amadey | 50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b

General

Target

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
Size

1.7MB
MD5

29e65327491e7fe24b4717c2c70e9331
SHA1

14a90e099d92d9f941784febcaa5fa225596fd86
SHA256

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b
SHA512

0fb8669513fc8ba22961684002ce9762250b0e6fc669248e421562e5d2346aa6d94e898543ef87aee949a3cda1615309f0d51eb10f202ce152e6898a34fe567e
SSDEEP

24576:u3qhCJFQ8LiQ6df1q4K5/2tuNZbhJUU62BYKrTHiNs5INz18l7ajlREUlFvVb:cqoXUnlK5/y6bfUU62dXHJ5hRgEUlF5

Score

10^/10

amadey 0e6740 evasion themida trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

C2

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exeexplortu.exeexplortu.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explortu.exeexplortu.exe50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exeexplortu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe

Executes dropped EXE 3 IoCs

Processes:

explortu.exeexplortu.exeexplortu.exe

pid process

5012 explortu.exe
2768 explortu.exe
4492 explortu.exe

pid	process
5012	explortu.exe
2768	explortu.exe
4492	explortu.exe

Themida packer 36 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/4268-0-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-2-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-3-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-6-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-5-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-4-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-1-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/4268-7-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe	themida
behavioral1/memory/4268-20-0x0000000000770000-0x0000000000CB5000-memory.dmp	themida
behavioral1/memory/5012-21-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-23-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-24-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-25-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-27-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-28-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-26-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-22-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/5012-29-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-33-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-35-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-38-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-40-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-39-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-37-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-36-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-34-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/2768-42-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-50-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-52-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-55-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-54-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-53-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-51-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-56-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida
behavioral1/memory/4492-57-0x0000000000B70000-0x00000000010B5000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exeexplortu.exeexplortu.exeexplortu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explortu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explortu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explortu.exe

Drops file in Windows directory 1 IoCs

Processes:

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe

description ioc process

File created C:\Windows\Tasks\explortu.job 50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explortu.job	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe

description	pid	process	target process
PID 4268 wrote to memory of 5012	4268	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe	explortu.exe
PID 4268 wrote to memory of 5012	4268	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe	explortu.exe
PID 4268 wrote to memory of 5012	4268	50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe	explortu.exe

C:\Users\Admin\AppData\Local\Temp\50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe
"C:\Users\Admin\AppData\Local\Temp\50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5012

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2768

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Filesize
1.7MB

MD5
29e65327491e7fe24b4717c2c70e9331

SHA1
14a90e099d92d9f941784febcaa5fa225596fd86

SHA256
50fb9fbf0ce8ff14f9bf15d9b263b8bad85e8e3be824af60816bf30546811d5b

SHA512
0fb8669513fc8ba22961684002ce9762250b0e6fc669248e421562e5d2346aa6d94e898543ef87aee949a3cda1615309f0d51eb10f202ce152e6898a34fe567e

Download Submit
memory/2768-33-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-42-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-34-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-36-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-37-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-39-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-40-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-38-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/2768-35-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-20-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-0-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-2-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-3-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-6-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-5-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-4-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-1-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4268-7-0x0000000000770000-0x0000000000CB5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-52-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-53-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-57-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-56-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-51-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-54-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-55-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/4492-50-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-24-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-25-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-23-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-27-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-28-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-21-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-26-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-22-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download
memory/5012-29-0x0000000000B70000-0x00000000010B5000-memory.dmp

Filesize
5.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads