Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 06:31

General

  • Target

    b0f8cebacc784a4a056d2754a3a0fe692a9da634327439de3f5a0fd06bbc7f9b.exe

  • Size

    1.8MB

  • MD5

    f8348bd316750a70f9c1f56eb9d4c700

  • SHA1

    5166b30fc5b622863e4edb83ef13905dff6e5295

  • SHA256

    b0f8cebacc784a4a056d2754a3a0fe692a9da634327439de3f5a0fd06bbc7f9b

  • SHA512

    1495d3e0961447ca074a61e493b14d03cdcbebfafd95ec29ad55721556a52457186801cf42597f1aa4a04400dd56ade7d151ec926301c6a0df9d55b3e25ee0ef

  • SSDEEP

    49152:Lj4rgB1bGh5MikKCHGvjRnK606KOeLZjgwVy1DuO:LjweJKMikclnfHtwV

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0f8cebacc784a4a056d2754a3a0fe692a9da634327439de3f5a0fd06bbc7f9b.exe
    "C:\Users\Admin\AppData\Local\Temp\b0f8cebacc784a4a056d2754a3a0fe692a9da634327439de3f5a0fd06bbc7f9b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Local\Temp\1000036001\e5cf423e52.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\e5cf423e52.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2328
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2132
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              PID:924
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240401114208 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98f318d0-238f-4f11-b5d4-ae97eb9992a6} 924 "\\.\pipe\gecko-crash-server-pipe.924" gpu
                7⤵
                  PID:2760
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2328 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00428ba7-5044-4d01-aa7e-d9d5203989cb} 924 "\\.\pipe\gecko-crash-server-pipe.924" socket
                  7⤵
                    PID:2096
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 2888 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37e94fc3-12af-44c8-99b9-79e5bd2e3065} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                    7⤵
                      PID:1384
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2700 -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3640 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42bcaee0-3913-416d-9b03-df8c657b90fc} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                      7⤵
                        PID:3812
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4496 -prefMapHandle 4472 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7037ef16-f0ee-4877-b9f8-4fc5f00e9135} 924 "\\.\pipe\gecko-crash-server-pipe.924" utility
                        7⤵
                        • Checks processor information in registry
                        PID:4244
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5164 -childID 3 -isForBrowser -prefsHandle 5096 -prefMapHandle 5128 -prefsLen 27050 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {898692df-d495-4460-bfe0-c155904252c5} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                        7⤵
                          PID:892
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 4 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 27050 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e514d63-fddd-451f-99b8-3957989e4c68} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                          7⤵
                            PID:2904
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 5 -isForBrowser -prefsHandle 5144 -prefMapHandle 5136 -prefsLen 27050 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dca09e17-13f3-4b09-ac95-c43e05bf4a41} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                            7⤵
                              PID:1992
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6000 -childID 6 -isForBrowser -prefsHandle 5940 -prefMapHandle 5908 -prefsLen 27181 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46b8dd2d-9d12-420e-a5bf-4bd745c34dd8} 924 "\\.\pipe\gecko-crash-server-pipe.924" tab
                              7⤵
                                PID:5172
                      • C:\Users\Admin\1000037002\a65be0d694.exe
                        "C:\Users\Admin\1000037002\a65be0d694.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2636
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4920
                      • C:\Users\Admin\AppData\Local\Temp\1000038001\13a21bf0df.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000038001\13a21bf0df.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4444
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5420
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5600
                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2420

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\1000037002\a65be0d694.exe

                    Filesize

                    206KB

                    MD5

                    c4e52e6c6a04afe8e1a0edb8fb8236a2

                    SHA1

                    e3d70bab8a8882ed26a5e5d206b50862a32a0112

                    SHA256

                    a4fcfe7074b0d307133c98530614d6de7f5e0fd27a64a00f30f7933583b63fa6

                    SHA512

                    3e89f085dd83274db01305ef8b66c481e202ba889125ae5d7f74aa09359f782557950d9d357cc54bf23a10e239e5b5760000ca2012f3b833e6481c6750d73478

                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                    Filesize

                    1.8MB

                    MD5

                    f8348bd316750a70f9c1f56eb9d4c700

                    SHA1

                    5166b30fc5b622863e4edb83ef13905dff6e5295

                    SHA256

                    b0f8cebacc784a4a056d2754a3a0fe692a9da634327439de3f5a0fd06bbc7f9b

                    SHA512

                    1495d3e0961447ca074a61e493b14d03cdcbebfafd95ec29ad55721556a52457186801cf42597f1aa4a04400dd56ade7d151ec926301c6a0df9d55b3e25ee0ef

                  • C:\Users\Admin\AppData\Local\Temp\1000036001\e5cf423e52.exe

                    Filesize

                    1.2MB

                    MD5

                    0cd9988143ed0889f0ec75b9ce302cc1

                    SHA1

                    a85827b7497b66554f2f8bf86d044afec100eed0

                    SHA256

                    f40952c3693d14eb42a3785136841e3f3fd2f6f0336272e09860a7b93db1e59d

                    SHA512

                    715ae0560d5540494ef0e12e9750ad5e864aafc341584c660406c2158e881d38831d4a72d0a6300c634804a2d49e9bb8abd18ee3e9c6d587e029cd9da26fabb6

                  • C:\Users\Admin\AppData\Local\Temp\1000038001\13a21bf0df.exe

                    Filesize

                    187KB

                    MD5

                    278ee1426274818874556aa18fd02e3a

                    SHA1

                    185a2761330024dec52134df2c8388c461451acb

                    SHA256

                    37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                    SHA512

                    07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                  • memory/2328-51-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2328-49-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2328-53-0x0000000000400000-0x000000000052D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2420-118-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2420-117-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2636-72-0x00000000007E0000-0x0000000000818000-memory.dmp

                    Filesize

                    224KB

                  • memory/2924-0-0x0000000000770000-0x0000000000C33000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2924-16-0x0000000000770000-0x0000000000C33000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2924-4-0x0000000000770000-0x0000000000C33000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2924-3-0x0000000000770000-0x0000000000C33000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2924-2-0x0000000000771000-0x000000000079F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2924-1-0x00000000774E4000-0x00000000774E6000-memory.dmp

                    Filesize

                    8KB

                  • memory/4228-46-0x00000000730FE000-0x00000000730FF000-memory.dmp

                    Filesize

                    4KB

                  • memory/4228-47-0x0000000000FA0000-0x00000000010D0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/4444-92-0x0000000000900000-0x0000000000B43000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4444-93-0x0000000000900000-0x0000000000B43000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4920-76-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/4920-74-0x0000000000400000-0x0000000000643000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/5032-20-0x0000000005650000-0x0000000005651000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-102-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-26-0x0000000000CB1000-0x0000000000CDF000-memory.dmp

                    Filesize

                    184KB

                  • memory/5032-19-0x0000000005640000-0x0000000005641000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-22-0x0000000005680000-0x0000000005681000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-23-0x0000000005610000-0x0000000005611000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-24-0x0000000005620000-0x0000000005621000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-25-0x0000000005670000-0x0000000005671000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-94-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-95-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-17-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-97-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-98-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-21-0x0000000005630000-0x0000000005631000-memory.dmp

                    Filesize

                    4KB

                  • memory/5032-101-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-27-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-103-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-104-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-105-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-106-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-115-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-114-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-110-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-111-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-112-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5032-113-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5420-100-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5420-99-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5600-109-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5600-108-0x0000000000CB0000-0x0000000001173000-memory.dmp

                    Filesize

                    4.8MB