Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 21:25

General

  • Target

    7dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d.exe

  • Size

    1.9MB

  • MD5

    fc40addc1c7501127359a023fbff7d46

  • SHA1

    923a1d921fc5f0c1495fb44ef35c2d325711eca1

  • SHA256

    7dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d

  • SHA512

    991a418959b0d5338b3381907fe98a08cfb6a7974ec104acfa1544f9b09fbb0bf339cf4b47b49ffab100db10d78035c699571f9ad1eec7d39e4ba85562c3da70

  • SSDEEP

    24576:OK9+nCf7lNbt7jf4o/TfP+crfhRTb+LcVaoiJ82FYbEWQKp1IezN3pcPZha7r+qU:lEmprhhrfTfVsJX3Kp1IICXhTJD4p2

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d.exe
    "C:\Users\Admin\AppData\Local\Temp\7dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4928
  • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
    C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4584
  • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
    C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4140
  • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
    C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

    Filesize

    1.9MB

    MD5

    fc40addc1c7501127359a023fbff7d46

    SHA1

    923a1d921fc5f0c1495fb44ef35c2d325711eca1

    SHA256

    7dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d

    SHA512

    991a418959b0d5338b3381907fe98a08cfb6a7974ec104acfa1544f9b09fbb0bf339cf4b47b49ffab100db10d78035c699571f9ad1eec7d39e4ba85562c3da70

  • memory/3908-47-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/3908-45-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4140-37-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4140-36-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4584-24-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4584-23-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4584-26-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4584-22-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4876-3-0x00000000009B0000-0x0000000000E81000-memory.dmp

    Filesize

    4.8MB

  • memory/4876-15-0x00000000009B0000-0x0000000000E81000-memory.dmp

    Filesize

    4.8MB

  • memory/4876-5-0x00000000009B0000-0x0000000000E81000-memory.dmp

    Filesize

    4.8MB

  • memory/4876-2-0x00000000009B1000-0x00000000009DF000-memory.dmp

    Filesize

    184KB

  • memory/4876-1-0x0000000077974000-0x0000000077976000-memory.dmp

    Filesize

    8KB

  • memory/4876-0-0x00000000009B0000-0x0000000000E81000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-29-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-38-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-28-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-25-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-30-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-31-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-32-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-33-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-34-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-20-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-19-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-27-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-39-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-40-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-41-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-42-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-43-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-18-0x0000000000381000-0x00000000003AF000-memory.dmp

    Filesize

    184KB

  • memory/4928-17-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-48-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB

  • memory/4928-49-0x0000000000380000-0x0000000000851000-memory.dmp

    Filesize

    4.8MB