Analysis
- max time kernel
144s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
09/09/2024, 19:01
General
- Target aacd6fe72021f84220f48b9ea92cc41b6e7219e5edffe0e7329d7244c8d65f44.exe
- Size 1.8MB
- Sample240909-xphljawfpg
- SHA256 aacd6fe72021f84220f48b9ea92cc41b6e7219e5edffe0e7329d7244c8d65f44
Malware Config
Extracted
-
amadey
-
4.41
-
c7817d
-
http://31.41.244.10
-
install_dir
0e8d0864aa
-
install_file
svoutse.exe
-
strings_key
5481b88a6ef75bcf21333988a4e47048
-
url_paths
/Dem7kTu/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 5 IoCs
- Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aacd6fe72021f84220f48b9ea92cc41b6e7219e5edffe0e7329d7244c8d65f44.exe"C:\Users\Admin\AppData\Local\Temp\aacd6fe72021f84220f48b9ea92cc41b6e7219e5edffe0e7329d7244c8d65f44.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000030001\295a9e1075.exe"C:\Users\Admin\AppData\Local\Temp\1000030001\295a9e1075.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exeC:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exeC:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exeC:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svoutse.exe
295a9e1075.exe
c360b1a414.exe
memory/432-26-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/432-29-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/432-27-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/2912-59-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/2912-74-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3128-37-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3452-16-0x0000000000ED0000-0x0000000001396000-memory.dmp
memory/3452-5-0x0000000000ED0000-0x0000000001396000-memory.dmp
memory/3452-3-0x0000000000ED0000-0x0000000001396000-memory.dmp
memory/3452-0-0x0000000000ED0000-0x0000000001396000-memory.dmp
memory/3452-2-0x0000000000ED1000-0x0000000000EFF000-memory.dmp
memory/3452-1-0x0000000077156000-0x0000000077158000-memory.dmp
memory/3528-31-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-40-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-30-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-23-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-32-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-33-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-34-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-35-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-22-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-38-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-39-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-24-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-41-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-42-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-21-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-57-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-20-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-19-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-17-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3528-79-0x0000000000B70000-0x0000000001036000-memory.dmp
memory/3984-78-0x0000000000AB0000-0x0000000001143000-memory.dmp