Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 19:30

General

  • Target

    8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe

  • Size

    1.8MB

  • MD5

    be131b7bc8cd4eb30eb81ccceeaaea4d

  • SHA1

    d3370bc98065a5b0d11b06a089f9280e184325b1

  • SHA256

    8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60

  • SHA512

    d3923b754ad3199815d154b996f6fc620ef2a4752e337268ebf46263271d434a35cb94ce0f48c54250a0f3e5284fa263ce00b518df577b76d3ee03b3635a5c9c

  • SSDEEP

    49152:x1C65bDvLzDByacb4n+rK7oXKjdPSoj+:xMGbbQai4nMSpSo

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe
    "C:\Users\Admin\AppData\Local\Temp\8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Users\Admin\AppData\Local\Temp\1008250001\d5403bf8da.exe
        "C:\Users\Admin\AppData\Local\Temp\1008250001\d5403bf8da.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7839758,0x7fef7839768,0x7fef7839778
            5⤵
              PID:2500
            • C:\Windows\system32\ctfmon.exe
              ctfmon.exe
              5⤵
                PID:1844
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:2
                5⤵
                  PID:1724
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:8
                  5⤵
                    PID:948
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:8
                    5⤵
                      PID:1472
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:1544
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:1384
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1396 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:2
                      5⤵
                        PID:2984
                    • C:\Users\Admin\AppData\Local\Temp\service123.exe
                      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2264
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:900
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 956
                      4⤵
                      • Loads dropped DLL
                      • Program crash
                      PID:1456
              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                1⤵
                  PID:2004
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {D2F8EA68-FCF1-4226-A450-B5AB627D52F8} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
                  1⤵
                    PID:2964
                    • C:\Users\Admin\AppData\Local\Temp\service123.exe
                      C:\Users\Admin\AppData\Local\Temp\/service123.exe
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2176

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                    Filesize

                    264KB

                    MD5

                    f50f89a0a91564d0b8a211f8921aa7de

                    SHA1

                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                    SHA256

                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                    SHA512

                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                    Filesize

                    16B

                    MD5

                    18e723571b00fb1694a3bad6c78e4054

                    SHA1

                    afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                    SHA256

                    8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                    SHA512

                    43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                  • C:\Users\Admin\AppData\Local\Temp\1008250001\d5403bf8da.exe

                    Filesize

                    4.2MB

                    MD5

                    3540f08b37b30b6c554e0e5ff05a8e97

                    SHA1

                    1ca146fe61b66a73900f1008f8267ec5554413c2

                    SHA256

                    562ab7435cbde0c5528a05f60ce959fa9b428d3378f4d0f5b22f48eb09fe13e6

                    SHA512

                    9ca4c49a620c2cb06a8c334d1cdce999579f3dcd472b10e7227c54089efe9e68844bfc0e2d34e0b72558e714b01094eeaa849b30566b1d7e7461fe928f1ed201

                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                    Filesize

                    1.8MB

                    MD5

                    be131b7bc8cd4eb30eb81ccceeaaea4d

                    SHA1

                    d3370bc98065a5b0d11b06a089f9280e184325b1

                    SHA256

                    8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60

                    SHA512

                    d3923b754ad3199815d154b996f6fc620ef2a4752e337268ebf46263271d434a35cb94ce0f48c54250a0f3e5284fa263ce00b518df577b76d3ee03b3635a5c9c

                  • memory/2156-116-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-42-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-107-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-111-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-57-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-109-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-49-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                    Filesize

                    10.4MB

                  • memory/2156-114-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-137-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-134-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-118-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2156-45-0x0000000000310000-0x0000000000F72000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2176-146-0x00000000001B0000-0x00000000001C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2264-139-0x00000000737A0000-0x00000000738D4000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2264-138-0x00000000001B0000-0x00000000001C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2596-0-0x0000000000FF0000-0x0000000001492000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2596-10-0x0000000000FF0000-0x0000000001492000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2596-2-0x0000000000FF1000-0x000000000101F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2596-5-0x0000000000FF0000-0x0000000001492000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2596-1-0x00000000774E0000-0x00000000774E2000-memory.dmp

                    Filesize

                    8KB

                  • memory/2596-17-0x0000000000FF0000-0x0000000001492000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2596-3-0x0000000000FF0000-0x0000000001492000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2596-14-0x00000000064D0000-0x0000000006972000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-43-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-41-0x0000000005FD0000-0x0000000006C32000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2920-108-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-150-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-110-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-58-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-112-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-47-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-115-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-44-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-117-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-46-0x0000000005FD0000-0x0000000006C32000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2920-119-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-40-0x0000000005FD0000-0x0000000006C32000-memory.dmp

                    Filesize

                    12.4MB

                  • memory/2920-135-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-38-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-21-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-22-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-140-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-19-0x0000000000071000-0x000000000009F000-memory.dmp

                    Filesize

                    184KB

                  • memory/2920-147-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-18-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB

                  • memory/2920-153-0x0000000000070000-0x0000000000512000-memory.dmp

                    Filesize

                    4.6MB