Overview

overview

10

Static

static

3

#!~#0Pen_9...re.dll

windows7-x64

1

#!~#0Pen_9...re.dll

windows10-2004-x64

1

#!~#0Pen_9...rk.dll

windows7-x64

1

#!~#0Pen_9...rk.dll

windows10-2004-x64

1

#!~#0Pen_9...up.exe

windows7-x64

10

#!~#0Pen_9...up.exe

windows10-2004-x64

10

#!~#0Pen_9...g.pptx

windows7-x64

1

#!~#0Pen_9...g.pptx

windows10-2004-x64

1

#!~#0Pen_9...64.dll

windows7-x64

1

#!~#0Pen_9...64.dll

windows10-2004-x64

1

#!~#0Pen_9...64.dll

windows7-x64

1

#!~#0Pen_9...64.dll

windows10-2004-x64

1

#!~#0Pen_9...40.dll

windows7-x64

1

#!~#0Pen_9...40.dll

windows10-2004-x64

1

#!~#0Pen_9..._1.dll

windows7-x64

1

#!~#0Pen_9..._1.dll

windows10-2004-x64

1

#!~#0Pen_9...64.dll

windows7-x64

1

#!~#0Pen_9...64.dll

windows10-2004-x64

1

#!~#0Pen_9...40.dll

windows7-x64

1

#!~#0Pen_9...40.dll

windows10-2004-x64

1

#!~#0Pen_9..._1.dll

windows7-x64

1

#!~#0Pen_9..._1.dll

windows10-2004-x64

1

#!~#0Pen_9...pp.dll

windows7-x64

1

#!~#0Pen_9...pp.dll

windows10-2004-x64

3

#!~#0Pen_9...1].exe

windows7-x64

1

#!~#0Pen_9...1].exe

windows10-2004-x64

1

#!~#0Pen_9...1].exe

windows7-x64

1

#!~#0Pen_9...1].exe

windows10-2004-x64

3

#!~#0Pen_9...1].exe

windows7-x64

1

#!~#0Pen_9...1].exe

windows10-2004-x64

1

#!~#0Pen_9...-1.dll

windows10-2004-x64

1

#!~#0Pen_9...-0.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    142b855d560838f934e48fd1cc796822.bin
  • Size 14.0MB
  • Sample240616-bdmkfswfmm
  • SHA256 c015d37754dab44ada580faf04f4fc21980f387c0f8b81dbd71b5493d6c6a796
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeystealcvidarxmrigffb1b9discoveryminerspywarestealertrojanupx

Malware Config

Extracted

Family

  • stealc

rc4.plain

Extracted

Family

  • amadey

Version

  • 4.30

Botnet

  • ffb1b9

C2

  • http://proresupdate.com

Attributes
  • install_dir

    4bbb72a446

  • install_file

    Hkbsse.exe

  • strings_key

    1ebbd218121948a356341fff55521237

  • url_paths

    /h9fmdW5/index.php

rc4.plain

Targets

    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/Qt5Core.dll
    • Size 6.0MB
    • SHA256 2e33fe29145a2f13dcb56635eb292f6c25c116e1e14fa081eb728ee04071ae25
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/Qt5Network.dll
    • Size 1.3MB
    • SHA256 739bedcfc8eb860927eb2057474be5b39518aaaa6703f9f85307a432fa1f236e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/Setup.exe
    • Size 5.4MB
    • SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    stealcvidarstealeramadeyxmrigffb1b9discoveryminerspywaretrojanupx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral5behavioral6
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/hogg.pptx
    • Size 85KB
    • SHA256 4db21e4665018a3e6cd03ec1b65f42a1c6c8f8046b3f451a1e025a2013e8203f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/libcrypto-1_1-x64.dll
    • Size 2.7MB
    • SHA256 52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/libssl-1_1-x64.dll
    • Size 669KB
    • SHA256 a0e43cbc4a2d8d39f225abd91980001b7b2b5001e8b2b8292537ae39b17b85d1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/msvcp140.dll
    • Size 564KB
    • SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/msvcp140_1.dll
    • Size 34KB
    • SHA256 a3a1199de32bbbc8318ec33e2e1ce556247d012851e4b367fe853a51e74ce4ee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/steam_api64.dll
    • Size 291KB
    • SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/vcruntime140.dll
    • Size 106KB
    • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/vcruntime140_1.dll
    • Size 48KB
    • SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/vcruntime140_app.dll
    • Size 21KB
    • SHA256 813a447192c4fa7d25d0716b769399546f8bf6b31269dd8ad47f9812008d79e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral23behavioral24
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/x86/HDHelper_[0MB]_[1].exe
    • Size 566KB
    • SHA256 72ece91f65a461c5023695bf5f31b5b6b5bd629dba8407524e8144f6d1e160e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/x86/NvStereoUtilityOGL_[1MB]_[1].exe
    • Size 1.1MB
    • SHA256 c2c71318a17f7f767e5d203d22b48f27eecae46a4f37082d7b413c51da6183b3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral27behavioral28
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/x86/VSLauncher_[0MB]_[1].exe
    • Size 281KB
    • SHA256 87048cff2227d2901314760618d23917cfbc5cc15fc22dc355e803c5ee5fb211
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/x86/api-ms-win-core-processthreads-l1-1-1.dll
    • Size 17KB
    • SHA256 e5ea2c21fb225090f7d0db6c6990d67b1558d8e834e86513bc8ba7a43c4e7b36
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31
    • Target
      #!~#0Pen_9898_P@$SW0rd~!!$/x86/api-ms-win-core-profile-l1-1-0.dll
    • Size 16KB
    • SHA256 d00a0edace14715bf79dbd17b715d8a74a2300f0adb1f3fc137edfb7074c9b0a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

stealcvidarstealer
Score
10/10

behavioral6

amadeystealcvidarxmrigffb1b9discoveryminerspywarestealertrojanupx
Score
10/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
3/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10