Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
26/09/2024, 17:50
General
- Target file.exe
- Size 1.8MB
- Sample240926-wek38ssgre
- SHA256 1232b1aee31f39db334e9233e7658f5dfdc588f3f698e619c3a0c9b3484c1629
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
stealc
-
save
-
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Stealc
Stealc is an infostealer written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Identifies Wine through registry keys 2 TTPs 12 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 5 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000354001\68d72f165e.exe"C:\Users\Admin\AppData\Local\Temp\1000354001\68d72f165e.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000355001\ea71ee9e62.exe"C:\Users\Admin\AppData\Local\Temp\1000355001\ea71ee9e62.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000023001\bf969c0a0d.exe"C:\Users\Admin\AppData\Local\Temp\1000023001\bf969c0a0d.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\1000026002\f831f69a2e.exe"C:\Users\Admin\1000026002\f831f69a2e.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000028001\144e809b6d.exe"C:\Users\Admin\AppData\Local\Temp\1000028001\144e809b6d.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd6⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0x78,0x124,0x7fffb8d1cc40,0x7fffb8d1cc4c,0x7fffb8d1cc587⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1888 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1928,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2096 /prefetch:37⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2460 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:17⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:17⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4620 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4712 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1100,i,5395654269688765053,11397871575423121564,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4796 /prefetch:87⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000029001\2225b392a3.exe"C:\Users\Admin\AppData\Local\Temp\1000029001\2225b392a3.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
BrowsingTopicsState
the-real-index
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
144e809b6d.exe
68d72f165e.exe
ea71ee9e62.exe
axplong.exe
memory/1536-304-0x0000000000140000-0x000000000060C000-memory.dmp
memory/1536-301-0x0000000000140000-0x000000000060C000-memory.dmp
memory/2060-240-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/2060-242-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/2872-41-0x0000000000730000-0x0000000000DCD000-memory.dmp
memory/2872-38-0x0000000000730000-0x0000000000DCD000-memory.dmp
memory/2872-40-0x0000000000731000-0x0000000000754000-memory.dmp
memory/2872-39-0x0000000005230000-0x0000000005231000-memory.dmp
memory/2992-108-0x0000000000130000-0x00000000007CD000-memory.dmp
memory/2992-107-0x0000000000130000-0x00000000007CD000-memory.dmp
memory/4100-241-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4100-243-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4100-300-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4100-305-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-285-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-317-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-340-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-306-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-198-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-72-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-296-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-269-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-266-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-264-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-220-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-244-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-109-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-328-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-236-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4356-110-0x0000000000A90000-0x0000000000F3D000-memory.dmp
memory/4476-268-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-19-0x0000000000141000-0x000000000016F000-memory.dmp
memory/4476-318-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-70-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-20-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-75-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-263-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-219-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-265-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-18-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-226-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-237-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-339-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-74-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-284-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-73-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-286-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-316-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-21-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-297-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-171-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4476-22-0x0000000000140000-0x000000000060C000-memory.dmp
memory/4544-69-0x0000000000100000-0x00000000005AD000-memory.dmp
memory/4544-57-0x0000000000100000-0x00000000005AD000-memory.dmp
memory/4760-3-0x0000000000F80000-0x000000000144C000-memory.dmp
memory/4760-4-0x0000000000F80000-0x000000000144C000-memory.dmp
memory/4760-2-0x0000000000F81000-0x0000000000FAF000-memory.dmp
memory/4760-17-0x0000000000F80000-0x000000000144C000-memory.dmp
memory/4760-0-0x0000000000F80000-0x000000000144C000-memory.dmp
memory/4760-1-0x0000000077C24000-0x0000000077C26000-memory.dmp
memory/4772-188-0x0000000000790000-0x0000000000C5C000-memory.dmp
memory/4772-192-0x0000000000790000-0x0000000000C5C000-memory.dmp
memory/5068-91-0x0000000000AC0000-0x000000000115D000-memory.dmp
memory/5068-92-0x0000000000AC0000-0x000000000115D000-memory.dmp