Analysis
-
max time kernel
1s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
13/05/2024, 23:15
General
-
Target
37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe
-
Size
1.5MB
-
MD5
a155de8690462c0959f2ea4909d882a5
-
SHA1
fdb6464008104acb947d0796f4f39194fd7caa5b
-
SHA256
37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3
-
SHA512
3506261ec12974f0fa0b4d4454f351329c9b740d438ab37c5f5eac8ea7738b69afb6c8a994ee638cd714e3aa9f8900831e38c68ee0bd7ac62ba716ebd2e4499e
-
SSDEEP
24576:xKE/S7xqKnUjVto5Naoqc0sCxYBF87pDjpi9WPpQ45OpY/uMWT7/gV0we:oE/S7xFUJyhqVsZGds9WJ5OK//W/YVZe
Malware Config
Extracted
amadey
4.20
http://5.42.96.141
http://5.42.96.7
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 42 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe"C:\Users\Admin\AppData\Local\Temp\37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
-
-
-
C:\Users\Admin\1000006002\0eb45443fb.exe"C:\Users\Admin\1000006002\0eb45443fb.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5906505cc5818955f1793017c1d83206d
SHA121c7c8ff1b3cd6205d3018da9d449ff30b441db9
SHA2569c3cdb46ca15b7c867ba2fdaab5f4c48e682ef004de8beac75d7da8186da3f1e
SHA512d284c6819762a67058cbc1dc8803a787faec7adb68dd95f082d338882b61f616a40e8db5030d82820e3583a47d14b2ea19719b100c738a7ddd702b46a43f894d
-
Filesize
1.8MB
MD5387a60a7af32e4df90f96085e62eb63d
SHA138bcae57be5abec2a519810313b49d9d5fedfe24
SHA2561b42d4086b500c28579921efe821bd8006d565f0dd40fdba961bda691e2e2973
SHA5121b738060e7ff44657c75dffc7fe4767c77fef4744dfa94415b230796b4b27c6ac5015266bac57b2490c67ea84d961922ea55c192424575f48dbd6b6a40a55c51
-
Filesize
1.2MB
MD5b4f5f331da33f5914179016ededc9fba
SHA1a0f7672543d56271c4075987f26c985e86ef5d77
SHA2566fbc542256f57f4cacede6132c3420c4002dd44d1aa63b2fe3363a6619e894b6
SHA512cef86bc15e8be86540746878eeb29048b48b41946c2b96287208a990652e6f9924fe785881a6d28705c8dfdf7980cba8b45d7375ebee8c1a33be3f23cd65bb25
-
Filesize
1.5MB
MD5a155de8690462c0959f2ea4909d882a5
SHA1fdb6464008104acb947d0796f4f39194fd7caa5b
SHA25637fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3
SHA5123506261ec12974f0fa0b4d4454f351329c9b740d438ab37c5f5eac8ea7738b69afb6c8a994ee638cd714e3aa9f8900831e38c68ee0bd7ac62ba716ebd2e4499e
-
Filesize
8KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB