Analysis
-
max time kernel
292s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
23-05-2024 23:51
Behavioral task
behavioral1
Sample
5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe
Resource
win7-20240221-en
General
-
Target
5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe
-
Size
1.7MB
-
MD5
3d1f43d1bde15490b0e82ba37445276e
-
SHA1
2882f75016eb37fa9399fb466c8e307068f4aca4
-
SHA256
5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43
-
SHA512
31827806e35f867983bab69e1e98c680602e15e3e3e431ceb302dbca2e864896185ee796dfde17bb401bbcf8c4f583ee727afc1a360ecf5e9d020eefbc7b3923
-
SSDEEP
24576:9XHn7i3MWNhePJBqRzdDGk7QUy3CihbBVHoMCPWJkmmfHQleKtTtR5wpfwio5s:RH7i3LN8PzUZDyT5c+mfyNBtR5w17Ws
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
Processes:
explorku.exe5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorku.exeexplorku.exeexplorku.exe5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe -
Executes dropped EXE 6 IoCs
Processes:
explorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exepid process 212 explorku.exe 4456 explorku.exe 1252 explorku.exe 5048 explorku.exe 688 explorku.exe 2180 explorku.exe -
Processes:
resource yara_rule behavioral2/memory/1768-0-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-2-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-3-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-1-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-6-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-7-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-5-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/1768-4-0x0000000000C30000-0x000000000117E000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe themida behavioral2/memory/1768-17-0x0000000000C30000-0x000000000117E000-memory.dmp themida behavioral2/memory/212-19-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-22-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-24-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-25-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-21-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-23-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-20-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-18-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/212-26-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-30-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-33-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-36-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-37-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-35-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-34-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-32-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-31-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/4456-38-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-46-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-48-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-49-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-51-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-52-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-50-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-47-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-53-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/1252-54-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-63-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-64-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-62-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-65-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-67-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-66-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-68-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/5048-69-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/688-78-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/688-79-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/688-77-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/688-80-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/688-85-0x0000000000C50000-0x000000000119E000-memory.dmp themida behavioral2/memory/2180-101-0x0000000000C50000-0x000000000119E000-memory.dmp themida -
Processes:
explorku.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exe5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe -
Drops file in Windows directory 1 IoCs
Processes:
5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exedescription ioc process File created C:\Windows\Tasks\explorku.job 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exedescription pid process target process PID 1768 wrote to memory of 212 1768 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe explorku.exe PID 1768 wrote to memory of 212 1768 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe explorku.exe PID 1768 wrote to memory of 212 1768 5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe explorku.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe"C:\Users\Admin\AppData\Local\Temp\5ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.7MB
MD53d1f43d1bde15490b0e82ba37445276e
SHA12882f75016eb37fa9399fb466c8e307068f4aca4
SHA2565ed0f760e6fc2b7d02f85dc1ac055f46fc43cf0fcefc44a27f2942b3e8fb0c43
SHA51231827806e35f867983bab69e1e98c680602e15e3e3e431ceb302dbca2e864896185ee796dfde17bb401bbcf8c4f583ee727afc1a360ecf5e9d020eefbc7b3923
-
memory/212-20-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-19-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-21-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-25-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-24-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-26-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-18-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-22-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/212-23-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/688-78-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/688-85-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/688-80-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/688-79-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/688-77-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-54-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-53-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-50-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-52-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-51-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-47-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-49-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-48-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1252-46-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/1768-2-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-7-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-0-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-17-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-6-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-1-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-3-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-5-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/1768-4-0x0000000000C30000-0x000000000117E000-memory.dmpFilesize
5.3MB
-
memory/2180-101-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-34-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-32-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-31-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-30-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-33-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-38-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-36-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-37-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/4456-35-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-62-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-69-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-68-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-66-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-67-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-65-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-64-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB
-
memory/5048-63-0x0000000000C50000-0x000000000119E000-memory.dmpFilesize
5.3MB