Analysis
- max time kernel
145s - max time network
116s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
30/05/2024, 19:02
General
- Target c82cd3daf8a70011e5efccddbb6bdb9c9fb10d55f28b0adac39154f063ce7e47.exe
- Size 1.8MB
- Sample240530-xpvabsgc5v
- SHA256 c82cd3daf8a70011e5efccddbb6bdb9c9fb10d55f28b0adac39154f063ce7e47
Malware Config
Extracted
-
amadey
-
4.21
-
0e6740
-
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
-
amadey
-
4.21
-
49e482
-
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 8 IoCs
- Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c82cd3daf8a70011e5efccddbb6bdb9c9fb10d55f28b0adac39154f063ce7e47.exe"C:\Users\Admin\AppData\Local\Temp\c82cd3daf8a70011e5efccddbb6bdb9c9fb10d55f28b0adac39154f063ce7e47.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
-
C:\Users\Admin\1000004002\8ec064ff94.exe"C:\Users\Admin\1000004002\8ec064ff94.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\b884fd2282.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\b884fd2282.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
8ec064ff94.exe
b884fd2282.exe
explortu.exe
memory/976-103-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-115-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-97-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-94-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-18-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-19-0x00000000002C1000-0x00000000002EF000-memory.dmp
memory/976-20-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-21-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-24-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-25-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-26-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-27-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-28-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-29-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-121-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-100-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-118-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-46-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-89-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-86-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/976-112-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/2344-59-0x0000000000A40000-0x0000000000F06000-memory.dmp
memory/2344-45-0x0000000000A40000-0x0000000000F06000-memory.dmp
memory/2524-99-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-96-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-123-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-114-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-106-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-102-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-78-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-88-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-93-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-92-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-117-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/2524-120-0x0000000000890000-0x0000000000EA0000-memory.dmp
memory/3688-109-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/3688-111-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/3760-95-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-91-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-90-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-87-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-101-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-113-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-104-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-122-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-119-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-116-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-60-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3760-98-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/3868-85-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/3868-83-0x00000000002C0000-0x0000000000782000-memory.dmp
memory/4416-110-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/4416-107-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/4448-81-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/4448-84-0x0000000000660000-0x0000000000B26000-memory.dmp
memory/4880-0-0x0000000000E60000-0x0000000001322000-memory.dmp
memory/4880-17-0x0000000000E60000-0x0000000001322000-memory.dmp
memory/4880-5-0x0000000000E60000-0x0000000001322000-memory.dmp
memory/4880-3-0x0000000000E60000-0x0000000001322000-memory.dmp
memory/4880-2-0x0000000000E61000-0x0000000000E8F000-memory.dmp
memory/4880-1-0x00000000772C6000-0x00000000772C8000-memory.dmp