Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 19:37
Static task
static1
Behavioral task
behavioral1
Sample
017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe
Resource
win7-20241010-en
General
-
Target
017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe
-
Size
1.8MB
-
MD5
fcef19f8625006d98f0f55d5723b5298
-
SHA1
4944a4b08c759e674cc37fdaedeea148ef758744
-
SHA256
017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08
-
SHA512
23af21f03a7a863baf5618be447297f06f35283f1d5e13fc9c8ee109bb6526cdedeaa16df559d9e42c909fa197aa67db7c64929be534f7246db94b27c7992d30
-
SSDEEP
49152:5WFDSDNlEstMehfBwe/WHGZDPgVW0DW40fNQ2:PNqs+ejL/ZDY50z
Malware Config
Extracted
amadey
5.04
4bee07
http://185.215.113.209
-
install_dir
fc9e0aaab7
-
install_file
defnur.exe
-
strings_key
191655f008adc880f91bfc85bc56db54
-
url_paths
/Fru7Nk9/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ defnur.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ defnur.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ defnur.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ defnur.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 23 1784 rundll32.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion defnur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion defnur.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation defnur.exe -
Executes dropped EXE 6 IoCs
pid Process 2740 defnur.exe 3672 defnur.exe 2904 a196953c36.exe 4388 kreon.exe 4168 defnur.exe 3660 defnur.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine defnur.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine defnur.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine defnur.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine defnur.exe -
Loads dropped DLL 1 IoCs
pid Process 1784 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kreon = "C:\\Users\\Admin\\AppData\\Local\\kreon.exe" a196953c36.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 28 raw.githubusercontent.com 29 raw.githubusercontent.com 36 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe 2740 defnur.exe 3672 defnur.exe 4168 defnur.exe 3660 defnur.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\defnur.job 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language defnur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3000 cmd.exe 2144 cmd.exe 4920 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4920 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe 2740 defnur.exe 2740 defnur.exe 3672 defnur.exe 3672 defnur.exe 4168 defnur.exe 4168 defnur.exe 3660 defnur.exe 3660 defnur.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2740 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe 83 PID 1360 wrote to memory of 2740 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe 83 PID 1360 wrote to memory of 2740 1360 017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe 83 PID 2740 wrote to memory of 1784 2740 defnur.exe 98 PID 2740 wrote to memory of 1784 2740 defnur.exe 98 PID 2740 wrote to memory of 1784 2740 defnur.exe 98 PID 2740 wrote to memory of 2904 2740 defnur.exe 99 PID 2740 wrote to memory of 2904 2740 defnur.exe 99 PID 2904 wrote to memory of 3000 2904 a196953c36.exe 101 PID 2904 wrote to memory of 3000 2904 a196953c36.exe 101 PID 3000 wrote to memory of 2144 3000 cmd.exe 103 PID 3000 wrote to memory of 2144 3000 cmd.exe 103 PID 2144 wrote to memory of 4920 2144 cmd.exe 105 PID 2144 wrote to memory of 4920 2144 cmd.exe 105 PID 2144 wrote to memory of 4388 2144 cmd.exe 107 PID 2144 wrote to memory of 4388 2144 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe"C:\Users\Admin\AppData\Local\Temp\017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\10004470101\a196953c36.exe"C:\Users\Admin\AppData\Local\Temp\10004470101\a196953c36.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\cmd.execmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\system32\PING.EXEping localhost -n 16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4920
-
-
C:\Users\Admin\AppData\Local\kreon.exeC:\Users\Admin\AppData\Local\kreon.exe6⤵
- Executes dropped EXE
PID:4388
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exeC:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3672
-
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exeC:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4168
-
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exeC:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3660
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Filesize471B
MD5e2705e3c0b0e009059f5ad82eeb98524
SHA123733d25f7f0b5c98cf4ef33871e651b94d58dbf
SHA256d1041d807bfc245a95dbc19bb7bfd5b68f2cc14830da05840123a96518fd66be
SHA512db932648a6d64b9b8fc0d689a1ec0ff76919d1afe3c24bc1dbd7cd63f7a7392df10d0a2165be31c38883dd74840605e5e8a8052f75a37794027770e1aed18db3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Filesize412B
MD5ea445700bc78c7b7721cf40277d55e8b
SHA12098a355f6dcad3bd0a6d9abac0307c26b0632ae
SHA25611db861921753710188d835feac7b3849a000c31436e85dbf8feb300bb8564ee
SHA5122585814685beb111118e63759cf2922d7b1825677c279424d666df4c4c756105140bf6d7dbbf813234791d67b2e9ff52b0d096142aebe5a8b13ea2153a15810c
-
Filesize
3.5MB
MD5ca480193e4b8159dd1283118ebde8896
SHA1857fb4852f31428ead5e2d9fbd5bfb16d9714d1a
SHA256377717dd342a9169589d1e2c8509d12ceafe9c43b3407ab16771ec611a367a2a
SHA512a49927f1dffe8d14f592e767415c490f4bdc9fb5d7ce45f10f5e6c7aa5c20b79412abc8d4f799cfd88aeeac3ef73f55a9710503a9a612efb5d414ec95a3e7ed9
-
Filesize
1.8MB
MD5fcef19f8625006d98f0f55d5723b5298
SHA14944a4b08c759e674cc37fdaedeea148ef758744
SHA256017fe2be76b891716b444e4b519e4585177bd04d3b173bde24c28d458631eb08
SHA51223af21f03a7a863baf5618be447297f06f35283f1d5e13fc9c8ee109bb6526cdedeaa16df559d9e42c909fa197aa67db7c64929be534f7246db94b27c7992d30
-
Filesize
124KB
MD50d3418372c854ee228b78e16ea7059be
SHA1c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1
SHA256885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7
SHA512e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19