Analysis
-
max time kernel
292s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
23-05-2024 23:33
Behavioral task
behavioral1
Sample
50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe
Resource
win7-20240220-en
General
-
Target
50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe
-
Size
1.5MB
-
MD5
4097974a2c514d3b1feacd8749e98c3c
-
SHA1
83270abf417c64cc7edfe9270b2b176174d3aca4
-
SHA256
50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315
-
SHA512
9f1e4a659323d4ef80d82023373d714f137aa94417fd672a932a95aa437ea64c8bde0dee9230188327b77ce1f11946dc6045ccf2dfe55fd02071df4a3d37bd4f
-
SSDEEP
49152:XXn4/8uZG3gNtvcAe6q59Q9ITktllPWi9CN:XyG3ceAe6qQyTClleisN
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
Processes:
explorku.exeexplorku.exeexplorku.exeexplorku.exe50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exeexplorku.exeexplorku.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorku.exeexplorku.exeexplorku.exe50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe -
Executes dropped EXE 6 IoCs
Processes:
explorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exepid process 2180 explorku.exe 5104 explorku.exe 4664 explorku.exe 588 explorku.exe 2404 explorku.exe 1268 explorku.exe -
Processes:
resource yara_rule behavioral2/memory/512-0-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-1-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-3-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-4-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-7-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-6-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-2-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/512-5-0x0000000000F60000-0x000000000144F000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe themida behavioral2/memory/512-17-0x0000000000F60000-0x000000000144F000-memory.dmp themida behavioral2/memory/2180-16-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-20-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-21-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-19-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-23-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-24-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-22-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-25-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-28-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-29-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-33-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-35-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-34-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-32-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-31-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2180-27-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-30-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/5104-37-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-45-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-49-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-51-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-50-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-48-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-46-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-47-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-52-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/4664-53-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-62-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-65-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-67-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-68-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-66-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-64-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-63-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-61-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/588-70-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-78-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-80-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-79-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-81-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-83-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-82-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/2404-86-0x0000000001300000-0x00000000017EF000-memory.dmp themida behavioral2/memory/1268-102-0x0000000001300000-0x00000000017EF000-memory.dmp themida -
Processes:
explorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exe50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe -
Drops file in Windows directory 1 IoCs
Processes:
50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exedescription ioc process File created C:\Windows\Tasks\explorku.job 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exedescription pid process target process PID 512 wrote to memory of 2180 512 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe explorku.exe PID 512 wrote to memory of 2180 512 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe explorku.exe PID 512 wrote to memory of 2180 512 50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe explorku.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe"C:\Users\Admin\AppData\Local\Temp\50a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.5MB
MD54097974a2c514d3b1feacd8749e98c3c
SHA183270abf417c64cc7edfe9270b2b176174d3aca4
SHA25650a0b1f13ecc693a781b25c0bfb7e32bd4585bf6cc0c45655331df0d8ed03315
SHA5129f1e4a659323d4ef80d82023373d714f137aa94417fd672a932a95aa437ea64c8bde0dee9230188327b77ce1f11946dc6045ccf2dfe55fd02071df4a3d37bd4f
-
memory/512-0-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-1-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-3-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-4-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-7-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-6-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-2-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-5-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/512-17-0x0000000000F60000-0x000000000144F000-memory.dmpFilesize
4.9MB
-
memory/588-64-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-70-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-61-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-63-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-62-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-66-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-68-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-67-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/588-65-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/1268-102-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-19-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-20-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-16-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-22-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-24-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-27-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-23-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-25-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2180-21-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-81-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-78-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-80-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-79-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-83-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-82-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/2404-86-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-49-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-50-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-45-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-51-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-53-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-52-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-47-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-46-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/4664-48-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-33-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-28-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-35-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-29-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-37-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-30-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-31-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-32-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB
-
memory/5104-34-0x0000000001300000-0x00000000017EF000-memory.dmpFilesize
4.9MB