd5273480e0c75916ea0f80cd9a7f8140991dfff

  • SHA256

    b1f147ef5fbdda670b5d98188bf085838598897cb5b09d316000071995bb185f

  • SHA512

    fe93c1f3e37533a5d9f7fbecef2503e1725a239248b42c15e6cafcf9113fe93709baf7526ccba61d7313bc4d8fd8c739033085a720bc62bb10f5980edd9b8103

  • SSDEEP

    49152:dlYvtgoIhBvcFOtW9l0RjqvMj4Y4c9wsdxbgUYxWax:PWtgBUC+0R2vRY4VBU

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1f147ef5fbdda670b5d98188bf085838598897cb5b09d316000071995bb185f.exe
    "C:\Users\Admin\AppData\Local\Temp\b1f147ef5fbdda670b5d98188bf085838598897cb5b09d316000071995bb185f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3432
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:576
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3144
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          4⤵
            PID:4072
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\115692303659_Desktop.zip' -CompressionLevel Optimal
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4052
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:2896

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Unsecured Credentials

    3
    T1552

    Credentials In Files

    2
    T1552.001

    Credentials in Registry

    1
    T1552.002

    Discovery

    Query Registry

    4
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    3
    T1082

    Collection

    Data from Local System

    3
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
      Filesize

      1.9MB

      MD5

      0e007067234be3bc281e4e48e6429670

      SHA1

      fd5273480e0c75916ea0f80cd9a7f8140991dfff

      SHA256

      b1f147ef5fbdda670b5d98188bf085838598897cb5b09d316000071995bb185f

      SHA512

      fe93c1f3e37533a5d9f7fbecef2503e1725a239248b42c15e6cafcf9113fe93709baf7526ccba61d7313bc4d8fd8c739033085a720bc62bb10f5980edd9b8103

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dcgrz2ud.b5p.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
      Filesize

      109KB

      MD5

      154c3f1334dd435f562672f2664fea6b

      SHA1

      51dd25e2ba98b8546de163b8f26e2972a90c2c79

      SHA256

      5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

      SHA512

      1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

    • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
      Filesize

      1.2MB

      MD5

      f35b671fda2603ec30ace10946f11a90

      SHA1

      059ad6b06559d4db581b1879e709f32f80850872

      SHA256

      83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

      SHA512

      b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

    • memory/3048-60-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-80-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-81-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-28-0x00000000053D0000-0x00000000053D1000-memory.dmp
      Filesize

      4KB

    • memory/3048-79-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-78-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-77-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-76-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-29-0x00000000053C0000-0x00000000053C1000-memory.dmp
      Filesize

      4KB

    • memory/3048-75-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-20-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-21-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-22-0x0000000005380000-0x0000000005381000-memory.dmp
      Filesize

      4KB

    • memory/3048-23-0x0000000005390000-0x0000000005391000-memory.dmp
      Filesize

      4KB

    • memory/3048-24-0x0000000005370000-0x0000000005371000-memory.dmp
      Filesize

      4KB

    • memory/3048-25-0x00000000053B0000-0x00000000053B1000-memory.dmp
      Filesize

      4KB

    • memory/3048-26-0x0000000005350000-0x0000000005351000-memory.dmp
      Filesize

      4KB

    • memory/3048-27-0x0000000005360000-0x0000000005361000-memory.dmp
      Filesize

      4KB

    • memory/3048-74-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-73-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-61-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3048-30-0x0000000000990000-0x0000000000E69000-memory.dmp
      Filesize

      4.8MB

    • memory/3432-7-0x0000000004C50000-0x0000000004C51000-memory.dmp
      Filesize

      4KB

    • memory/3432-6-0x0000000004C30000-0x0000000004C31000-memory.dmp
      Filesize

      4KB

    • memory/3432-4-0x0000000004C70000-0x0000000004C71000-memory.dmp
      Filesize

      4KB

    • memory/3432-17-0x00000000002B0000-0x0000000000789000-memory.dmp
      Filesize

      4.8MB

    • memory/3432-2-0x00000000002B0000-0x0000000000789000-memory.dmp
      Filesize

      4.8MB

    • memory/3432-3-0x0000000004C60000-0x0000000004C61000-memory.dmp
      Filesize

      4KB

    • memory/3432-5-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
      Filesize

      4KB

    • memory/3432-9-0x0000000004C90000-0x0000000004C91000-memory.dmp
      Filesize

      4KB

    • memory/3432-0-0x00000000002B0000-0x0000000000789000-memory.dmp
      Filesize

      4.8MB

    • memory/3432-1-0x00000000772F4000-0x00000000772F6000-memory.dmp
      Filesize

      8KB

    • memory/3432-10-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
      Filesize

      4KB

    • memory/3432-11-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
      Filesize

      4KB

    • memory/3432-8-0x0000000004C40000-0x0000000004C41000-memory.dmp
      Filesize

      4KB

    • memory/4052-52-0x000001DB69950000-0x000001DB69972000-memory.dmp
      Filesize

      136KB

    • memory/4052-54-0x000001DB6BB40000-0x000001DB6BB4A000-memory.dmp
      Filesize

      40KB

    • memory/4052-53-0x000001DB6BB60000-0x000001DB6BB72000-memory.dmp
      Filesize

      72KB