Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    71s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/06/2024, 21:52 UTC

General

  • Target

    8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a.exe

  • Size

    1.8MB

  • MD5

    6c7e43bbf75184c3057fe13366dab2ae

  • SHA1

    32933ffb55922dead5ea5f798f93b51944333734

  • SHA256

    8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a

  • SHA512

    5d4775e6939a77c0e30844db174c0188f873565a162bc0def410827d08c4ace03ff513c0c4212b17f837ce561dfca91e9e79675a89d42f7166715c89fa6d772c

  • SSDEEP

    49152:3vnOLQZ7SbOZ4S9dA8XuvpItcfEsv2MokVR2QHCA5Nm6bkXWe:3WLhQ4S9dL+vKtp62Mo+IA5NSXW

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

C2

http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a.exe
    "C:\Users\Admin\AppData\Local\Temp\8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3884
  • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3468
  • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1740
  • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4872

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
  • 77.91.77.81:80
    axplong.exe
    260 B
    5
  • 77.91.77.81:80
    axplong.exe
    260 B
    5
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    330 B
    5

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    8.8.8.8.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe

    Filesize

    1.8MB

    MD5

    6c7e43bbf75184c3057fe13366dab2ae

    SHA1

    32933ffb55922dead5ea5f798f93b51944333734

    SHA256

    8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a

    SHA512

    5d4775e6939a77c0e30844db174c0188f873565a162bc0def410827d08c4ace03ff513c0c4212b17f837ce561dfca91e9e79675a89d42f7166715c89fa6d772c

  • memory/1740-38-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/1740-37-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3468-28-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3468-26-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3468-29-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-31-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-42-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-19-0x0000000000F91000-0x0000000000FBF000-memory.dmp

    Filesize

    184KB

  • memory/3884-20-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-32-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-22-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-23-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-24-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-18-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-27-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-44-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-43-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-33-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-41-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-21-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-30-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-34-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-35-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-40-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/3884-39-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/4144-1-0x0000000077236000-0x0000000077238000-memory.dmp

    Filesize

    8KB

  • memory/4144-3-0x00000000007C0000-0x0000000000C87000-memory.dmp

    Filesize

    4.8MB

  • memory/4144-2-0x00000000007C1000-0x00000000007EF000-memory.dmp

    Filesize

    184KB

  • memory/4144-17-0x00000000007C0000-0x0000000000C87000-memory.dmp

    Filesize

    4.8MB

  • memory/4144-5-0x00000000007C0000-0x0000000000C87000-memory.dmp

    Filesize

    4.8MB

  • memory/4144-0-0x00000000007C0000-0x0000000000C87000-memory.dmp

    Filesize

    4.8MB

  • memory/4872-46-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

  • memory/4872-47-0x0000000000F90000-0x0000000001457000-memory.dmp

    Filesize

    4.8MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.