Analysis
- max time kernel
146s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
28/05/2024, 11:35
General
- Target 1f97d3413e4e3982dac52ea1447e302be4b8a63bb3ea53f752fc8d9d146cdad9.exe
- Size 1.8MB
- Sample240528-np9kkshc2s
- SHA256 1f97d3413e4e3982dac52ea1447e302be4b8a63bb3ea53f752fc8d9d146cdad9
Malware Config
Extracted
-
amadey
-
4.21
-
0e6740
-
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
-
amadey
-
4.21
-
49e482
-
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 10 IoCs
- Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f97d3413e4e3982dac52ea1447e302be4b8a63bb3ea53f752fc8d9d146cdad9.exe"C:\Users\Admin\AppData\Local\Temp\1f97d3413e4e3982dac52ea1447e302be4b8a63bb3ea53f752fc8d9d146cdad9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
-
C:\Users\Admin\1000004002\f9e6e58663.exe"C:\Users\Admin\1000004002\f9e6e58663.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\4141cf359c.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\4141cf359c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
f9e6e58663.exe
4141cf359c.exe
explortu.exe
memory/664-86-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-117-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-97-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-93-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-114-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-123-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-90-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-100-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-102-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-52-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-120-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-85-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-127-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-111-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/664-74-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/1300-134-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/1300-130-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/1468-81-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/1468-84-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/2344-79-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/2344-83-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/2532-110-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/2532-108-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/2620-1-0x00000000770A6000-0x00000000770A8000-memory.dmp
memory/2620-5-0x0000000000E00000-0x00000000012B3000-memory.dmp
memory/2620-2-0x0000000000E01000-0x0000000000E2F000-memory.dmp
memory/2620-0-0x0000000000E00000-0x00000000012B3000-memory.dmp
memory/2620-17-0x0000000000E00000-0x00000000012B3000-memory.dmp
memory/2620-3-0x0000000000E00000-0x00000000012B3000-memory.dmp
memory/2784-51-0x0000000000690000-0x0000000000B46000-memory.dmp
memory/2784-38-0x0000000000690000-0x0000000000B46000-memory.dmp
memory/3100-132-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/3100-135-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/3484-119-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-125-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-98-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-122-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-92-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-101-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-89-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-88-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-113-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-95-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-105-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-76-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-116-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-128-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3484-72-0x0000000000A40000-0x0000000001041000-memory.dmp
memory/3612-109-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/3612-106-0x00000000007A0000-0x0000000000C56000-memory.dmp
memory/4792-73-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-115-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-112-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-104-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-99-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-118-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-96-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-121-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-94-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-91-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-124-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-87-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-126-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-77-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-75-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-71-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-20-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-19-0x0000000000B70000-0x0000000001023000-memory.dmp
memory/4792-18-0x0000000000B70000-0x0000000001023000-memory.dmp