Analysis

  • max time kernel
    292s
  • max time network
    265s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 22:34

General

  • Target

    36c21ef0049ef387de90ec5d1ed8ddbb1bcbbc0cd3c17c3212cdaf528e1c28e2.exe

  • Size

    1.8MB

  • MD5

    92263218d1c0ee48c6f0428210be8217

  • SHA1

    0c99feb9fd793efa1e1226ed525acf32d95b7b6e

  • SHA256

    36c21ef0049ef387de90ec5d1ed8ddbb1bcbbc0cd3c17c3212cdaf528e1c28e2

  • SHA512

    92c062dcd50d7287a440fdb076a06f7d3131288cafe30ca1000816ee81c03557fcbcdc842eae8d9963cdc80d100247f06ec61ddf849a16663bc0931c146eb461

  • SSDEEP

    49152:gQe0zB4HBg283QL2hru53srGM3hTyfOpg1xdSn:q0V+gMz3srhxwVxdS

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36c21ef0049ef387de90ec5d1ed8ddbb1bcbbc0cd3c17c3212cdaf528e1c28e2.exe
    "C:\Users\Admin\AppData\Local\Temp\36c21ef0049ef387de90ec5d1ed8ddbb1bcbbc0cd3c17c3212cdaf528e1c28e2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
        "C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Windows\system32\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Windows\system32\PING.EXE
            ping 127.0.0.1 -n 7
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:544
          • C:\Windows\system32\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
            5⤵
            • Adds Run key to start application
            PID:1096
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
          4⤵
            PID:2288
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
            4⤵
              PID:816
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
              4⤵
                PID:2268
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                4⤵
                  PID:2088
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                  4⤵
                    PID:2192
                  • C:\Users\Admin\AppData\Local\Temp\neon.exe
                    "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2548
                    • C:\Users\Admin\AppData\Local\Temp\neon.exe
                      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                      5⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:648

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

              Filesize

              3.5MB

              MD5

              b3fd0e1003b1cd38402b6d32829f6135

              SHA1

              c9cedd6322fb83457f56b64b4624b07e2786f702

              SHA256

              e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

              SHA512

              04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

              Filesize

              1.8MB

              MD5

              92263218d1c0ee48c6f0428210be8217

              SHA1

              0c99feb9fd793efa1e1226ed525acf32d95b7b6e

              SHA256

              36c21ef0049ef387de90ec5d1ed8ddbb1bcbbc0cd3c17c3212cdaf528e1c28e2

              SHA512

              92c062dcd50d7287a440fdb076a06f7d3131288cafe30ca1000816ee81c03557fcbcdc842eae8d9963cdc80d100247f06ec61ddf849a16663bc0931c146eb461

            • C:\Users\Admin\AppData\Local\Temp\neon.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              64B

              MD5

              75d05ecc31198dd640cdb9b71323ae20

              SHA1

              60bf013e8f1cdd4cfefe5284a1360cc335df7aee

              SHA256

              bdbecf10192e8a18d1ff75953375f9101873edc7486e76124cb80c1431b67634

              SHA512

              f5d7a9058150bcc1d37490324efbafb77ed5dd11f1a8f7b6657b18cbb8a8e1b8d7910d74047a235e56365c99ae4df00367c4824a48375720a87e778c5e0e997a

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              66B

              MD5

              69ef9ef37100d1fd7bcd5209f02dde42

              SHA1

              d97ab1f0a1fc7c07749533e386c4418232f2430f

              SHA256

              da0412c7bf536b25239495214feb16d03de6a7f1953cd5a3272f345dde9117ef

              SHA512

              4c8ecb7cd8eb3ca0f47eba816857bd5c8bf5c6bc5ea53f6db132b85d43a9e14879002caa11663a2e4a25a47e49c4fe7f518ce9578652f27bb53158968b4b9d87

            • memory/808-5-0x0000000000150000-0x000000000061C000-memory.dmp

              Filesize

              4.8MB

            • memory/808-10-0x0000000000150000-0x000000000061C000-memory.dmp

              Filesize

              4.8MB

            • memory/808-3-0x0000000000150000-0x000000000061C000-memory.dmp

              Filesize

              4.8MB

            • memory/808-16-0x0000000000150000-0x000000000061C000-memory.dmp

              Filesize

              4.8MB

            • memory/808-0-0x0000000000150000-0x000000000061C000-memory.dmp

              Filesize

              4.8MB

            • memory/808-2-0x0000000000151000-0x000000000017F000-memory.dmp

              Filesize

              184KB

            • memory/808-1-0x00000000774E0000-0x00000000774E2000-memory.dmp

              Filesize

              8KB

            • memory/816-78-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

              Filesize

              4KB

            • memory/1376-49-0x000000001C3F0000-0x000000001C407000-memory.dmp

              Filesize

              92KB

            • memory/1376-47-0x000000001E820000-0x000000001E94C000-memory.dmp

              Filesize

              1.2MB

            • memory/1376-37-0x0000000000990000-0x0000000000A2F000-memory.dmp

              Filesize

              636KB

            • memory/1376-41-0x0000000000D40000-0x0000000000DB1000-memory.dmp

              Filesize

              452KB

            • memory/1376-43-0x0000000001470000-0x0000000001579000-memory.dmp

              Filesize

              1.0MB

            • memory/1376-42-0x0000000001210000-0x00000000012D9000-memory.dmp

              Filesize

              804KB

            • memory/1376-40-0x0000000000CA0000-0x0000000000D3C000-memory.dmp

              Filesize

              624KB

            • memory/1376-45-0x0000000003510000-0x0000000003607000-memory.dmp

              Filesize

              988KB

            • memory/1376-46-0x0000000000E20000-0x000000000119C000-memory.dmp

              Filesize

              3.5MB

            • memory/1376-58-0x00000000234D0000-0x00000000234EA000-memory.dmp

              Filesize

              104KB

            • memory/1376-48-0x000000001C810000-0x000000001C832000-memory.dmp

              Filesize

              136KB

            • memory/1376-39-0x0000000000A30000-0x0000000000B5D000-memory.dmp

              Filesize

              1.2MB

            • memory/1376-50-0x0000000021450000-0x00000000214EE000-memory.dmp

              Filesize

              632KB

            • memory/1376-51-0x0000000023030000-0x00000000230D0000-memory.dmp

              Filesize

              640KB

            • memory/1376-52-0x0000000023280000-0x0000000023495000-memory.dmp

              Filesize

              2.1MB

            • memory/1376-53-0x0000000023B50000-0x0000000023CB1000-memory.dmp

              Filesize

              1.4MB

            • memory/1376-109-0x0000000024000000-0x0000000024099000-memory.dmp

              Filesize

              612KB

            • memory/1376-69-0x00000000234F0000-0x0000000023504000-memory.dmp

              Filesize

              80KB

            • memory/1376-59-0x0000000023260000-0x0000000023266000-memory.dmp

              Filesize

              24KB

            • memory/1376-38-0x0000000000540000-0x000000000055F000-memory.dmp

              Filesize

              124KB

            • memory/2060-56-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-17-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-18-0x0000000000871000-0x000000000089F000-memory.dmp

              Filesize

              184KB

            • memory/2060-19-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-54-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-55-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-21-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-57-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2060-88-0x0000000000870000-0x0000000000D3C000-memory.dmp

              Filesize

              4.8MB

            • memory/2088-97-0x000007FFFFFDB000-0x000007FFFFFDC000-memory.dmp

              Filesize

              4KB

            • memory/2192-106-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

              Filesize

              4KB

            • memory/2268-87-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

              Filesize

              4KB

            • memory/2288-64-0x0000000000460000-0x0000000000654000-memory.dmp

              Filesize

              2.0MB

            • memory/2288-66-0x0000000000460000-0x0000000000654000-memory.dmp

              Filesize

              2.0MB

            • memory/2288-68-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

              Filesize

              4KB

            • memory/2288-62-0x0000000000460000-0x0000000000654000-memory.dmp

              Filesize

              2.0MB

            • memory/2288-61-0x0000000000460000-0x0000000000654000-memory.dmp

              Filesize

              2.0MB

            • memory/2548-117-0x0000000000C00000-0x0000000000C1A000-memory.dmp

              Filesize

              104KB