Analysis
- max time kernel
150s - max time network
142s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
01/09/2024, 11:33
General
- Target 25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
- Size 1.9MB
- Sample240901-nn32eazdlb
- SHA256 25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae
Malware Config
Extracted
-
amadey
-
4.41
-
0657d1
-
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
-
stealc
-
leva
-
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Stealc
Stealc is an infostealer written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe"C:\Users\Admin\AppData\Local\Temp\25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1000051000\99a10d6912.exe"C:\Users\Admin\AppData\Roaming\1000051000\99a10d6912.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\1000052000\3b9a04a5fb.exe"C:\Users\Admin\AppData\Roaming\1000052000\3b9a04a5fb.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000053001\d77e3ed11d.exe"C:\Users\Admin\AppData\Local\Temp\1000053001\d77e3ed11d.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
d77e3ed11d.exe
99a10d6912.exe
explorti.exe
memory/1960-64-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-88-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-97-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-96-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-95-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-16-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-94-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-19-0x00000000010B1000-0x00000000010DF000-memory.dmp
memory/1960-20-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-22-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-93-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-38-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-41-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-40-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-92-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-59-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-61-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-60-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-62-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-91-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-90-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-89-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-87-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-86-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-81-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1960-82-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-83-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-84-0x0000000006840000-0x0000000006EBD000-memory.dmp
memory/1960-85-0x00000000010B0000-0x000000000157F000-memory.dmp
memory/1984-63-0x0000000000B50000-0x00000000011CD000-memory.dmp
memory/1984-66-0x0000000000B50000-0x00000000011CD000-memory.dmp
memory/2500-1-0x0000000077CC0000-0x0000000077CC2000-memory.dmp
memory/2500-5-0x0000000000800000-0x0000000000CCF000-memory.dmp
memory/2500-0-0x0000000000800000-0x0000000000CCF000-memory.dmp
memory/2500-2-0x0000000000801000-0x000000000082F000-memory.dmp
memory/2500-18-0x0000000000800000-0x0000000000CCF000-memory.dmp
memory/2500-15-0x0000000006C30000-0x00000000070FF000-memory.dmp
memory/2500-13-0x0000000000800000-0x0000000000CCF000-memory.dmp
memory/2500-3-0x0000000000800000-0x0000000000CCF000-memory.dmp
memory/3068-65-0x0000000000300000-0x000000000097D000-memory.dmp
memory/3068-42-0x0000000000300000-0x000000000097D000-memory.dmp