amadey | 7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3

General

Target

7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe
Size

1.5MB
MD5

6092d146503c24342463552b8c384723
SHA1

84f74c4cb2ea1bb4080711d0fdef51983e29a7a1
SHA256

7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3
SHA512

c52f11036f538183e0e7437a41dee86b8cd3e67623a67c3690038375adddcc661d654ae5074965ab43fc02c5863cad628530f9583e0c9f0829260a7d64a1e21a
SSDEEP

24576:JtXwJ7WECpfqU0W1FylP40uHupa9xZmqagByL1RwuA4X+xi+KQ2w8:JlwJ7CAWCl3uHupmMqJByk4XX+RQ

Score

10^/10

amadey 18befc evasion themida trojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes

install_dir
908f070dff
install_file
explorku.exe
strings_key
b25a9385246248a95c600f9a061438e1
url_paths
/go34ko8/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorku.exeexplorku.exeexplorku.exe7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exeexplorku.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorku.exeexplorku.exeexplorku.exeexplorku.exe7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe

Executes dropped EXE 4 IoCs

Processes:

explorku.exeexplorku.exeexplorku.exeexplorku.exe

pid process

4268 explorku.exe
1248 explorku.exe
1456 explorku.exe
5076 explorku.exe

pid	process
4268	explorku.exe
1248	explorku.exe
1456	explorku.exe
5076	explorku.exe

Themida packer 48 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/468-0-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-2-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-3-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-1-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-5-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-7-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-6-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-4-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/468-8-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe	themida
behavioral2/memory/4268-22-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-23-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-25-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-30-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-28-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-27-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-26-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-29-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/4268-24-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/468-21-0x0000000000660000-0x0000000000B41000-memory.dmp	themida
behavioral2/memory/4268-31-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-34-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-37-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-36-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-35-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-39-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-42-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-41-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-40-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-38-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1248-44-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-52-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-53-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-55-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-56-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-59-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-58-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-57-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-54-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/1456-60-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-68-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-70-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-72-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-74-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-73-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-71-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-69-0x0000000000B60000-0x0000000001041000-memory.dmp	themida
behavioral2/memory/5076-75-0x0000000000B60000-0x0000000001041000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exeexplorku.exeexplorku.exeexplorku.exeexplorku.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe

Drops file in Windows directory 1 IoCs

Processes:

7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe

description ioc process

File created C:\Windows\Tasks\explorku.job 7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explorku.job	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe

description	pid	process	target process
PID 468 wrote to memory of 4268	468	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe	explorku.exe
PID 468 wrote to memory of 4268	468	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe	explorku.exe
PID 468 wrote to memory of 4268	468	7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe	explorku.exe

C:\Users\Admin\AppData\Local\Temp\7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe
"C:\Users\Admin\AppData\Local\Temp\7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:468

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4268

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1248

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1456

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
Filesize
1.5MB

MD5
6092d146503c24342463552b8c384723

SHA1
84f74c4cb2ea1bb4080711d0fdef51983e29a7a1

SHA256
7acf0213cbe32f250917f7feafd5b60c1abbd34c85a63124c732e0ff4b23dbc3

SHA512
c52f11036f538183e0e7437a41dee86b8cd3e67623a67c3690038375adddcc661d654ae5074965ab43fc02c5863cad628530f9583e0c9f0829260a7d64a1e21a

Download Submit
memory/468-0-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-8-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-1-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-5-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-7-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-6-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-4-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-2-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-21-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/468-3-0x0000000000660000-0x0000000000B41000-memory.dmp

Filesize
4.9MB

Download
memory/1248-36-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-38-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-40-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-41-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-42-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-39-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-35-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-34-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-37-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1248-44-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-58-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-52-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-60-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-54-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-57-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-59-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-56-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-55-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/1456-53-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-30-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-24-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-25-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-31-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-28-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-27-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-22-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-26-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-29-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/4268-23-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-68-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-70-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-72-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-74-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-73-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-71-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-69-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download
memory/5076-75-0x0000000000B60000-0x0000000001041000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads