Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/05/2024, 01:16
General
- Target 3d62073c6642613d8c50498ba63c0b01.exe
- Size 1.6MB
- Sample240507-bmsstseg28
- SHA256 778a0c870cc2ff58b29173cadac9f31962311781a6f478d3086aa9576f25786d
Malware Config
Extracted
-
amadey
-
4.20
-
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 9 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 41 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 63 IoCs
- Suspicious use of SendNotifyMessage 60 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d62073c6642613d8c50498ba63c0b01.exe"C:\Users\Admin\AppData\Local\Temp\3d62073c6642613d8c50498ba63c0b01.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main6⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\906287020291_Desktop.zip' -CompressionLevel Optimal7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000020001\c6d7092604.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\c6d7092604.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\1000021002\721b7eb762.exe"C:\Users\Admin\1000021002\721b7eb762.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cc84ab58,0x7ff8cc84ab68,0x7ff8cc84ab785⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 --field-trial-handle=1864,i,408464029906258638,17416155042096230582,131072 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
721b7eb762.exe
the-real-index
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache~RFe580c20.TMP
amert.exe
c6d7092604.exe
explorta.exe
906287020291_Desktop.zip
OptimizeExpand.docx
SearchTrace.txt
__PSScriptPolicyTest_dvh1ajxs.jy1.ps1
clip64.dll
cred64.dll
memory/1408-109-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-27-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-26-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-24-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-23-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-22-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-21-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-28-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1408-25-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1516-222-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-283-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-61-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-325-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-337-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-163-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-286-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-299-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-240-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-254-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1516-340-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/1680-47-0x0000000077C54000-0x0000000077C56000-memory.dmp
memory/1680-60-0x00000000001B0000-0x000000000066C000-memory.dmp
memory/1680-46-0x00000000001B0000-0x000000000066C000-memory.dmp
memory/1924-251-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-262-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-252-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-258-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-259-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-260-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-261-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-257-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/1924-253-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/2156-7-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-1-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-20-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-4-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-5-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-0-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-2-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-3-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2156-6-0x00000000006B0000-0x0000000000BEA000-memory.dmp
memory/2876-353-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/2876-345-0x0000000000CE0000-0x000000000121A000-memory.dmp
memory/3668-201-0x00000228DDDE0000-0x00000228DDDEA000-memory.dmp
memory/3668-188-0x00000228DDDF0000-0x00000228DDE12000-memory.dmp
memory/3668-200-0x00000228F63E0000-0x00000228F63F2000-memory.dmp
memory/4584-83-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-88-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-164-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-84-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-86-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-82-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-81-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-87-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-85-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4584-80-0x00000000002A0000-0x0000000000922000-memory.dmp
memory/4684-256-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/4684-263-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/4820-344-0x0000000000590000-0x0000000000A4C000-memory.dmp
memory/4820-355-0x0000000000590000-0x0000000000A4C000-memory.dmp