Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 11:01

General

  • Target

    ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe

  • Size

    1.9MB

  • MD5

    48a36baee2fba32fc07ba2f12526914c

  • SHA1

    0f16d91ed72554f0bc71e3906b6532ab2ac40781

  • SHA256

    ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978

  • SHA512

    a7f327d00ef54a17d06b0fce5084e10bddb7c93768c995738b80d8618f320c54472aded33769facde18fef1ec8e528fc29a8e818828cebe935b2ad8ded0f59aa

  • SSDEEP

    49152:7LXxWt2ugXdp1jhk+BSIxEGMWRiF5AlObZX0:7L8t+dp1ybIxrMxOObl

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe
        "C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4092
          • C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe
            "C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3592
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4668
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        2⤵
          PID:5104
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
          2⤵
            PID:3152
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
            2⤵
              PID:1712
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
              2⤵
                PID:5108
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                2⤵
                  PID:972
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                  2⤵
                    PID:2116
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                    2⤵
                      PID:4288
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4120
                  • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                    C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2340
                  • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                    C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1948

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

                    Filesize

                    1.4MB

                    MD5

                    03b1ed4c105e5f473357dad1df17cf98

                    SHA1

                    faf5046ff19eafd3a59dcf85be30496f90b5b6b1

                    SHA256

                    6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba

                    SHA512

                    3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

                  • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

                    Filesize

                    1.9MB

                    MD5

                    48a36baee2fba32fc07ba2f12526914c

                    SHA1

                    0f16d91ed72554f0bc71e3906b6532ab2ac40781

                    SHA256

                    ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978

                    SHA512

                    a7f327d00ef54a17d06b0fce5084e10bddb7c93768c995738b80d8618f320c54472aded33769facde18fef1ec8e528fc29a8e818828cebe935b2ad8ded0f59aa

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n21owazb.xdr.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • memory/1932-3-0x0000000000110000-0x00000000005E6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1932-4-0x0000000000110000-0x00000000005E6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1932-17-0x0000000000110000-0x00000000005E6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1932-2-0x0000000000111000-0x000000000013F000-memory.dmp

                    Filesize

                    184KB

                  • memory/1932-0-0x0000000000110000-0x00000000005E6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1932-1-0x0000000076EF4000-0x0000000076EF6000-memory.dmp

                    Filesize

                    8KB

                  • memory/1948-1161-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/1948-1159-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2340-30-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2340-34-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2340-32-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/2340-31-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/3592-62-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-82-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-1138-0x000001E0E02B0000-0x000001E0E0304000-memory.dmp

                    Filesize

                    336KB

                  • memory/3592-1132-0x000001E0C7690000-0x000001E0C76DC000-memory.dmp

                    Filesize

                    304KB

                  • memory/3592-1131-0x000001E0E0200000-0x000001E0E02A4000-memory.dmp

                    Filesize

                    656KB

                  • memory/3592-57-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-68-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-80-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-98-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-54-0x000001E0C5840000-0x000001E0C59A0000-memory.dmp

                    Filesize

                    1.4MB

                  • memory/3592-55-0x000001E0DFFA0000-0x000001E0E00CA000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3592-56-0x000001E0E00D0000-0x000001E0E01FC000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3592-88-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-90-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-110-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-108-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-106-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-104-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-103-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-100-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-96-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-94-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-92-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-86-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-84-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-112-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-78-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-76-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-74-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-72-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-70-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-66-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-64-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-58-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3592-60-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/4092-25-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-21-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-22-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-35-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-23-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-24-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-27-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-26-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-18-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-19-0x0000000000611000-0x000000000063F000-memory.dmp

                    Filesize

                    184KB

                  • memory/4092-28-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4092-20-0x0000000000610000-0x0000000000AE6000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4120-1142-0x0000018384840000-0x00000183848FC000-memory.dmp

                    Filesize

                    752KB

                  • memory/4668-1148-0x0000018DE6D80000-0x0000018DE6DA2000-memory.dmp

                    Filesize

                    136KB