Behavioral task
behavioral1
Sample
2812-3-0x0000000000AC0000-0x0000000000F71000-memory.exe
Resource
win7-20240705-en
General
-
Target
2812-3-0x0000000000AC0000-0x0000000000F71000-memory.dmp
-
Size
4.7MB
-
MD5
5bbaa5339578512a022b769d669fbfa3
-
SHA1
297ff73c16b63d1e9a5eceb28b629f118a48fff2
-
SHA256
64de23a9d7e82684f805428732b15eec6493efe78a3a98e1d2a40642aeab7dbf
-
SHA512
b0a32b6c1cf0b096af9ee8456e30444e6b7e861a97c9f288d19cef8590e0e941dfbb64602edf7f7890b729c651e4f28ca762c771e0857dab7e5af8eb0ff45e79
-
SSDEEP
98304:TEItvTF8EhtLtXgiPgALQgd3LaWE4iT97glqsBEXNvT:T5R7gAEgxaWE7Jglgv
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2812-3-0x0000000000AC0000-0x0000000000F71000-memory.dmp
Files
-
2812-3-0x0000000000AC0000-0x0000000000F71000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gvtletko Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qujcpoqu Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE