Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
07/05/2024, 13:31
General
- Target 5b8ff6346021854ff5e1c2ecdd7fcbe2.exe
- Size 1.7MB
- Sample240507-qsdcnahf2t
- SHA256 0d0ae934e46b821fec45c7e3f4e3baea4e72a038138f3854a56a6f1eb31dfc6c
Malware Config
Extracted
-
amadey
-
4.20
-
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Extracted
-
risepro
-
147.45.47.126:58709
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
-
lumma
-
https://chunkylopsidedwos.shop/api
-
https://acceptabledcooeprs.shop/api
-
https://obsceneclassyjuwks.shop/api
-
https://zippyfinickysofwps.shop/api
-
https://miniaturefinerninewjs.shop/api
-
https://plaintediousidowsko.shop/api
-
https://sweetsquarediaslw.shop/api
-
https://holicisticscrarws.shop/api
-
https://boredimperissvieos.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 11 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 37 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 63 IoCs
- Suspicious use of SendNotifyMessage 60 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b8ff6346021854ff5e1c2ecdd7fcbe2.exe"C:\Users\Admin\AppData\Local\Temp\5b8ff6346021854ff5e1c2ecdd7fcbe2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000103001\conhost.exe"C:\Users\Admin\AppData\Local\Temp\1000103001\conhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"6⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main6⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\775195409080_Desktop.zip' -CompressionLevel Optimal7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000020001\a4c9ca5dae.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\a4c9ca5dae.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\1000021002\2e07beeefe.exe"C:\Users\Admin\1000021002\2e07beeefe.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffda352cc40,0x7ffda352cc4c,0x7ffda352cc585⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1912 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2172 /prefetch:35⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2452 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3132 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3180 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4624 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4716 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4764,i,10736034728032418260,5336833631181170850,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4832 /prefetch:85⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
2e07beeefe.exe
BrowsingTopicsState
the-real-index
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
amert.exe
a4c9ca5dae.exe
conhost.exe
explorta.exe
__PSScriptPolicyTest_pk4i4yuq.zmx.ps1
clip64.dll
cred64.dll
memory/392-22-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-23-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-78-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-26-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-27-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-28-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-29-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-184-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-30-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-25-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/392-24-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/1560-215-0x0000000000380000-0x0000000000836000-memory.dmp
memory/1560-271-0x0000000000380000-0x0000000000836000-memory.dmp
memory/1560-105-0x0000000000380000-0x0000000000836000-memory.dmp
memory/1804-6-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-7-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-2-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-4-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-5-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-1-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-21-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-8-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-0-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1804-3-0x0000000000990000-0x0000000000EE1000-memory.dmp
memory/1992-117-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-118-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-122-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-121-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-124-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-216-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-123-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-116-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-120-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/1992-119-0x0000000000DA0000-0x0000000001430000-memory.dmp
memory/2032-207-0x0000000000400000-0x000000000045C000-memory.dmp
memory/2032-209-0x0000000000400000-0x000000000045C000-memory.dmp
memory/2504-104-0x0000000000C00000-0x00000000010B6000-memory.dmp
memory/2504-79-0x0000000000C00000-0x00000000010B6000-memory.dmp
memory/2620-205-0x00007FF77EB90000-0x00007FF77EF27000-memory.dmp
memory/2620-208-0x00007FF77EB90000-0x00007FF77EF27000-memory.dmp
memory/4924-43-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-60-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-81-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-83-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-82-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-62-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-64-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-67-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-68-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-69-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-70-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-66-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-65-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-63-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-40-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-41-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-54-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-55-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-58-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-36-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-59-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-80-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-37-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/4924-33-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-267-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-61-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-56-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-57-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-53-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-38-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-39-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-42-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/4924-52-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/5264-389-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/5276-382-0x0000000000380000-0x0000000000836000-memory.dmp
memory/5276-391-0x0000000000380000-0x0000000000836000-memory.dmp
memory/5484-261-0x000001FD6B2A0000-0x000001FD6B2AA000-memory.dmp
memory/5484-260-0x000001FD6B2C0000-0x000001FD6B2D2000-memory.dmp
memory/5484-250-0x000001FD52B40000-0x000001FD52B62000-memory.dmp
memory/6012-310-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/6012-304-0x0000000000D20000-0x0000000001271000-memory.dmp
memory/6020-312-0x0000000000380000-0x0000000000836000-memory.dmp
memory/6020-300-0x0000000000380000-0x0000000000836000-memory.dmp