Analysis

  • max time kernel
    294s
  • max time network
    266s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 22:46

General

  • Target

    9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe

  • Size

    1.8MB

  • MD5

    05bf47facd1f8b89c7cdaadc238ffb9a

  • SHA1

    b43a5f8a3c7213162144402798fa7bc015c7fa23

  • SHA256

    9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9

  • SHA512

    d2e986d794130062b423657b3e40decdb682908c194b076e442a4f13272c296caf11cdde209a1b10abafde2f177c16384c8ca7655c22903e7e66796f08c0dcb7

  • SSDEEP

    49152:Sx78jdtEzCSkNxOYxOcVCimZcjSQWYqJWlgUtl+:3tEV+xxWy+JWL4

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe
    "C:\Users\Admin\AppData\Local\Temp\9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
        "C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Windows\system32\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Windows\system32\PING.EXE
            ping 127.0.0.1 -n 9
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:676
          • C:\Windows\system32\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
            5⤵
            • Adds Run key to start application
            PID:748
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
          4⤵
            PID:1036
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
            4⤵
              PID:2604
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
              4⤵
                PID:2128
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                4⤵
                  PID:2968
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                  4⤵
                    PID:2156
                  • C:\Users\Admin\AppData\Local\Temp\neon.exe
                    "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1964
                    • C:\Users\Admin\AppData\Local\Temp\neon.exe
                      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                      5⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:600

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

              Filesize

              3.5MB

              MD5

              b3fd0e1003b1cd38402b6d32829f6135

              SHA1

              c9cedd6322fb83457f56b64b4624b07e2786f702

              SHA256

              e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

              SHA512

              04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

            • C:\Users\Admin\AppData\Local\Temp\neon.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              64B

              MD5

              9cbeaf85b3f791a57a8c6176d1a6a1b7

              SHA1

              acaa58162deb430fae5dd3a022601565cd58cfb1

              SHA256

              8ec4026b88e8850e4b0b6dcd5470e71a7c0fab8645da0b4956dcab83de3650e4

              SHA512

              3b6803a6f77d055d9bb66c43ae0457f36ed0ffe31dd7d2cd03d3f97030cd19df4cf4a61c0997d8bfdc3b600a10de4c0010415760bc721b6c07f081ed15b0ff6c

            • C:\Users\Admin\AppData\Local\Temp\neon.txt

              Filesize

              66B

              MD5

              c9aa6e23fb3c7838e717423c6c9a263f

              SHA1

              72c4334856b54936905010aee09e84cfe39ffee9

              SHA256

              f4edc5655c1e28f0c70a0ecb871265b6ac0d3a5295c2687747929d29bca60ed9

              SHA512

              6ee40913307721c2ca2d581292b8c7d82d467e099ceb92d5e274bbd9af5e89a13d78e1df20dda0a170baa87d552bc8db2295a74d3227dd74d9bb137954d8b2b0

            • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

              Filesize

              1.8MB

              MD5

              05bf47facd1f8b89c7cdaadc238ffb9a

              SHA1

              b43a5f8a3c7213162144402798fa7bc015c7fa23

              SHA256

              9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9

              SHA512

              d2e986d794130062b423657b3e40decdb682908c194b076e442a4f13272c296caf11cdde209a1b10abafde2f177c16384c8ca7655c22903e7e66796f08c0dcb7

