Analysis
- max time kernel
142s - max time network
125s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
05/07/2024, 02:22
General
- Target 1608caccc377a28575b839e3eec49314.exe
- Size 1.8MB
- Sample240705-ctkapsseqe
- SHA256 bf54e9ba7f3f8d09aedef4e6d9d377f16bb085cb5353352a3f1bb5d17f3e1263
Malware Config
Extracted
-
amadey
-
4.30
-
4dd39d
-
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Extracted
-
stealc
-
Nice
-
http://85.28.47.30
-
url_path
/920475a59bac849d.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Stealc
Stealc is an infostealer written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1608caccc377a28575b839e3eec49314.exe"C:\Users\Admin\AppData\Local\Temp\1608caccc377a28575b839e3eec49314.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000006001\4eda7f1c96.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\4eda7f1c96.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CBGCGDBKEG.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CBGCGDBKEG.exe"C:\Users\Admin\AppData\Local\Temp\CBGCGDBKEG.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IECBGIDAEH.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
4eda7f1c96.exe
explorti.exe
mozglue.dll
nss3.dll
memory/2212-87-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-153-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-161-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-16-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-17-0x00000000013E1000-0x000000000140F000-memory.dmp
memory/2212-107-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-20-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-160-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-36-0x0000000006A10000-0x0000000007613000-memory.dmp
memory/2212-159-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-38-0x0000000006A10000-0x0000000007613000-memory.dmp
memory/2212-41-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-158-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-157-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-156-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-89-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-155-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-154-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-152-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-151-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-18-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-106-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-150-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-148-0x00000000013E0000-0x0000000001879000-memory.dmp
memory/2212-149-0x0000000006A10000-0x0000000007613000-memory.dmp
memory/2604-5-0x0000000000DA0000-0x0000000001239000-memory.dmp
memory/2604-0-0x0000000000DA0000-0x0000000001239000-memory.dmp
memory/2604-1-0x0000000077BA0000-0x0000000077BA2000-memory.dmp
memory/2604-2-0x0000000000DA1000-0x0000000000DCF000-memory.dmp
memory/2604-3-0x0000000000DA0000-0x0000000001239000-memory.dmp
memory/2604-15-0x0000000000DA0000-0x0000000001239000-memory.dmp
memory/2892-102-0x00000000010B0000-0x0000000001CB3000-memory.dmp
memory/2892-98-0x00000000010B0000-0x0000000001CB3000-memory.dmp
memory/2892-42-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2892-39-0x00000000010B0000-0x0000000001CB3000-memory.dmp
memory/2936-147-0x0000000000F40000-0x00000000013D9000-memory.dmp
memory/2936-108-0x0000000000F40000-0x00000000013D9000-memory.dmp