amadey | 65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3

General

Target

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
Size

1.9MB
MD5

cf02058ce59cb0d1f9e9f3146316717f
SHA1

9c276c5d673ad974c0c49e55be5e1952100bbc56
SHA256

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3
SHA512

5a46d5055bd3e5c94e7214f7600d578cdeadb6de9a4adce17f8d7afb2bc51c35a995fd94d6f16ea7be9b1f5862f6cd7add5d18b7e80b6fc60286041acecdafd7
SSDEEP

49152:V3/bnL0qZ+XLHP19pmfybjyCIaIzRGuyW2/iC2Xxx9lB:VjnLnYXx90abbI3Dy/iC2Xr

Score

10^/10

amadey evasion trojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorta.exeexplorta.exe65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe

Executes dropped EXE 6 IoCs

Processes:

explorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exe

pid process

688 explorta.exe
3632 explorta.exe
5008 explorta.exe
3476 explorta.exe
4888 explorta.exe
2972 explorta.exe

pid	process
688	explorta.exe
3632	explorta.exe
5008	explorta.exe
3476	explorta.exe
4888	explorta.exe
2972	explorta.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorta.exe65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exe

pid	process
4196	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
688	explorta.exe
3632	explorta.exe
5008	explorta.exe
3476	explorta.exe
4888	explorta.exe
2972	explorta.exe

Drops file in Windows directory 1 IoCs

Processes:

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe

description ioc process

File created C:\Windows\Tasks\explorta.job 65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explorta.job	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exeexplorta.exe

pid	process
4196	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
4196	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
688	explorta.exe
688	explorta.exe
3632	explorta.exe
3632	explorta.exe
5008	explorta.exe
5008	explorta.exe
3476	explorta.exe
3476	explorta.exe
4888	explorta.exe
4888	explorta.exe
2972	explorta.exe
2972	explorta.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe

description	pid	process	target process
PID 4196 wrote to memory of 688	4196	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe	explorta.exe
PID 4196 wrote to memory of 688	4196	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe	explorta.exe
PID 4196 wrote to memory of 688	4196	65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe	explorta.exe

C:\Users\Admin\AppData\Local\Temp\65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe
"C:\Users\Admin\AppData\Local\Temp\65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:688

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3632

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5008

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4888

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2972

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
Filesize
1.9MB

MD5
cf02058ce59cb0d1f9e9f3146316717f

SHA1
9c276c5d673ad974c0c49e55be5e1952100bbc56

SHA256
65b13c88ba108bc85331d8fd4c92b5f84d48e63f612085a73eaec353f821ccc3

SHA512
5a46d5055bd3e5c94e7214f7600d578cdeadb6de9a4adce17f8d7afb2bc51c35a995fd94d6f16ea7be9b1f5862f6cd7add5d18b7e80b6fc60286041acecdafd7

Download Submit
memory/688-58-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-36-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-74-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-73-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-72-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-71-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-70-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-67-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-66-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-65-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-64-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-20-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-25-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/688-26-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/688-24-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/688-23-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/688-22-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/688-21-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/688-28-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/688-27-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/688-63-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-62-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-33-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-34-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-35-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-57-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-39-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-38-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-37-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-56-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-55-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-44-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-45-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-46-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-47-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-48-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-49-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-54-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/688-53-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/2972-69-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/3476-52-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/3476-51-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/3632-32-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/3632-30-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/4196-4-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/4196-7-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/4196-0-0x0000000001130000-0x0000000001603000-memory.dmp

Filesize
4.8MB

Download
memory/4196-19-0x0000000001130000-0x0000000001603000-memory.dmp

Filesize
4.8MB

Download
memory/4196-2-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/4196-9-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/4196-10-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/4196-1-0x0000000077C14000-0x0000000077C15000-memory.dmp

Filesize
4KB

Download
memory/4196-3-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/4196-5-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/4196-6-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/4888-61-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/4888-60-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/5008-43-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download
memory/5008-41-0x0000000001050000-0x0000000001523000-memory.dmp

Filesize
4.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads