Analysis

  • max time kernel
    294s
  • max time network
    270s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 22:43

General

  • Target

    7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe

  • Size

    1.8MB

  • MD5

    211e2a18a305834618abddd71045360c

  • SHA1

    e30300f3a4b6abc7808d18174bd2205f4f2c45be

  • SHA256

    7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7

  • SHA512

    212649d62a264d9a9b02a97b8750d42501dcf5463e7ed8b1a22ab79aab235da527a928843fc6adcec38b57fd284fc878df3bbc357f84e6e5c2cc619b7e3ae524

  • SSDEEP

    49152:z1xHd56Q2gmMoZaB1lWlE47+Up1pglH70KrxDKy:3HGQ28oWlWeypglHLrxD

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe
    "C:\Users\Admin\AppData\Local\Temp\7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
        "C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:924
        • C:\Windows\system32\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:1972
          • C:\Windows\system32\PING.EXE
            ping 127.0.0.1 -n 6
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2324
          • C:\Windows\system32\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
            5⤵
            • Adds Run key to start application
            PID:2268
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
          4⤵
            PID:2296
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
            4⤵
              PID:2280
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
              4⤵
                PID:1012
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                4⤵
                  PID:2436
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                  4⤵
                    PID:944
                  • C:\Users\Admin\AppData\Local\Temp\neon.exe
                    "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2612
                    • C:\Users\Admin\AppData\Local\Temp\neon.exe
                      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                      5⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2424

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

              Filesize

              3.5MB

              MD5

              b3fd0e1003b1cd38402b6d32829f6135

              SHA1

              c9cedd6322fb83457f56b64b4624b07e2786f702

              SHA256

              e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

              SHA512

              04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

              Filesize

              1.8MB

              MD5

              211e2a18a305834618abddd71045360c

              SHA1

              e30300f3a4b6abc7808d18174bd2205f4f2c45be

              SHA256

              7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7

              SHA512

              212649d62a264d9a9b02a97b8750d42501dcf5463e7ed8b1a22ab79aab235da527a928843fc6adcec38b57fd284fc878df3bbc357f84e6e5c2cc619b7e3ae524

            • C:\Users\Admin\AppData\Local\Temp\neon.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              63B

              MD5

              7fbbc13b58424f6d745a0c8d40f50056

              SHA1

              22c2c7d4405404af3425fd0175d8533c2902e0a1

              SHA256

              c6e29dec194eac652a9b60537e4bd2a4aecb7185139f5ba5a14e4e75014d64e1

              SHA512

              ded0aa6a07ea41a7faf62f549717160bb6df0bc285052a498e5b853943ce547a803b96cd2d838109a1e82fb51f657e617bc29273db1abd813390214c8fd21c5c

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              66B

              MD5

              7a9fe2d53be44957d01223fe88ae27ea

              SHA1

              eacfe44289f65ed4f80d4022e6edcb7569574314

              SHA256

              ea9a8df4163594f4e495711fe5012e1dd9ba1d624bd72e3ade3951739e8ad5dc

              SHA512

              af4f4c7e96c5fb9f03cc30c412a531a36794520008d8768baaeb7699b831f63f2a01f6e4bf8a9fdac41a9d20c2c03d0888eff326c586a5a9c99171a9fc972e9f

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              66B

              MD5

              69d7dea11f9a3b194ecb1ac4851abaa8

              SHA1

              db8699ba3303f441087450770ecf0e5895c7784d

              SHA256

              7b3f2e59d879d6a96f5a4b4e244dce0a3484652c44e573e6464b867857f09064

              SHA512

              90789d83277c1414b6b1765a290a5ecdbc88ff77581fa67c2cad418ba004a5c7a042a32b0097e5e0801d6862a4262eedc9716fc8dec53745cdb73522d1628883

            • memory/924-51-0x000000001CC30000-0x000000001CC47000-memory.dmp

              Filesize

              92KB

            • memory/924-54-0x0000000023280000-0x0000000023495000-memory.dmp

              Filesize

              2.1MB

            • memory/924-71-0x00000000215E0000-0x00000000215F4000-memory.dmp

              Filesize

              80KB

            • memory/924-61-0x000000001E9F0000-0x000000001E9F6000-memory.dmp

              Filesize

              24KB

            • memory/924-60-0x00000000215C0000-0x00000000215DA000-memory.dmp

              Filesize

              104KB

            • memory/924-55-0x00000000234A0000-0x0000000023601000-memory.dmp

              Filesize

              1.4MB

            • memory/924-53-0x0000000021520000-0x00000000215C0000-memory.dmp

              Filesize

              640KB

            • memory/924-52-0x0000000021470000-0x000000002150E000-memory.dmp

              Filesize

              632KB

            • memory/924-46-0x0000000003510000-0x0000000003607000-memory.dmp

              Filesize

              988KB

            • memory/924-44-0x0000000001410000-0x0000000001519000-memory.dmp

              Filesize

              1.0MB

            • memory/924-43-0x00000000011B0000-0x0000000001279000-memory.dmp

              Filesize

              804KB

            • memory/924-42-0x00000000007F0000-0x0000000000861000-memory.dmp

              Filesize

              452KB

            • memory/924-41-0x0000000000AB0000-0x0000000000B4C000-memory.dmp

              Filesize

              624KB

            • memory/924-40-0x0000000000ED0000-0x0000000000FFD000-memory.dmp

              Filesize

              1.2MB

            • memory/924-39-0x0000000000060000-0x000000000007F000-memory.dmp

              Filesize

              124KB

            • memory/924-38-0x0000000000A10000-0x0000000000AAF000-memory.dmp

              Filesize

              636KB

            • memory/924-47-0x0000000000B50000-0x0000000000ECC000-memory.dmp

              Filesize

              3.5MB

            • memory/924-48-0x000000001C380000-0x000000001C4AC000-memory.dmp

              Filesize

              1.2MB

            • memory/924-50-0x000000001C520000-0x000000001C542000-memory.dmp

              Filesize

              136KB

            • memory/944-108-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

              Filesize

              4KB

            • memory/1012-89-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

              Filesize

              4KB

            • memory/2280-80-0x000007FFFFFDE000-0x000007FFFFFDF000-memory.dmp

              Filesize

              4KB

            • memory/2296-63-0x0000000000610000-0x0000000000804000-memory.dmp

              Filesize

              2.0MB

            • memory/2296-66-0x0000000000610000-0x0000000000804000-memory.dmp

              Filesize

              2.0MB

            • memory/2296-68-0x0000000000610000-0x0000000000804000-memory.dmp

              Filesize

              2.0MB

            • memory/2296-70-0x000007FFFFFDE000-0x000007FFFFFDF000-memory.dmp

              Filesize

              4KB

            • memory/2296-64-0x0000000000610000-0x0000000000804000-memory.dmp

              Filesize

              2.0MB

            • memory/2436-99-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

              Filesize

              4KB

            • memory/2560-17-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-49-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-59-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-58-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-57-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-56-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-20-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-22-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-18-0x0000000000C61000-0x0000000000C8F000-memory.dmp

              Filesize

              184KB

            • memory/2560-19-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2560-90-0x0000000000C60000-0x0000000001116000-memory.dmp

              Filesize

              4.7MB

            • memory/2612-119-0x00000000001F0000-0x000000000020A000-memory.dmp

              Filesize

              104KB

            • memory/2788-1-0x00000000776D0000-0x00000000776D2000-memory.dmp

              Filesize

              8KB

            • memory/2788-0-0x0000000000B10000-0x0000000000FC6000-memory.dmp

              Filesize

              4.7MB

            • memory/2788-5-0x0000000000B10000-0x0000000000FC6000-memory.dmp

              Filesize

              4.7MB

            • memory/2788-16-0x0000000000B10000-0x0000000000FC6000-memory.dmp

              Filesize

              4.7MB

            • memory/2788-3-0x0000000000B10000-0x0000000000FC6000-memory.dmp

              Filesize

              4.7MB

            • memory/2788-2-0x0000000000B11000-0x0000000000B3F000-memory.dmp

              Filesize

              184KB

            • memory/2788-14-0x0000000006650000-0x0000000006B06000-memory.dmp

              Filesize

              4.7MB