Overview

overview

8

Static

static

5

AMTEmu-202...er.exe

windows7-x64

7

AMTEmu-202...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    137s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 23:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AMTEmu-2024-Universal-Patcher.exe
  • Size 1.5MB
  • Sample240603-3skg7aed73
  • SHA256 5761e0a37a846b17d677454c4142a1c3ec9625dd5222085e71fe652b446baaba
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
evasionexecution

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in Program Files directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AMTEmu-2024-Universal-Patcher.exe
    "C:\Users\Admin\AppData\Local\Temp\AMTEmu-2024-Universal-Patcher.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
      PowerShell Set-ExecutionPolicy Bypass -scope Process -Force;(Get-NetRoute | Where-Object DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where-Object ConnectionState -eq 'Connected') -ne $null
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5228
    • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
      PowerShell Set-ExecutionPolicy Bypass -scope Process -Force;$ips=@();$soa=(Resolve-DnsName -Name adobe.io -Type SOA).PrimaryServer;Do{$ip=(Resolve-DnsName -Name adobe.io -Server $soa).IPAddress;$ips+=$ip;$ips=$ips|Select -Unique|Sort-Object}While($ips.Count -lt 8);$list=$ips -join ',';$list
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5252
    • C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall delete rule name="Adobe Unlicensed Pop-up"
      2⤵
      • Modifies Windows Firewall
      PID:5948
    • C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Adobe Unlicensed Pop-up" dir=out action=block remoteip="107.22.247.231,18.207.85.246,23.22.254.206,34.193.227.236,52.202.204.11,52.5.13.197,54.144.73.197,54.227.187.23"
      2⤵
      • Modifies Windows Firewall
      PID:4616
    • C:\Windows\Temp\RunAsTI.exe
      C:\Windows\Temp\RunAsTI.exe "C:\Users\Admin\AppData\Local\Temp\AMTEmu-2024-Universal-Patcher.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4432
      • C:\Windows\Temp\RunAsTI.exe
        /t /t C:\Users\Admin\AppData\Local\Temp\AMTEmu-2024-Universal-Patcher.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2008
        • C:\Users\Admin\AppData\Local\Temp\AMTEmu-2024-Universal-Patcher.exe
          "C:\Users\Admin\AppData\Local\Temp\AMTEmu-2024-Universal-Patcher.exe"
          4⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:4188

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PowerShell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
        • Size 3KB
        • SHA256 3db8aa9632b299e222b6707bda1258eaf7bde9bfe93b647ae81f9695af9b8ef7
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b1d866605782b52ef51e87a8ff0b86eaa90166cb63355542018f2e880a5b8189
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_vexaas4u.ae0.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vexaas4u.ae0.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\config.ini
        • Size 4KB
        • SHA256 1b880dffb2bf903c82deac05d21e4636f0a0cb814ff3a3ef8b0722b8b8c659cd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RunAsTI.exe
        • Path C:\Windows\Temp\RunAsTI.exe
        • Size 26KB
        • SHA256 a3e0ba70ba908de8a75825c3a1ff36147e02c686280993c2caa8a9a6968764b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/5228-10-0x00007FFA573C3000-0x00007FFA573C5000-memory.dmp
        Download

        memory/5228-12-0x000001B1EE0F0000-0x000001B1EE112000-memory.dmp
        Download

        memory/5228-11-0x00007FFA573C0000-0x00007FFA57E81000-memory.dmp
        Download

        memory/5228-22-0x00007FFA573C0000-0x00007FFA57E81000-memory.dmp
        Download

        memory/5228-25-0x00007FFA573C0000-0x00007FFA57E81000-memory.dmp
        Download

        memory/5252-37-0x000001D729A90000-0x000001D729AA0000-memory.dmp
        Download

        memory/5252-38-0x000001D72BC70000-0x000001D72BC8A000-memory.dmp
        Download