Analysis
- max time kernel
144s - max time network
127s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
14/05/2024, 01:39
General
- Target 9276280817d21fa73a4c27322909cdfea2bb44235b79ab169bf4f494a23f242f.exe
- Size 1.7MB
- Sample240514-b3c3baef37
- SHA256 9276280817d21fa73a4c27322909cdfea2bb44235b79ab169bf4f494a23f242f
Malware Config
Extracted
-
amadey
-
4.20
-
http://5.42.96.141
-
http://5.42.96.7
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 8 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Themida packer 43 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9276280817d21fa73a4c27322909cdfea2bb44235b79ab169bf4f494a23f242f.exe"C:\Users\Admin\AppData\Local\Temp\9276280817d21fa73a4c27322909cdfea2bb44235b79ab169bf4f494a23f242f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\1000006002\b534dcce8a.exe"C:\Users\Admin\1000006002\b534dcce8a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
b534dcce8a.exe
amers.exe
explorku.exe
memory/748-107-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-114-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-105-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-106-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-110-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-109-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-104-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-108-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/748-111-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2072-61-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/2072-47-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/2072-48-0x00000000773C6000-0x00000000773C8000-memory.dmp
memory/2448-137-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2448-147-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2740-1-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-0-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-19-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-2-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-7-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-4-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-6-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-5-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-3-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2740-8-0x0000000000540000-0x0000000000A93000-memory.dmp
memory/2900-27-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-22-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-21-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-26-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-24-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-29-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-90-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-28-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-23-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2900-25-0x0000000000ED0000-0x0000000001423000-memory.dmp
memory/2984-149-0x0000000000180000-0x000000000062E000-memory.dmp
memory/2984-145-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-92-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-126-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-129-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-100-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-62-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-97-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-95-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-123-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-121-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3096-117-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3220-86-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-89-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-85-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-93-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-81-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-82-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-88-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-87-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-83-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3220-84-0x0000000000B80000-0x0000000001215000-memory.dmp
memory/3884-115-0x0000000000180000-0x000000000062E000-memory.dmp
memory/3884-116-0x0000000000180000-0x000000000062E000-memory.dmp