Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe
Resource
win7-20240708-en
General
-
Target
634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe
-
Size
3.1MB
-
MD5
1f3880629f4830ad6b109bec208f274a
-
SHA1
55e3d4d3536eb1620d635a6350db4709dcff0ce2
-
SHA256
634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321
-
SHA512
3ba9d448fe0de299cfc0f83e902e8149fedff5e9dd3e3cdc3ac7fb153d54e7ab829a25ddd8794470c8e78fdc9178ca690dc3f69ecd2a7b2d61a38180004915e4
-
SSDEEP
98304:pPR9FCxdTCuiZARs+txszDbFuMtzKBbSN:pPR9HksgxcHFbm5
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe -
Executes dropped EXE 2 IoCs
pid Process 2532 skotes.exe 1316 e01481a216.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine skotes.exe -
Loads dropped DLL 8 IoCs
pid Process 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 2532 skotes.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 2532 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2740 1316 WerFault.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e01481a216.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 2532 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2532 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 30 PID 2484 wrote to memory of 2532 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 30 PID 2484 wrote to memory of 2532 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 30 PID 2484 wrote to memory of 2532 2484 634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe 30 PID 2532 wrote to memory of 1316 2532 skotes.exe 33 PID 2532 wrote to memory of 1316 2532 skotes.exe 33 PID 2532 wrote to memory of 1316 2532 skotes.exe 33 PID 2532 wrote to memory of 1316 2532 skotes.exe 33 PID 1316 wrote to memory of 2740 1316 e01481a216.exe 34 PID 1316 wrote to memory of 2740 1316 e01481a216.exe 34 PID 1316 wrote to memory of 2740 1316 e01481a216.exe 34 PID 1316 wrote to memory of 2740 1316 e01481a216.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe"C:\Users\Admin\AppData\Local\Temp\634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\1013886001\e01481a216.exe"C:\Users\Admin\AppData\Local\Temp\1013886001\e01481a216.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 444⤵
- Loads dropped DLL
- Program crash
PID:2740
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD52a78ce9f3872f5e591d643459cabe476
SHA19ac947dfc71a868bc9c2eb2bd78dfb433067682e
SHA25621a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae
SHA51203e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9
-
Filesize
3.1MB
MD51f3880629f4830ad6b109bec208f274a
SHA155e3d4d3536eb1620d635a6350db4709dcff0ce2
SHA256634574bd010e80e3d6e50ef2483c5c74b9cf9685e0e8349159a1be862b8d7321
SHA5123ba9d448fe0de299cfc0f83e902e8149fedff5e9dd3e3cdc3ac7fb153d54e7ab829a25ddd8794470c8e78fdc9178ca690dc3f69ecd2a7b2d61a38180004915e4