Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/11/2024, 18:28
General
- Target 526e7692bca7ee6efee8c13d543791dcae7f1cc6ac74651b6b2fb94f7c8cbe6d.exe
- Size 3.0MB
- Sample241111-w4hpeasmfx
- SHA256 526e7692bca7ee6efee8c13d543791dcae7f1cc6ac74651b6b2fb94f7c8cbe6d
Malware Config
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
-
lumma
-
https://scriptyprefej.store
-
https://navygenerayk.store
-
https://founpiuer.store
-
https://necklacedmny.store
-
https://thumbystriw.store
-
https://fadehairucw.store
-
https://crisiwarny.store
-
https://presticitpo.store
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Drops file in Windows directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\526e7692bca7ee6efee8c13d543791dcae7f1cc6ac74651b6b2fb94f7c8cbe6d.exe"C:\Users\Admin\AppData\Local\Temp\526e7692bca7ee6efee8c13d543791dcae7f1cc6ac74651b6b2fb94f7c8cbe6d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1005591001\6eaccee7f5.exe"C:\Users\Admin\AppData\Local\Temp\1005591001\6eaccee7f5.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1005592001\a49b742706.exe"C:\Users\Admin\AppData\Local\Temp\1005592001\a49b742706.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1005594001\8413405d70.exe"C:\Users\Admin\AppData\Local\Temp\1005594001\8413405d70.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1005595041\k4pDgO.ps1"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mshta.EXEC:\Windows\system32\mshta.EXE vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -ep bypass -File """"C:\Users\Admin\AppData\Roaming\Adobe\xuYFSayk2.ps1 """""" ,0:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File "C:\Users\Admin\AppData\Roaming\Adobe\xuYFSayk2.ps1 "2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
6eaccee7f5.exe
a49b742706.exe
8413405d70.exe
k4pDgO.ps1
__PSScriptPolicyTest_gekpa1oo.31y.ps1
skotes.exe
JCAjfbUwkOnEIRfxzMVt.txt
xuYFSayk1.ps1
xuYFSayk2.ps1
xuYFSayk3.ps1
memory/1016-120-0x0000000007BD0000-0x0000000007C02000-memory.dmp
memory/1016-115-0x0000000007510000-0x0000000007532000-memory.dmp
memory/1016-135-0x0000000007D30000-0x0000000007D41000-memory.dmp
memory/1016-133-0x0000000007C30000-0x0000000007CD3000-memory.dmp
memory/1016-132-0x0000000007C10000-0x0000000007C2E000-memory.dmp
memory/1016-122-0x00000000703C0000-0x0000000070714000-memory.dmp
memory/1016-121-0x0000000070260000-0x00000000702AC000-memory.dmp
memory/1016-109-0x0000000006510000-0x000000000652E000-memory.dmp
memory/1016-119-0x0000000007A80000-0x0000000007AC0000-memory.dmp
memory/1016-118-0x0000000007A30000-0x0000000007A38000-memory.dmp
memory/1016-117-0x0000000008FC0000-0x00000000094EC000-memory.dmp
memory/1016-136-0x0000000007D70000-0x0000000007D7E000-memory.dmp
memory/1016-116-0x00000000084E0000-0x0000000008A84000-memory.dmp
memory/1016-134-0x0000000007D20000-0x0000000007D2A000-memory.dmp
memory/1016-137-0x0000000008B50000-0x0000000008B7A000-memory.dmp
memory/1016-114-0x00000000077E0000-0x0000000007876000-memory.dmp
memory/1016-113-0x0000000006A70000-0x0000000006A8A000-memory.dmp
memory/1016-112-0x0000000007E60000-0x00000000084DA000-memory.dmp
memory/1016-138-0x0000000008B80000-0x0000000008BA4000-memory.dmp
memory/1016-93-0x0000000004FA0000-0x0000000004FD6000-memory.dmp
memory/1016-94-0x00000000057D0000-0x0000000005DF8000-memory.dmp
memory/1016-95-0x0000000005660000-0x0000000005682000-memory.dmp
memory/1016-96-0x0000000005E70000-0x0000000005ED6000-memory.dmp
memory/1016-97-0x0000000005EE0000-0x0000000005F46000-memory.dmp
memory/1016-139-0x0000000008C20000-0x0000000008CB2000-memory.dmp
memory/1016-107-0x0000000006050000-0x00000000063A4000-memory.dmp
memory/1016-110-0x0000000006540000-0x000000000658C000-memory.dmp
memory/1728-46-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-39-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-16-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-161-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-108-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-194-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-193-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-192-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-191-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-189-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-42-0x0000000000761000-0x00000000007C9000-memory.dmp
memory/1728-169-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-165-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-158-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-164-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-22-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-21-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-20-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-19-0x0000000000761000-0x00000000007C9000-memory.dmp
memory/1728-163-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/1728-162-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/2864-141-0x0000000000AB0000-0x0000000000D6C000-memory.dmp
memory/2864-146-0x0000000000AB0000-0x0000000000D6C000-memory.dmp
memory/2864-83-0x0000000000AB0000-0x0000000000D6C000-memory.dmp
memory/2864-84-0x0000000000AB0000-0x0000000000D6C000-memory.dmp
memory/2864-85-0x0000000000AB0000-0x0000000000D6C000-memory.dmp
memory/3508-148-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/3508-150-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/3588-17-0x0000000000200000-0x000000000050D000-memory.dmp
memory/3588-18-0x0000000000201000-0x0000000000269000-memory.dmp
memory/3588-1-0x0000000077DE4000-0x0000000077DE6000-memory.dmp
memory/3588-0-0x0000000000200000-0x000000000050D000-memory.dmp
memory/3588-3-0x0000000000200000-0x000000000050D000-memory.dmp
memory/3588-2-0x0000000000201000-0x0000000000269000-memory.dmp
memory/3588-4-0x0000000000200000-0x000000000050D000-memory.dmp
memory/4028-168-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/4028-167-0x0000000000760000-0x0000000000A6D000-memory.dmp
memory/4400-41-0x0000000000EF0000-0x00000000011FF000-memory.dmp
memory/4400-45-0x0000000000EF1000-0x0000000000F49000-memory.dmp
memory/4400-40-0x0000000000EF1000-0x0000000000F49000-memory.dmp
memory/4400-43-0x0000000000EF0000-0x00000000011FF000-memory.dmp
memory/4400-38-0x0000000000EF0000-0x00000000011FF000-memory.dmp
memory/4516-176-0x00000268A4540000-0x00000268A4562000-memory.dmp
memory/4516-188-0x00000268A5340000-0x00000268A5976000-memory.dmp
memory/4872-62-0x0000000000F90000-0x0000000001602000-memory.dmp
memory/4872-63-0x0000000000F90000-0x0000000001602000-memory.dmp