Analysis
-
max time kernel
144s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 09:06
Behavioral task
behavioral1
Sample
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe
Resource
win10v2004-20240426-en
General
-
Target
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe
-
Size
1.7MB
-
MD5
19923fb77b18c695262eadb18567006a
-
SHA1
611694ed4bde95d43f82d0d10b8bb98f69d3f4b0
-
SHA256
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9
-
SHA512
32b9287af25a88fc7f5cdd47e7baf1e9f8a3a96f69de1c7b785856a8025283f836f8205698fb92ab386d4ed9e8dc1bf4340eb325d8bbade8d86e92b7259bf361
-
SSDEEP
49152:2DJc4W46mCQXOfpy2T0r6DGXuhj47IRtEsfXywAHx3:2Vc4W4JipBT0rx+TLEsfnAHx3
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorku.exef90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exeexplorku.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe -
Executes dropped EXE 3 IoCs
Processes:
explorku.exeexplorku.exeexplorku.exepid process 4664 explorku.exe 1504 explorku.exe 4520 explorku.exe -
Processes:
resource yara_rule behavioral1/memory/3636-0-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-1-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-7-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-6-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-5-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-4-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-3-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-2-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/3636-8-0x00000000009D0000-0x0000000000F16000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe themida behavioral1/memory/3636-21-0x00000000009D0000-0x0000000000F16000-memory.dmp themida behavioral1/memory/4664-22-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-25-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-26-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-30-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-28-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-29-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-27-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-24-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-23-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4664-31-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-35-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-37-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-38-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-36-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-40-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-42-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-41-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-39-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-43-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/1504-44-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-53-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-58-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-59-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-57-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-56-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-55-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-54-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-52-0x0000000000880000-0x0000000000DC6000-memory.dmp themida behavioral1/memory/4520-61-0x0000000000880000-0x0000000000DC6000-memory.dmp themida -
Processes:
explorku.exeexplorku.exef90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe -
Drops file in Windows directory 1 IoCs
Processes:
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exedescription ioc process File created C:\Windows\Tasks\explorku.job f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exedescription pid process target process PID 3636 wrote to memory of 4664 3636 f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe explorku.exe PID 3636 wrote to memory of 4664 3636 f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe explorku.exe PID 3636 wrote to memory of 4664 3636 f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe explorku.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe"C:\Users\Admin\AppData\Local\Temp\f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4664
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1504
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.7MB
MD519923fb77b18c695262eadb18567006a
SHA1611694ed4bde95d43f82d0d10b8bb98f69d3f4b0
SHA256f90763fdf6955482060795bb19dee26952e71ebacbfaebbdd6c180368d95b1f9
SHA51232b9287af25a88fc7f5cdd47e7baf1e9f8a3a96f69de1c7b785856a8025283f836f8205698fb92ab386d4ed9e8dc1bf4340eb325d8bbade8d86e92b7259bf361
-
memory/1504-35-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-44-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-43-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-39-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-41-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-42-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-40-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-36-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-38-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/1504-37-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/3636-21-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-0-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-1-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-7-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-6-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-5-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-4-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-3-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-2-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/3636-8-0x00000000009D0000-0x0000000000F16000-memory.dmpFilesize
5.3MB
-
memory/4520-59-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-53-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-61-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-52-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-54-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-55-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-56-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-57-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4520-58-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-27-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-26-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-30-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-25-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-28-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-29-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-22-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-24-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-23-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB
-
memory/4664-31-0x0000000000880000-0x0000000000DC6000-memory.dmpFilesize
5.3MB