Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 21:17

General

  • Target

    aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe

  • Size

    3.1MB

  • MD5

    5414a4ee71faf061656cf6e5799f6814

  • SHA1

    131d118f0a2a8b8347f81dccf232c1126581a48e

  • SHA256

    aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a

  • SHA512

    ab30851216dde32626a62ecaeaab6289d2239a4b8547726fece82c3a744e6deee7ce9886cd1cf8d03ffb95d05a02386a6ecf583099cc803a87517ed20b5d3b87

  • SSDEEP

    49152:2z+UsTxH00MQH4F6yyqG0pQKvH4uKtBbD1ajFa:2z4H5MQYF65GqKwfrbpajFa

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe
    "C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe
        "C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1676
      • C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe
        "C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2976
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
          PID:1608
        • C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe
          "C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe"
          3⤵
          • Modifies Windows Defender Real-time Protection settings
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Windows security modification
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:836
        • C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
          "C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe"
          3⤵
          • Executes dropped EXE
          PID:1636

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe

      Filesize

      3.0MB

      MD5

      1679847fc3d6173b33c5bc2b2edca142

      SHA1

      8e76660cbe31c9ccfd9d43aebcff9e0c9150660f

      SHA256

      af2c8e421a858c0cf7f416d78c3beba9cb0d53808ab4492fe2a2a747aa7bb0e7

      SHA512

      c0ffa44a2b2ed196bf3022b053f7a6f2ec03299997535e1069e505e20446ee61d31dbd124fb9e4582c5f71d0fc39a84e6e72fc182716504e097b6a18f95de5b7

    • C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe

      Filesize

      1.8MB

      MD5

      7496ab59ffb86bf1c658489ca7128933

      SHA1

      4b5aff93958a89d2778de9a17918b2df96cf8807

      SHA256

      bd7faaaf7173bc1fb80c8d60df889957e073407939b3f2aed28a62f61f8ad3d4

      SHA512

      050db57d5aedd88b1f38c0a1c216abd383f272225710e7ca3aae2f546d061aaddf57701f3e098b545f9a5a984d86750fcb90acede70e3b65f423c284964305cf

    • C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe

      Filesize

      2.7MB

      MD5

      2786f43899bd5d2876cd6591848f9b13

      SHA1

      2b5d7dec2e55d9bbc30deaa8b7dfcc9d2686e057

      SHA256

      ea665102e0e2ca7b45bb70ccaef20fc995403d09d75a820e8bbf969a161d5143

      SHA512

      aa50a04a07e45a74c373a92f00aa4c750b2fd35fc76c6b70a64d932b23e785d7193a7a6ac1cf8db6e51bb419e4c6ff77fdf85ddf7d7655e92600a667bc609be9

    • C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

      Filesize

      33.3MB

      MD5

      8fb77810c61e160a657298815346996e

      SHA1

      4268420571bb1a858bc6a9744c0742d6fd738a83

      SHA256

      a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66

      SHA512

      b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

    • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

      Filesize

      3.1MB

      MD5

      5414a4ee71faf061656cf6e5799f6814

      SHA1

      131d118f0a2a8b8347f81dccf232c1126581a48e

      SHA256

      aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a

      SHA512

      ab30851216dde32626a62ecaeaab6289d2239a4b8547726fece82c3a744e6deee7ce9886cd1cf8d03ffb95d05a02386a6ecf583099cc803a87517ed20b5d3b87

    • memory/836-100-0x0000000000900000-0x0000000000BB6000-memory.dmp

      Filesize

      2.7MB

    • memory/836-98-0x0000000000900000-0x0000000000BB6000-memory.dmp

      Filesize

      2.7MB

    • memory/836-93-0x0000000000900000-0x0000000000BB6000-memory.dmp

      Filesize

      2.7MB

    • memory/836-92-0x0000000000900000-0x0000000000BB6000-memory.dmp

      Filesize

      2.7MB

    • memory/836-91-0x0000000000900000-0x0000000000BB6000-memory.dmp

      Filesize

      2.7MB

    • memory/1676-69-0x00000000013C0000-0x00000000016CB000-memory.dmp

      Filesize

      3.0MB

    • memory/1676-41-0x00000000013C0000-0x00000000016CB000-memory.dmp

      Filesize

      3.0MB

    • memory/2224-23-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-89-0x0000000006710000-0x0000000006DCA000-memory.dmp

      Filesize

      6.7MB

    • memory/2224-21-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-43-0x00000000000C1000-0x0000000000129000-memory.dmp

      Filesize

      416KB

    • memory/2224-42-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-22-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-40-0x00000000060F0000-0x00000000063FB000-memory.dmp

      Filesize

      3.0MB

    • memory/2224-44-0x00000000060F0000-0x00000000063FB000-memory.dmp

      Filesize

      3.0MB

    • memory/2224-45-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-47-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-48-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-19-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-64-0x0000000006710000-0x0000000006DCA000-memory.dmp

      Filesize

      6.7MB

    • memory/2224-66-0x0000000006710000-0x0000000006DCA000-memory.dmp

      Filesize

      6.7MB

    • memory/2224-124-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-18-0x00000000000C1000-0x0000000000129000-memory.dmp

      Filesize

      416KB

    • memory/2224-70-0x00000000060F0000-0x00000000063FB000-memory.dmp

      Filesize

      3.0MB

    • memory/2224-123-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-74-0x00000000060F0000-0x00000000063FB000-memory.dmp

      Filesize

      3.0MB

    • memory/2224-75-0x0000000005F60000-0x0000000006273000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-122-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-121-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-16-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-90-0x0000000006110000-0x00000000063C6000-memory.dmp

      Filesize

      2.7MB

    • memory/2224-120-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-107-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-94-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-95-0x0000000005F60000-0x0000000006273000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-96-0x0000000006110000-0x00000000063C6000-memory.dmp

      Filesize

      2.7MB

    • memory/2224-106-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-105-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-101-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-102-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-103-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2224-104-0x00000000000C0000-0x00000000003D3000-memory.dmp

      Filesize

      3.1MB

    • memory/2672-2-0x0000000000871000-0x00000000008D9000-memory.dmp

      Filesize

      416KB

    • memory/2672-3-0x0000000000870000-0x0000000000B83000-memory.dmp

      Filesize

      3.1MB

    • memory/2672-5-0x0000000000870000-0x0000000000B83000-memory.dmp

      Filesize

      3.1MB

    • memory/2672-1-0x0000000077C80000-0x0000000077C82000-memory.dmp

      Filesize

      8KB

    • memory/2672-14-0x0000000000870000-0x0000000000B83000-memory.dmp

      Filesize

      3.1MB

    • memory/2672-0-0x0000000000870000-0x0000000000B83000-memory.dmp

      Filesize

      3.1MB

    • memory/2672-17-0x0000000000871000-0x00000000008D9000-memory.dmp

      Filesize

      416KB

    • memory/2976-71-0x00000000012D0000-0x000000000198A000-memory.dmp

      Filesize

      6.7MB

    • memory/2976-67-0x00000000012D0000-0x000000000198A000-memory.dmp

      Filesize

      6.7MB