Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
8367d2f6ef5e11db59ec8e4295378853
-
SHA1
9653847b6ec9f36137fbe7c68b991e74f54cc7dd
-
SHA256
08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
-
SHA512
681420d694ad6aa33d4150137892c7199dee045f3bf1d38174d25c14c38bc99a4518c6e9c860cdc66d3f00d1c8c6b477a379d96e68d6de8bca55919b2b309fac
-
SSDEEP
24576:2F9unCPFskHeI52FzFYhJFqOZAZKKF0m8qaYJgprK8EaCAJE9v139qPVKZQmzEIv:2FCAGkHezz7nPN81L+lEHOrvYbz4
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
file.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
file.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Executes dropped EXE 1 IoCs
Processes:
axplong.exepid process 2688 axplong.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
file.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine axplong.exe -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 2404 file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
file.exeaxplong.exepid process 2404 file.exe 2688 axplong.exe -
Drops file in Windows directory 1 IoCs
Processes:
file.exedescription ioc process File created C:\Windows\Tasks\axplong.job file.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
file.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exeaxplong.exepid process 2404 file.exe 2688 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
file.exepid process 2404 file.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
file.exedescription pid process target process PID 2404 wrote to memory of 2688 2404 file.exe axplong.exe PID 2404 wrote to memory of 2688 2404 file.exe axplong.exe PID 2404 wrote to memory of 2688 2404 file.exe axplong.exe PID 2404 wrote to memory of 2688 2404 file.exe axplong.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD58367d2f6ef5e11db59ec8e4295378853
SHA19653847b6ec9f36137fbe7c68b991e74f54cc7dd
SHA25608cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
SHA512681420d694ad6aa33d4150137892c7199dee045f3bf1d38174d25c14c38bc99a4518c6e9c860cdc66d3f00d1c8c6b477a379d96e68d6de8bca55919b2b309fac