Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
13-05-2024 18:14
General
-
Target
91a3e5d5507a742f69ab255356307a3bab09064d7ae11aa607709ea1bbd6dec5.exe
-
Size
1.7MB
-
MD5
41d2becde0453ac6f431b0e0a837e29b
-
SHA1
679e1ca3c13a2febe58b504604da1a8d93f650aa
-
SHA256
91a3e5d5507a742f69ab255356307a3bab09064d7ae11aa607709ea1bbd6dec5
-
SHA512
aa421f0ba8485d3a2d8a4af17fc7f1e9c0e6f02e9ccd414d8a6008e4fe04b4f29a274911fb5d7bc4c2c24f68afa8e73bc7ded2bad145fc340db95100c20363e6
-
SSDEEP
24576:56uhTLr7KPNgM3APga4fEg1YmAHOsqZXopzD9mqi72q7g/C1LrQarQLANFhJlw+G:5aPNTqgUqQHkXCD9mtKqvLrlrQ+ny
Malware Config
Extracted
amadey
4.20
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Themida packer 39 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91a3e5d5507a742f69ab255356307a3bab09064d7ae11aa607709ea1bbd6dec5.exe"C:\Users\Admin\AppData\Local\Temp\91a3e5d5507a742f69ab255356307a3bab09064d7ae11aa607709ea1bbd6dec5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD541d2becde0453ac6f431b0e0a837e29b
SHA1679e1ca3c13a2febe58b504604da1a8d93f650aa
SHA25691a3e5d5507a742f69ab255356307a3bab09064d7ae11aa607709ea1bbd6dec5
SHA512aa421f0ba8485d3a2d8a4af17fc7f1e9c0e6f02e9ccd414d8a6008e4fe04b4f29a274911fb5d7bc4c2c24f68afa8e73bc7ded2bad145fc340db95100c20363e6
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB