Analysis

  • max time kernel
    67s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-09-2024 08:07

General

  • Target

    5d1a1cd27bacd3056147511b475f0953af2fba7dc50f73585944bbcb3bed6f47.exe

  • Size

    435KB

  • MD5

    6005662a18ecbc23f89481cb5ae9be73

  • SHA1

    bc4ec29220c54fe2cec779f738bae8f0fff91c8c

  • SHA256

    5d1a1cd27bacd3056147511b475f0953af2fba7dc50f73585944bbcb3bed6f47

  • SHA512

    e204c4b2f56616b5cbc222bf9bd111e4dd455ec32ad1d1dae833414e1945133f772f84a41cb0b48339245f6cc97bf1949523f4853fd42b96d5f77d8da62fcd1a

  • SSDEEP

    6144:sLq9GFWzmKJaexGmG2ugpIRk71J4AE1oYMEW6GQ4NqffzymNSZQ5FYc5KYi:sG9Ggta2Lpik2lSPQomzymNSMi

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

save

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d1a1cd27bacd3056147511b475f0953af2fba7dc50f73585944bbcb3bed6f47.exe
    "C:\Users\Admin\AppData\Local\Temp\5d1a1cd27bacd3056147511b475f0953af2fba7dc50f73585944bbcb3bed6f47.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Users\Admin\AppData\Local\Temp\1000023001\9fedc44b36.exe
        "C:\Users\Admin\AppData\Local\Temp\1000023001\9fedc44b36.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2632
      • C:\Users\Admin\1000026002\5dd4e155bd.exe
        "C:\Users\Admin\1000026002\5dd4e155bd.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1688
      • C:\Users\Admin\AppData\Local\Temp\1000028001\9b67ca5fa3.exe
        "C:\Users\Admin\AppData\Local\Temp\1000028001\9b67ca5fa3.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1920
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d19758,0x7fef6d19768,0x7fef6d19778
            5⤵
              PID:1156
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:2
              5⤵
                PID:1216
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:8
                5⤵
                  PID:1868
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:8
                  5⤵
                    PID:636
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2156 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:1
                    5⤵
                      PID:2504
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2164 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:1
                      5⤵
                        PID:1888
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3252 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:1
                        5⤵
                          PID:2612
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1400 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:2
                          5⤵
                            PID:1408
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 --field-trial-handle=1380,i,659298516237816222,12798015023229626716,131072 /prefetch:8
                            5⤵
                              PID:976
                        • C:\Users\Admin\AppData\Local\Temp\1000029001\a79e707c6f.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000029001\a79e707c6f.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Loads dropped DLL
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          PID:1296
                          • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                            "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
                            4⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3036
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:576

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                        Filesize

                        264KB

                        MD5

                        f50f89a0a91564d0b8a211f8921aa7de

                        SHA1

                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                        SHA256

                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                        SHA512

                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        61f4c8f9bbef8f3dd960043aa47d5842

                        SHA1

                        1e65de8ede719f5f2764259f6ebdb6b3246adbd5

                        SHA256

                        7e03e0d390f7cde356686e9cd72cb9f50d9fc544ca370ac6e8dc4dab56c5a9c5

                        SHA512

                        ff5e8ecfe68465a387409a486f3fabc69ca304a0fab9a1dd4ef8a312d16148a3ce719932e934588166b595f54ac037ba6666297549c5f00bef17a70d23fafbf5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                        Filesize

                        16B

                        MD5

                        18e723571b00fb1694a3bad6c78e4054

                        SHA1

                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                        SHA256

                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                        SHA512

                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d9c6a296-1adc-4ba3-89e0-9b75f3eedcdb.tmp

                        Filesize

                        6KB

                        MD5

                        28dd8170a0d23e83274150c39afbffa6

                        SHA1

                        d81ec21c17a1faaeb46b43d101c0339d8e2d2430

                        SHA256

                        b3273c0d4523bd68dcd1cb36b7c594ac85fc2e0c91bd82a4fc66550625dfe48f

                        SHA512

                        bbd40381443ae82b42aea5e6b08e34229bdc61adc9223f782098809c3c8852aa2c1953ee0245b5cbf57a24073f3929640b80e0ccb92a9291de5f97bff3af4572

                      • C:\Users\Admin\AppData\Local\Temp\1000023001\9fedc44b36.exe

                        Filesize

                        1.8MB

                        MD5

                        2ff9d81435c7d755cb5a6b975ed50ce6

                        SHA1

                        a588fbde21ac7335c3b516db6ccaa783eb2a088c

                        SHA256

                        162e527a19799d2d3ace95ca315eba1ffa0fd4fd3eac247a26b41212033b2863

                        SHA512

                        46688a8fb90c3b3bcb926e6b37129ebd45297283150e61450b685f792d20f7d5d2d88ea2487f73dd76d6e20b513f43ba143ff9d321b47f4f4563287e02a9e235

                      • C:\Users\Admin\AppData\Local\Temp\1000028001\9b67ca5fa3.exe

                        Filesize

                        1.1MB

                        MD5

                        cda0b8ef0af532cf29045c06142ce1f8

                        SHA1

                        39b7bd4dadc3172152d727dd9633916ae1a8fd7d

                        SHA256

                        3129cc8fa8430ac67ed710a05d4227d636612387b02125b8006117c40c79e5b6

                        SHA512

                        40f6209a1b41e952eb5b96cadcfa87bdc5a9ceaf7f1f438beff20378d620eada3031485b179ef58920d23d6563324269206a2243d0cfb3ad58811827d39071f2

                      • C:\Users\Admin\AppData\Local\Temp\1000029001\a79e707c6f.exe

                        Filesize

                        1.8MB

                        MD5

                        2dbfc6089fd5e3b1aa8a004508a16a37

                        SHA1

                        20331e184251ff628c6e3593511fc6ab93349058

                        SHA256

                        99bc61afdb7382ac8d7f9da3bb87ca552fe8596ded65bf39a81d2f7839bbc3d6

                        SHA512

                        03f5390778ce28d28d6e4c60af50f0ee32f1e4adf1b0ea1958bd9897db919f63817f1a0df8b4b4ae03ac90d4e797a2a1db380f9fce9d6ef33575101c4a640629

                      • \??\pipe\crashpad_1920_ALMYWZREVZGBJKRG

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                        Filesize

                        435KB

                        MD5

                        6005662a18ecbc23f89481cb5ae9be73

                        SHA1

                        bc4ec29220c54fe2cec779f738bae8f0fff91c8c

                        SHA256

                        5d1a1cd27bacd3056147511b475f0953af2fba7dc50f73585944bbcb3bed6f47

                        SHA512

                        e204c4b2f56616b5cbc222bf9bd111e4dd455ec32ad1d1dae833414e1945133f772f84a41cb0b48339245f6cc97bf1949523f4853fd42b96d5f77d8da62fcd1a

                      • memory/588-24-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-85-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/588-25-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-27-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-23-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-43-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/588-46-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-45-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/588-209-0x0000000003EB0000-0x0000000004350000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/588-192-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-59-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/588-67-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/588-181-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/588-169-0x0000000003EB0000-0x0000000004350000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/588-155-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/588-84-0x0000000003EB0000-0x0000000004559000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/1296-170-0x0000000000D90000-0x0000000001230000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/1296-182-0x0000000006D70000-0x0000000007210000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/1296-186-0x0000000000D90000-0x0000000001230000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/1688-69-0x0000000000ED0000-0x0000000001579000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/1688-68-0x0000000000ED0000-0x0000000001579000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/2376-19-0x0000000000670000-0x0000000000770000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2376-1-0x0000000000670000-0x0000000000770000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2376-5-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/2376-20-0x0000000000400000-0x000000000046F000-memory.dmp

                        Filesize

                        444KB

                      • memory/2376-18-0x0000000000220000-0x000000000028A000-memory.dmp

                        Filesize

                        424KB

                      • memory/2376-21-0x0000000000400000-0x0000000000568000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/2376-3-0x0000000000400000-0x000000000046F000-memory.dmp

                        Filesize

                        444KB

                      • memory/2376-2-0x0000000000220000-0x000000000028A000-memory.dmp

                        Filesize

                        424KB

                      • memory/2632-49-0x00000000013D0000-0x0000000001A79000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/2632-47-0x00000000013D0000-0x0000000001A79000-memory.dmp

                        Filesize

                        6.7MB

                      • memory/3036-183-0x0000000000F00000-0x00000000013A0000-memory.dmp

                        Filesize

                        4.6MB