Behavioral task
behavioral1
Sample
3028-3-0x0000000001390000-0x000000000183C000-memory.exe
Resource
win7-20240704-en
General
-
Target
3028-3-0x0000000001390000-0x000000000183C000-memory.dmp
-
Size
4.7MB
-
MD5
ec3c47267d4ea07b88eb8f9510e8c664
-
SHA1
fccd7b9e5cd03ae7176cd162e9769a868c38d60e
-
SHA256
4e29d59e5320c0eabfcc6aa47ef0ee9866b297dc358f94555c5d249c8b8e448f
-
SHA512
0a2f7362d6565ac15000a3a6ce9a50cdf1406fe570375e74cdf4cd469d5459b948cb2402e8d0f041b81d1dc46d6afb50ff134add1054333eed2823a88374b336
-
SSDEEP
98304:GHLrltMHPyjVw6xZVbVyUvjlDsKpa55SAAlTlgwEsKlYRQa7dyVuw5wLSE6ymriM:GIHAORkAQTGw1KlM7SESWSj
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3028-3-0x0000000001390000-0x000000000183C000-memory.dmp
Files
-
3028-3-0x0000000001390000-0x000000000183C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xtqiedmi Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pzupkaig Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE