amadey | 6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d

Analysis

max time kernel
142s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13/09/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
Size

1.8MB
MD5

6dfe7e91841439b9da82c2102f4bef08
SHA1

6db4051485371ef53eee822798594581fafa843b
SHA256

6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d
SHA512

79f0a80d9a4a4ce3d5141aa4ebdf72126fa282c17c129325c551f41a17e4a9cbaac837f06a33c2464b00224b5073c8598cfcbe16fcc8f605bfa142f8e07afb3b
SSDEEP

49152:82L7eYREwh6wvOgKplmMLV+scHSlnJ7V8VoJ:1eYRRIwv4mMLrcAnJ7Oi

Score

10^/10

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	33113e9980.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d39dec7643.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d39dec7643.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	33113e9980.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	33113e9980.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d39dec7643.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 6 IoCs

pid	Process
3300	svoutse.exe
2696	svoutse.exe
4336	33113e9980.exe
1208	d39dec7643.exe
3120	svoutse.exe
3832	svoutse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	33113e9980.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	d39dec7643.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Windows\CurrentVersion\Run\d39dec7643.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\d39dec7643.exe"	svoutse.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4552	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
3300	svoutse.exe
2696	svoutse.exe
4336	33113e9980.exe
1208	d39dec7643.exe
3120	svoutse.exe
3832	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33113e9980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d39dec7643.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4552	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
4552	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
3300	svoutse.exe
3300	svoutse.exe
2696	svoutse.exe
2696	svoutse.exe
4336	33113e9980.exe
4336	33113e9980.exe
1208	d39dec7643.exe
1208	d39dec7643.exe
3120	svoutse.exe
3120	svoutse.exe
3832	svoutse.exe
3832	svoutse.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3300	4552	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe	81
PID 4552 wrote to memory of 3300	4552	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe	81
PID 4552 wrote to memory of 3300	4552	6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe	81
PID 3300 wrote to memory of 4336	3300	svoutse.exe	83
PID 3300 wrote to memory of 4336	3300	svoutse.exe	83
PID 3300 wrote to memory of 4336	3300	svoutse.exe	83
PID 3300 wrote to memory of 1208	3300	svoutse.exe	84
PID 3300 wrote to memory of 1208	3300	svoutse.exe	84
PID 3300 wrote to memory of 1208	3300	svoutse.exe	84

C:\Users\Admin\AppData\Local\Temp\6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe
"C:\Users\Admin\AppData\Local\Temp\6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Users\Admin\AppData\Roaming\1000026000\33113e9980.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\33113e9980.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\1000030001\d39dec7643.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\d39dec7643.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1208

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2696

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3120

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Filesize
1.8MB

MD5
6dfe7e91841439b9da82c2102f4bef08

SHA1
6db4051485371ef53eee822798594581fafa843b

SHA256
6cd01cd53006d22f391c472cc2f98701c0549769596a75ad492570c7dee8514d

SHA512
79f0a80d9a4a4ce3d5141aa4ebdf72126fa282c17c129325c551f41a17e4a9cbaac837f06a33c2464b00224b5073c8598cfcbe16fcc8f605bfa142f8e07afb3b

Download Submit
C:\Users\Admin\AppData\Roaming\1000026000\33113e9980.exe

Filesize
1.7MB

MD5
c9b922ad4cd81d079feea7f168fda043

SHA1
95eab98d5568999eb492267c57cd6ce911a30bdf

SHA256
29ccb9b73cef0dec4afe5a18560b5b65e0731c7e1030d753267c262cd9c2f3a1

SHA512
95e3813a7c1762b7d11787dd81286a6c261cc760581bfe5d74c734cea2fccb2c113ebdc44f1c538bda916a2d87ed1d553ea0ea590be12a753650e910e5517097

Download Submit
memory/1208-63-0x0000000000080000-0x00000000006F8000-memory.dmp

Filesize
6.5MB

Download
memory/1208-60-0x0000000000080000-0x00000000006F8000-memory.dmp

Filesize
6.5MB

Download
memory/2696-23-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/2696-27-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/2696-25-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/2696-24-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3120-74-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3120-73-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-68-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-76-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-85-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-18-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-84-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-80-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-79-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-59-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-78-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-77-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-67-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-64-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-65-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-66-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-19-0x0000000000901000-0x000000000092F000-memory.dmp

Filesize
184KB

Download
memory/3300-69-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-71-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-70-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-20-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-21-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3300-75-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3832-82-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/3832-83-0x0000000000900000-0x0000000000DCF000-memory.dmp

Filesize
4.8MB

Download
memory/4336-62-0x0000000000310000-0x0000000000988000-memory.dmp

Filesize
6.5MB

Download
memory/4336-43-0x0000000000310000-0x0000000000988000-memory.dmp

Filesize
6.5MB

Download
memory/4552-0-0x0000000000150000-0x000000000061F000-memory.dmp

Filesize
4.8MB

Download
memory/4552-1-0x00000000771E6000-0x00000000771E8000-memory.dmp

Filesize
8KB

Download
memory/4552-2-0x0000000000151000-0x000000000017F000-memory.dmp

Filesize
184KB

Download
memory/4552-3-0x0000000000150000-0x000000000061F000-memory.dmp

Filesize
4.8MB

Download
memory/4552-5-0x0000000000150000-0x000000000061F000-memory.dmp

Filesize
4.8MB

Download
memory/4552-17-0x0000000000150000-0x000000000061F000-memory.dmp

Filesize
4.8MB

Download