Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-12-2024 17:02

General

  • Target

    1658f0e2c9dfe87a46080d606c06ebbfd93f4d85b92a00c0da651f756cf2d04d.exe

  • Size

    3.0MB

  • MD5

    9c5d114ce9d0008f2f10b8065b0f3bcd

  • SHA1

    bb55eae46c7c5df146693981498e0c4bf22ee9e5

  • SHA256

    1658f0e2c9dfe87a46080d606c06ebbfd93f4d85b92a00c0da651f756cf2d04d

  • SHA512

    8dfe5e1369fc5b9f9518c50b9e64b460127905ac1eb81ddd592af4e3891a3f41c39057323fff965f8039464acd55da632d354d252ab25bd8d9377b5535623a30

  • SSDEEP

    49152:zbqzGqEs/TRMr4ydSGWr3epgIrLvOUcCx9SUMK16dLeavoT5XJjlk0N:E0s/TRdydArkgInvcCx9vMKIdqavgxd

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1658f0e2c9dfe87a46080d606c06ebbfd93f4d85b92a00c0da651f756cf2d04d.exe
    "C:\Users\Admin\AppData\Local\Temp\1658f0e2c9dfe87a46080d606c06ebbfd93f4d85b92a00c0da651f756cf2d04d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Users\Admin\AppData\Local\Temp\1013760001\a8c3b6306e.exe
        "C:\Users\Admin\AppData\Local\Temp\1013760001\a8c3b6306e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\download[1].htm

    Filesize

    1B

    MD5

    cfcd208495d565ef66e7dff9f98764da

    SHA1

    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

    SHA256

    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

    SHA512

    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

  • C:\Users\Admin\AppData\Local\Temp\1013760001\a8c3b6306e.exe

    Filesize

    1.9MB

    MD5

    b16a303612f8717a90851727a25fdf61

    SHA1

    20281be28ae8c170b6dff5939fabd5616e9b7d23

    SHA256

    14a7faa5a16cbc6e031beb668ec24d78b04d8fe4959766cf11722932b93317dc

    SHA512

    c1c83b89a760997dc6740d940628fb7d68e3d82018b55c428ac1fcec0cde4b81ca943ef3dfd247212a14dd5b0eac20e4b4ba7f55b6154ea33a75920be032e196

  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

    Filesize

    3.0MB

    MD5

    9c5d114ce9d0008f2f10b8065b0f3bcd

    SHA1

    bb55eae46c7c5df146693981498e0c4bf22ee9e5

    SHA256

    1658f0e2c9dfe87a46080d606c06ebbfd93f4d85b92a00c0da651f756cf2d04d

    SHA512

    8dfe5e1369fc5b9f9518c50b9e64b460127905ac1eb81ddd592af4e3891a3f41c39057323fff965f8039464acd55da632d354d252ab25bd8d9377b5535623a30

  • \Users\Admin\AppData\Local\Temp\DEFRwdFs31D\Y-Cleaner.exe

    Filesize

    1.4MB

    MD5

    a8cf5621811f7fac55cfe8cb3fa6b9f6

    SHA1

    121356839e8138a03141f5f5856936a85bd2a474

    SHA256

    614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

    SHA512

    4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

  • memory/900-84-0x0000000000400000-0x0000000000C71000-memory.dmp

    Filesize

    8.4MB

  • memory/900-72-0x0000000000400000-0x0000000000C71000-memory.dmp

    Filesize

    8.4MB

  • memory/900-66-0x0000000000400000-0x0000000000C71000-memory.dmp

    Filesize

    8.4MB

  • memory/900-58-0x0000000000400000-0x0000000000C71000-memory.dmp

    Filesize

    8.4MB

  • memory/900-59-0x0000000000400000-0x0000000000C71000-memory.dmp

    Filesize

    8.4MB

  • memory/900-53-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/900-44-0x0000000000400000-0x0000000000C71000-memory.dmp

    Filesize

    8.4MB

  • memory/1652-48-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-85-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-34-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-41-0x0000000006810000-0x0000000007081000-memory.dmp

    Filesize

    8.4MB

  • memory/1652-45-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-42-0x0000000006810000-0x0000000007081000-memory.dmp

    Filesize

    8.4MB

  • memory/1652-22-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-46-0x0000000000D51000-0x0000000000DB9000-memory.dmp

    Filesize

    416KB

  • memory/1652-47-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-94-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-21-0x0000000000D51000-0x0000000000DB9000-memory.dmp

    Filesize

    416KB

  • memory/1652-56-0x0000000006810000-0x0000000007081000-memory.dmp

    Filesize

    8.4MB

  • memory/1652-19-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-93-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-62-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-92-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-91-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-68-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-90-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-74-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-89-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-88-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-24-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-86-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/1652-87-0x0000000000D50000-0x0000000001057000-memory.dmp

    Filesize

    3.0MB

  • memory/2700-1-0x0000000077760000-0x0000000077762000-memory.dmp

    Filesize

    8KB

  • memory/2700-2-0x0000000000241000-0x00000000002A9000-memory.dmp

    Filesize

    416KB

  • memory/2700-3-0x0000000000240000-0x0000000000547000-memory.dmp

    Filesize

    3.0MB

  • memory/2700-5-0x0000000000240000-0x0000000000547000-memory.dmp

    Filesize

    3.0MB

  • memory/2700-18-0x0000000000240000-0x0000000000547000-memory.dmp

    Filesize

    3.0MB

  • memory/2700-20-0x0000000000241000-0x00000000002A9000-memory.dmp

    Filesize

    416KB

  • memory/2700-0-0x0000000000240000-0x0000000000547000-memory.dmp

    Filesize

    3.0MB