Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 23:27
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.9MB
-
MD5
544ca28aa15b5ed1c6ee914b09e6f3c2
-
SHA1
4b1a98399c63e9b3220cfb4b7f23f4297fae6365
-
SHA256
1af2f5a32ad1db3ad373935626a38cc897ec5b717a43ec7dc2d3e507f034aa7d
-
SHA512
6b6f1e113bb1de11caa4f7d287fa7c31a1b79c127eef99f315ff27ea06c4ae7fea93d80a7e5a0a06fea27347359f6d766956aecc4573b22c4a9ce812bce1e4fc
-
SSDEEP
49152:NH09SO0SzQIL/QU3TR7u9ZlxJd3dbjJ1Qs/vVhkE+:NH09SOtVL/pTUZdd3mmSE+
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
file.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
file.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Executes dropped EXE 1 IoCs
Processes:
axplong.exepid process 2808 axplong.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
file.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine axplong.exe -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 2792 file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
file.exeaxplong.exepid process 2792 file.exe 2808 axplong.exe -
Drops file in Windows directory 1 IoCs
Processes:
file.exedescription ioc process File created C:\Windows\Tasks\axplong.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
file.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exeaxplong.exepid process 2792 file.exe 2808 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
file.exepid process 2792 file.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
file.exedescription pid process target process PID 2792 wrote to memory of 2808 2792 file.exe axplong.exe PID 2792 wrote to memory of 2808 2792 file.exe axplong.exe PID 2792 wrote to memory of 2808 2792 file.exe axplong.exe PID 2792 wrote to memory of 2808 2792 file.exe axplong.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5544ca28aa15b5ed1c6ee914b09e6f3c2
SHA14b1a98399c63e9b3220cfb4b7f23f4297fae6365
SHA2561af2f5a32ad1db3ad373935626a38cc897ec5b717a43ec7dc2d3e507f034aa7d
SHA5126b6f1e113bb1de11caa4f7d287fa7c31a1b79c127eef99f315ff27ea06c4ae7fea93d80a7e5a0a06fea27347359f6d766956aecc4573b22c4a9ce812bce1e4fc