amadey | 29c4ad548b256164b8a892c659bd38f94fde34b63e412059a04098daa5c32653

Analysis

max time kernel
120s
max time network
76s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d95a35cf969288d0d43e4b54f6d3db20N.exe
Size

1.8MB
MD5

d95a35cf969288d0d43e4b54f6d3db20
SHA1

11c9439a1887286d6a91f624afcf56b9a0598688
SHA256

29c4ad548b256164b8a892c659bd38f94fde34b63e412059a04098daa5c32653
SHA512

4b95932666165b21bf697927f7330b72ee6b6fe077206c739600f18afff12bd4811275997612e4b8107604bad9f982d56333c78f9d8c09bd03390316117ed303
SSDEEP

49152:dCa4pnH/W4u9EnPTvJNoPUBU8E5fUm4IsW5dUWyLN4hP:4a4B/Wt9EdNoPOrEhj4jW5i7Z4hP

Score

10^/10

amadey stealc c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d95a35cf969288d0d43e4b54f6d3db20N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b2eedcf053.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d8e2d5f67e.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b2eedcf053.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b2eedcf053.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d8e2d5f67e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d8e2d5f67e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d95a35cf969288d0d43e4b54f6d3db20N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d95a35cf969288d0d43e4b54f6d3db20N.exe

Executes dropped EXE 4 IoCs

pid	Process
2756	svoutse.exe
1640	785def3533.exe
1360	b2eedcf053.exe
2376	d8e2d5f67e.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	d8e2d5f67e.exe
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	d95a35cf969288d0d43e4b54f6d3db20N.exe
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	b2eedcf053.exe

Loads dropped DLL 6 IoCs

pid	Process
1344	d95a35cf969288d0d43e4b54f6d3db20N.exe
2756	svoutse.exe
2756	svoutse.exe
2756	svoutse.exe
2756	svoutse.exe
2756	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000018716-26.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1344	d95a35cf969288d0d43e4b54f6d3db20N.exe
2756	svoutse.exe
1360	b2eedcf053.exe
2376	d8e2d5f67e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	d95a35cf969288d0d43e4b54f6d3db20N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	785def3533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2eedcf053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8e2d5f67e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d95a35cf969288d0d43e4b54f6d3db20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1344	d95a35cf969288d0d43e4b54f6d3db20N.exe
2756	svoutse.exe
1360	b2eedcf053.exe
2376	d8e2d5f67e.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1344	d95a35cf969288d0d43e4b54f6d3db20N.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe
1640	785def3533.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2756	1344	d95a35cf969288d0d43e4b54f6d3db20N.exe	30
PID 1344 wrote to memory of 2756	1344	d95a35cf969288d0d43e4b54f6d3db20N.exe	30
PID 1344 wrote to memory of 2756	1344	d95a35cf969288d0d43e4b54f6d3db20N.exe	30
PID 1344 wrote to memory of 2756	1344	d95a35cf969288d0d43e4b54f6d3db20N.exe	30
PID 2756 wrote to memory of 1640	2756	svoutse.exe	32
PID 2756 wrote to memory of 1640	2756	svoutse.exe	32
PID 2756 wrote to memory of 1640	2756	svoutse.exe	32
PID 2756 wrote to memory of 1640	2756	svoutse.exe	32
PID 2756 wrote to memory of 1360	2756	svoutse.exe	33
PID 2756 wrote to memory of 1360	2756	svoutse.exe	33
PID 2756 wrote to memory of 1360	2756	svoutse.exe	33
PID 2756 wrote to memory of 1360	2756	svoutse.exe	33
PID 2756 wrote to memory of 2376	2756	svoutse.exe	34
PID 2756 wrote to memory of 2376	2756	svoutse.exe	34
PID 2756 wrote to memory of 2376	2756	svoutse.exe	34
PID 2756 wrote to memory of 2376	2756	svoutse.exe	34