            • memory/1036-62-0x00000000004D0000-0x00000000006C4000-memory.dmp

              Filesize

              2.0MB

            • memory/1036-64-0x00000000004D0000-0x00000000006C4000-memory.dmp

              Filesize

              2.0MB

            • memory/1036-66-0x00000000004D0000-0x00000000006C4000-memory.dmp

              Filesize

              2.0MB

            • memory/1036-68-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

              Filesize

              4KB

            • memory/1036-60-0x00000000004D0000-0x00000000006C4000-memory.dmp

              Filesize

              2.0MB

            • memory/1656-49-0x000000001C7D0000-0x000000001C7F2000-memory.dmp

              Filesize

              136KB

            • memory/1656-50-0x0000000003890000-0x00000000038A7000-memory.dmp

              Filesize

              92KB

            • memory/1656-69-0x0000000023F50000-0x0000000023F64000-memory.dmp

              Filesize

              80KB

            • memory/1656-59-0x0000000023590000-0x0000000023596000-memory.dmp

              Filesize

              24KB

            • memory/1656-43-0x00000000011E0000-0x00000000012A9000-memory.dmp

              Filesize

              804KB

            • memory/1656-42-0x0000000000D70000-0x0000000000DE1000-memory.dmp

              Filesize

              452KB

            • memory/1656-41-0x0000000000CD0000-0x0000000000D6C000-memory.dmp

              Filesize

              624KB

            • memory/1656-40-0x0000000000AA0000-0x0000000000BCD000-memory.dmp

              Filesize

              1.2MB

            • memory/1656-39-0x0000000000160000-0x000000000017F000-memory.dmp

              Filesize

              124KB

            • memory/1656-38-0x0000000000A00000-0x0000000000A9F000-memory.dmp

              Filesize

              636KB

            • memory/1656-44-0x0000000001440000-0x0000000001549000-memory.dmp

              Filesize

              1.0MB

            • memory/1656-46-0x0000000003510000-0x0000000003607000-memory.dmp

              Filesize

              988KB

            • memory/1656-47-0x0000000000E60000-0x00000000011DC000-memory.dmp

              Filesize

              3.5MB

            • memory/1656-48-0x000000001E850000-0x000000001E97C000-memory.dmp

              Filesize

              1.2MB

            • memory/1656-58-0x0000000023430000-0x000000002344A000-memory.dmp

              Filesize

              104KB

            • memory/1656-54-0x00000000239A0000-0x0000000023B01000-memory.dmp

              Filesize

              1.4MB

            • memory/1656-51-0x00000000224E0000-0x000000002257E000-memory.dmp

              Filesize

              632KB

            • memory/1656-52-0x0000000022F70000-0x0000000023010000-memory.dmp

              Filesize

              640KB

            • memory/1656-53-0x0000000023120000-0x0000000023335000-memory.dmp

              Filesize

              2.1MB

            • memory/1964-118-0x0000000000810000-0x000000000082A000-memory.dmp

              Filesize

              104KB

            • memory/2128-88-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

              Filesize

              4KB

            • memory/2156-106-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

              Filesize

              4KB

            • memory/2192-4-0x00000000003E0000-0x00000000008B0000-memory.dmp

              Filesize

              4.8MB

            • memory/2192-3-0x00000000003E0000-0x00000000008B0000-memory.dmp

              Filesize

              4.8MB

            • memory/2192-0-0x00000000003E0000-0x00000000008B0000-memory.dmp

              Filesize

              4.8MB

            • memory/2192-2-0x00000000003E1000-0x000000000040F000-memory.dmp

              Filesize

              184KB

            • memory/2192-15-0x0000000006EF0000-0x00000000073C0000-memory.dmp

              Filesize

              4.8MB

            • memory/2192-1-0x0000000077880000-0x0000000077882000-memory.dmp

              Filesize

              8KB

            • memory/2192-14-0x00000000003E0000-0x00000000008B0000-memory.dmp

              Filesize

              4.8MB

            • memory/2604-78-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

              Filesize

              4KB

            • memory/2704-17-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-21-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-79-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-18-0x00000000009B1000-0x00000000009DF000-memory.dmp

              Filesize

              184KB

            • memory/2704-56-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-109-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-57-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-55-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-19-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2704-22-0x00000000009B0000-0x0000000000E80000-memory.dmp

              Filesize

              4.8MB

            • memory/2968-97-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

              Filesize

              4KB