Analysis

  • max time kernel
    143s
  • max time network
    122s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-05-2024 12:45

General

  • Target

    cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe

  • Size

    1.8MB

  • MD5

    094b73661371248a9f6dce45d34c12cb

  • SHA1

    2b25339b8454f9e7e1241603a54fca0997799d4e

  • SHA256

    cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d

  • SHA512

    5f0c24d8fc7e19c8c21eeaaf945b827390f3bc170dc1b691a12cec7679982d0987f5b83f047f00564e41791417151e2809306b8ee7cb28e90990e38d7c55f507

  • SSDEEP

    49152:jQfec74YUgeof1P2WjSH7VCn/BT52MaiPB2sN1vcxz:yzrUgem1PzuZCPzPBl1vc

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

C2

http://147.45.47.155

Attributes
  • install_dir

    9217037dc9

  • install_file

    explortu.exe

  • strings_key

    8e894a8a4a3d0da8924003a561cfb244

  • url_paths

    /ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe
    "C:\Users\Admin\AppData\Local\Temp\cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        3⤵
          PID:1648
        • C:\Users\Admin\1000004002\6add99a857.exe
          "C:\Users\Admin\1000004002\6add99a857.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
            "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:1180
        • C:\Users\Admin\AppData\Local\Temp\1000005001\be2f687d35.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\be2f687d35.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:400
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3808
    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1204
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4040
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:708
    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1788

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    3
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\1000004002\6add99a857.exe
      Filesize

      1.8MB

      MD5

      c165996ca2a03c5c04a1af3415011f3f

      SHA1

      ed0d3c849cc0319fa5e595464988b1791f98ed73

      SHA256

      2fba8eea1a026e381ab112213f6fe09173ea37b39e9e65bdbf2b5d995dfbfa8c

      SHA512

      0035a59dec68f398edd338d819b79dea1ca5acf6d7658ac2b40b1340324d82c49cc88c75c88d81fa1352937ea4fded1277c741cf09abf70020190af92fc88a08

    • C:\Users\Admin\AppData\Local\Temp\1000005001\be2f687d35.exe
      Filesize

      2.3MB

      MD5

      7154f7f38c806cfdcf8a593a1a9d29da

      SHA1

      7594597c61090519126c598b29dc3d3c0886c3a9

      SHA256

      3361fe4b6f365b1df2b53472e005ab365ad94be87888f659bdfda3af24dcdf12

      SHA512

      b5acca76aa38024e54a8f78922c160d3c43e53924c26aab81a2627260104ccfedbaf301fcee385d59a15a1bfd3d05b3ac0d3016d8d8b178b23f34e8f2304c6e8

    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      Filesize

      1.8MB

      MD5

      094b73661371248a9f6dce45d34c12cb

      SHA1

      2b25339b8454f9e7e1241603a54fca0997799d4e

      SHA256

      cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d

      SHA512

      5f0c24d8fc7e19c8c21eeaaf945b827390f3bc170dc1b691a12cec7679982d0987f5b83f047f00564e41791417151e2809306b8ee7cb28e90990e38d7c55f507

    • memory/400-97-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-109-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-78-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-121-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-118-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-115-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-112-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-83-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-106-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-131-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-93-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-134-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-90-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/400-86-0x0000000000380000-0x0000000000967000-memory.dmp
      Filesize

      5.9MB

    • memory/708-124-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/708-128-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-95-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-114-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-108-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-133-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-81-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-117-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-130-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-105-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-85-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-87-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-111-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-92-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-89-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-120-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1180-59-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1204-99-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1204-103-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1788-129-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/1788-126-0x0000000000CA0000-0x0000000001167000-memory.dmp
      Filesize

      4.8MB

    • memory/3364-0-0x0000000000E20000-0x00000000012E3000-memory.dmp
      Filesize

      4.8MB

    • memory/3364-17-0x0000000000E20000-0x00000000012E3000-memory.dmp
      Filesize

      4.8MB

    • memory/3364-5-0x0000000000E20000-0x00000000012E3000-memory.dmp
      Filesize

      4.8MB

    • memory/3364-3-0x0000000000E20000-0x00000000012E3000-memory.dmp
      Filesize

      4.8MB

    • memory/3364-2-0x0000000000E21000-0x0000000000E4F000-memory.dmp
      Filesize

      184KB

    • memory/3364-1-0x0000000077D36000-0x0000000077D38000-memory.dmp
      Filesize

      8KB

    • memory/3440-91-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-18-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-107-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-135-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-21-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-110-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-79-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-20-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-113-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-80-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-19-0x0000000000471000-0x000000000049F000-memory.dmp
      Filesize

      184KB

    • memory/3440-116-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-96-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-22-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-119-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-94-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-132-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-122-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-82-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-88-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3440-84-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3808-39-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3808-27-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/3808-26-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/4040-101-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/4040-104-0x0000000000470000-0x0000000000933000-memory.dmp
      Filesize

      4.8MB

    • memory/4116-45-0x0000000000D80000-0x0000000001247000-memory.dmp
      Filesize

      4.8MB

    • memory/4116-58-0x0000000000D80000-0x0000000001247000-memory.dmp
      Filesize

      4.8MB