C:\Users\Admin\AppData\Local\Temp\d95a35cf969288d0d43e4b54f6d3db20N.exe
"C:\Users\Admin\AppData\Local\Temp\d95a35cf969288d0d43e4b54f6d3db20N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\1000015001\785def3533.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\785def3533.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1640
- - C:\Users\Admin\AppData\Roaming\1000017000\b2eedcf053.exe
    "C:\Users\Admin\AppData\Roaming\1000017000\b2eedcf053.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1360
- - C:\Users\Admin\AppData\Roaming\1000019000\d8e2d5f67e.exe
    "C:\Users\Admin\AppData\Roaming\1000019000\d8e2d5f67e.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Filesize
1.8MB

MD5
d95a35cf969288d0d43e4b54f6d3db20

SHA1
11c9439a1887286d6a91f624afcf56b9a0598688

SHA256
29c4ad548b256164b8a892c659bd38f94fde34b63e412059a04098daa5c32653

SHA512
4b95932666165b21bf697927f7330b72ee6b6fe077206c739600f18afff12bd4811275997612e4b8107604bad9f982d56333c78f9d8c09bd03390316117ed303

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000015001\785def3533.exe

Filesize
896KB

MD5
f074ba8a42fd6c33590292292ca5b3ec

SHA1
a9fccc12395967d4739805797671bb0c0c7c9500

SHA256
697ffd86a80d619d1501520c90fcbabc99cd94e103034428bfd248955e5a1387

SHA512
46ae3f514b8113a6440450029f1a3fc047ba0a0fd1e942559ed98da5c28e6a27ea791a3c1c365fbfc0a529bd8c9f5b2031b4f6663a203a5154246cf70dbb7721

Download Submit
C:\Users\Admin\AppData\Roaming\1000017000\b2eedcf053.exe

Filesize
1.7MB

MD5
6daeccad61a0c7a6343226aebc2f5991

SHA1
789d113f7c6abc47d436f9e080635bbc8ea39c2d

SHA256
20feef1cd2f7bc7afa599f5e3305fc5cebe04110b5dc6e99c1844efb7b31aeee

SHA512
95660b4fed2371c236e906c613592a4afdd8979abb746536c39b15b9e3a49e1d3905a86b9ccf1e4cf9080e36741899e60513152839cdf311136b987121bb82da

Download Submit
memory/1344-3-0x0000000000D60000-0x0000000001226000-memory.dmp

Filesize
4.8MB

Download
memory/1344-5-0x0000000000D60000-0x0000000001226000-memory.dmp

Filesize
4.8MB

Download
memory/1344-10-0x0000000000D60000-0x0000000001226000-memory.dmp

Filesize
4.8MB

Download
memory/1344-2-0x0000000000D61000-0x0000000000D8F000-memory.dmp

Filesize
184KB

Download
memory/1344-15-0x0000000000D60000-0x0000000001226000-memory.dmp

Filesize
4.8MB

Download
memory/1344-1-0x0000000077B80000-0x0000000077B82000-memory.dmp

Filesize
8KB

Download
memory/1344-0-0x0000000000D60000-0x0000000001226000-memory.dmp

Filesize
4.8MB

Download
memory/1360-78-0x00000000000D0000-0x000000000073F000-memory.dmp

Filesize
6.4MB

Download
memory/1360-57-0x00000000000D0000-0x000000000073F000-memory.dmp

Filesize
6.4MB

Download
memory/2376-80-0x0000000000FC0000-0x000000000162F000-memory.dmp

Filesize
6.4MB

Download
memory/2376-75-0x0000000000FC0000-0x000000000162F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-53-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-83-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-56-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-55-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-36-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-21-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-18-0x00000000011A1000-0x00000000011CF000-memory.dmp

Filesize
184KB

Download
memory/2756-76-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-74-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-19-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-17-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-81-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-82-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-54-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-84-0x0000000006AC0000-0x000000000712F000-memory.dmp

Filesize
6.4MB

Download
memory/2756-85-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-86-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-87-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-88-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-89-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-90-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-91-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-92-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-93-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download
memory/2756-94-0x00000000011A0000-0x0000000001666000-memory.dmp

Filesize
4.8MB

Download