amadey | 586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/12/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
Size

1.8MB
MD5

1ce4a796ecbb274e2642a4235547263d
SHA1

97f07f6369ea6b4a8bd567a26a45b1b4725bd897
SHA256

586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6
SHA512

599be766010c2082da0430b8f412b7f9b019e73c027e0deba6a19a4bed2377520404305533b470779771b489310cd11d7c31712976067e9757f9d7c59f76f7fa
SSDEEP

49152:8IbJbaQFrNnQWaTcpXFhM4vfKmw3yg5tp65FI/5SG:pv1Fh1cyqp65Fb

Score

10^/10

amadey lumma stealc fed3aa stok discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

lumma

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	480dc6fa29.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7b3482e50b.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	480dc6fa29.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	480dc6fa29.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7b3482e50b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7b3482e50b.exe

Executes dropped EXE 3 IoCs

pid	Process
2848	axplong.exe
1012	7b3482e50b.exe
1244	480dc6fa29.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	7b3482e50b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	480dc6fa29.exe

Loads dropped DLL 5 IoCs

pid	Process
2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
2848	axplong.exe
2848	axplong.exe
2848	axplong.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\7b3482e50b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1005847001\\7b3482e50b.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\480dc6fa29.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1005848001\\480dc6fa29.exe"	axplong.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
2848	axplong.exe
1012	7b3482e50b.exe
1244	480dc6fa29.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b3482e50b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	480dc6fa29.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
2848	axplong.exe
1012	7b3482e50b.exe
1244	480dc6fa29.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2848	2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe	30
PID 2516 wrote to memory of 2848	2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe	30
PID 2516 wrote to memory of 2848	2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe	30
PID 2516 wrote to memory of 2848	2516	586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe	30
PID 2848 wrote to memory of 1012	2848	axplong.exe	32
PID 2848 wrote to memory of 1012	2848	axplong.exe	32
PID 2848 wrote to memory of 1012	2848	axplong.exe	32
PID 2848 wrote to memory of 1012	2848	axplong.exe	32
PID 2848 wrote to memory of 1244	2848	axplong.exe	33
PID 2848 wrote to memory of 1244	2848	axplong.exe	33
PID 2848 wrote to memory of 1244	2848	axplong.exe	33
PID 2848 wrote to memory of 1244	2848	axplong.exe	33

C:\Users\Admin\AppData\Local\Temp\586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe
"C:\Users\Admin\AppData\Local\Temp\586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\1005847001\7b3482e50b.exe
    "C:\Users\Admin\AppData\Local\Temp\1005847001\7b3482e50b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1012
- - C:\Users\Admin\AppData\Local\Temp\1005848001\480dc6fa29.exe
    "C:\Users\Admin\AppData\Local\Temp\1005848001\480dc6fa29.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1005847001\7b3482e50b.exe

Filesize
1.7MB

MD5
e113c7c881355590d17b82cdd27e9c7d

SHA1
ef5b7dcac182074a561fd2e1fb2eda69ac3a40bf

SHA256
e8589e69f99d96c0c35c02ac0bdbb97cf3263855396f0408ec1f52e41d75a49b

SHA512
7eb5b668f6f2d517ddbee8928756fe877c971beee8f88801d0a4a0492696a291a19c803ecbb5eb77f31febdfb0187272a3037f48fb527e8334c5dc26abdadbeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005848001\480dc6fa29.exe

Filesize
1.8MB

MD5
9035a7790366c718391f37fd13a52b71

SHA1
00cffbc4cf948aa8a4a20c535da13b90099da1f7

SHA256
7800195f1a9a7e6c04d66b85215f58ca240b9d6bb3f369d1ba8e150b95ae583c

SHA512
ef277aab36d4549a26a596dcf93131d9314e23d97ea901a212f9f57f27693baa3ae54fdbd2d7f41197fd94d7e84ca894fc5ddc97ea7f2e77258d347a123ded68

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
1ce4a796ecbb274e2642a4235547263d

SHA1
97f07f6369ea6b4a8bd567a26a45b1b4725bd897

SHA256
586b16d7c9a91ab17b825b5830613442410f163a5eeee5d44f11714ff421e9e6

SHA512
599be766010c2082da0430b8f412b7f9b019e73c027e0deba6a19a4bed2377520404305533b470779771b489310cd11d7c31712976067e9757f9d7c59f76f7fa

Download Submit
memory/1012-47-0x00000000002E0000-0x0000000000975000-memory.dmp

Filesize
6.6MB

Download
memory/1012-45-0x00000000002E0000-0x0000000000975000-memory.dmp

Filesize
6.6MB

Download
memory/1244-68-0x0000000000FD0000-0x0000000001483000-memory.dmp

Filesize
4.7MB

Download
memory/1244-65-0x0000000000FD0000-0x0000000001483000-memory.dmp

Filesize
4.7MB

Download
memory/2516-20-0x0000000006B60000-0x0000000007018000-memory.dmp

Filesize
4.7MB

Download
memory/2516-19-0x0000000000030000-0x00000000004E8000-memory.dmp

Filesize
4.7MB

Download
memory/2516-17-0x0000000000030000-0x00000000004E8000-memory.dmp

Filesize
4.7MB

Download
memory/2516-5-0x0000000000030000-0x00000000004E8000-memory.dmp

Filesize
4.7MB

Download
memory/2516-0-0x0000000000030000-0x00000000004E8000-memory.dmp

Filesize
4.7MB

Download
memory/2516-3-0x0000000000030000-0x00000000004E8000-memory.dmp

Filesize
4.7MB

Download
memory/2516-2-0x0000000000031000-0x000000000005F000-memory.dmp

Filesize
184KB

Download
memory/2516-1-0x0000000077C30000-0x0000000077C32000-memory.dmp

Filesize
8KB

Download
memory/2848-23-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-72-0x0000000006880000-0x0000000006D33000-memory.dmp

Filesize
4.7MB

Download
memory/2848-41-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-42-0x0000000006880000-0x0000000006F15000-memory.dmp

Filesize
6.6MB

Download
memory/2848-48-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-25-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-62-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-22-0x0000000000101000-0x000000000012F000-memory.dmp

Filesize
184KB

Download
memory/2848-64-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-66-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-63-0x0000000006880000-0x0000000006D33000-memory.dmp

Filesize
4.7MB

Download
memory/2848-21-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-69-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-70-0x0000000006880000-0x0000000006F15000-memory.dmp

Filesize
6.6MB

Download
memory/2848-71-0x0000000006880000-0x0000000006F15000-memory.dmp

Filesize
6.6MB

Download
memory/2848-44-0x0000000006880000-0x0000000006F15000-memory.dmp

Filesize
6.6MB

Download
memory/2848-73-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-74-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-75-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-76-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-77-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-78-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-79-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-80-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-81-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-82-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-83-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-84-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download
memory/2848-85-0x0000000000100000-0x00000000005B8000-memory.dmp

Filesize
4.7MB

Download