Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 13:43
Static task
static1
General
-
Target
4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe
-
Size
3.1MB
-
MD5
539341782f4a87527e7fa92a400d7f22
-
SHA1
e42c8be2c48096fb20972e4798b479e107750289
-
SHA256
4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849
-
SHA512
5df8530c8357b092dbf2fb519473ea7479cd12eb90798dfeb9a7c2b40529906537c538c986ef16c62bda4614e7d1493670f872d6c648b65cff2698a07d1dc6bb
-
SSDEEP
98304:/fpFTvdHRZa3Hwc+u1utfTdQIuhcwl7R:H7TvfndQIuhcw
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://drive-connect.cyou/api
Extracted
lumma
https://drive-connect.cyou/api
https://covery-mover.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 711c66b5a9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 711c66b5a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 711c66b5a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 10b1441140.exe -
Executes dropped EXE 8 IoCs
pid Process 3364 skotes.exe 4664 711c66b5a9.exe 4576 fbdebd1e0a.exe 1648 fbdebd1e0a.exe 828 10b1441140.exe 1080 skotes.exe 5088 skotes.exe 352 skotes.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine 711c66b5a9.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine skotes.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe 3364 skotes.exe 4664 711c66b5a9.exe 1080 skotes.exe 5088 skotes.exe 352 skotes.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4576 set thread context of 1648 4576 fbdebd1e0a.exe 91 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4648 828 WerFault.exe 92 4668 4664 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711c66b5a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdebd1e0a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdebd1e0a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10b1441140.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 10b1441140.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 10b1441140.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2232 timeout.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe 3364 skotes.exe 3364 skotes.exe 4664 711c66b5a9.exe 4664 711c66b5a9.exe 828 10b1441140.exe 828 10b1441140.exe 1080 skotes.exe 1080 skotes.exe 5088 skotes.exe 5088 skotes.exe 352 skotes.exe 352 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1248 wrote to memory of 3364 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe 82 PID 1248 wrote to memory of 3364 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe 82 PID 1248 wrote to memory of 3364 1248 4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe 82 PID 3364 wrote to memory of 4664 3364 skotes.exe 86 PID 3364 wrote to memory of 4664 3364 skotes.exe 86 PID 3364 wrote to memory of 4664 3364 skotes.exe 86 PID 3364 wrote to memory of 4576 3364 skotes.exe 88 PID 3364 wrote to memory of 4576 3364 skotes.exe 88 PID 3364 wrote to memory of 4576 3364 skotes.exe 88 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 4576 wrote to memory of 1648 4576 fbdebd1e0a.exe 91 PID 3364 wrote to memory of 828 3364 skotes.exe 92 PID 3364 wrote to memory of 828 3364 skotes.exe 92 PID 3364 wrote to memory of 828 3364 skotes.exe 92 PID 828 wrote to memory of 2416 828 10b1441140.exe 95 PID 828 wrote to memory of 2416 828 10b1441140.exe 95 PID 828 wrote to memory of 2416 828 10b1441140.exe 95 PID 2416 wrote to memory of 2232 2416 cmd.exe 99 PID 2416 wrote to memory of 2232 2416 cmd.exe 99 PID 2416 wrote to memory of 2232 2416 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe"C:\Users\Admin\AppData\Local\Temp\4be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\1014408001\711c66b5a9.exe"C:\Users\Admin\AppData\Local\Temp\1014408001\711c66b5a9.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 14644⤵
- Program crash
PID:4668
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014409001\fbdebd1e0a.exe"C:\Users\Admin\AppData\Local\Temp\1014409001\fbdebd1e0a.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\1014409001\fbdebd1e0a.exe"C:\Users\Admin\AppData\Local\Temp\1014409001\fbdebd1e0a.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1648
-
-
-
C:\Users\Admin\AppData\Local\Temp\1014410001\10b1441140.exe"C:\Users\Admin\AppData\Local\Temp\1014410001\10b1441140.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014410001\10b1441140.exe" & rd /s /q "C:\ProgramData\1DBSJMYU3EKN" & exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 21204⤵
- Program crash
PID:4648
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 828 -ip 8281⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4664 -ip 46641⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
1.9MB
MD5c270b2bd3dd5cbc4eca9a2337870d80f
SHA105215b2a48284f2025fd54e98ba89e60e1b825b8
SHA25631e2255304e6a0eb615cc93c582567c46e8e0aa948eaa8bd28db603730428004
SHA5122120b40c6cfae4e62150d726512ee940893b81963fec14d62fbe087d3baf15b97f729677a478113f3e5a6ac62b88324af95cb9d2a2ac9417c6ad1685bfee2615
-
Filesize
710KB
MD528e568616a7b792cac1726deb77d9039
SHA139890a418fb391b823ed5084533e2e24dff021e1
SHA2569597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2
SHA51285048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
3.1MB
MD5539341782f4a87527e7fa92a400d7f22
SHA1e42c8be2c48096fb20972e4798b479e107750289
SHA2564be2c4d5712a87cd800b8d7a8eebc0bc57e473bd83c83c7ea71d1954a4ab5849
SHA5125df8530c8357b092dbf2fb519473ea7479cd12eb90798dfeb9a7c2b40529906537c538c986ef16c62bda4614e7d1493670f872d6c648b65cff2698a07d1dc6bb