Analysis

  • max time kernel
    113s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 02:43

General

  • Target

    52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21fN.exe

  • Size

    2.9MB

  • MD5

    30825fab1d50f101d38373952e92f6e0

  • SHA1

    69d1860c308b3fb30519402aa1e08df365dc35e4

  • SHA256

    52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21f

  • SHA512

    c8f26dccc3fbfdf254a1d322fb2c32a9299be93f826d29339c05035594ee52bfc2ac5ce42baa21b1ae2a9063a0b5731e0c30399b0cb435b6440d27605dbee975

  • SSDEEP

    49152:cZ/jf/q95mWke8XmcIUJAkGXP5yJBHlyWhav:s/q95mWke82hUJAkGXBy7Hh

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21fN.exe
        "C:\Users\Admin\AppData\Local\Temp\52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21fN.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Users\Admin\AppData\Local\Temp\1006906001\4de87e0737.exe
            "C:\Users\Admin\AppData\Local\Temp\1006906001\4de87e0737.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1080
          • C:\Users\Admin\AppData\Local\Temp\1006907001\9a588140ce.exe
            "C:\Users\Admin\AppData\Local\Temp\1006907001\9a588140ce.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1280
          • C:\Users\Admin\AppData\Local\Temp\1006908001\22b1f31335.exe
            "C:\Users\Admin\AppData\Local\Temp\1006908001\22b1f31335.exe"
            4⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1068
          • C:\Users\Admin\AppData\Local\Temp\1006909001\495561f58f.exe
            "C:\Users\Admin\AppData\Local\Temp\1006909001\495561f58f.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:2492
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2408

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1006906001\4de87e0737.exe

      Filesize

      2.8MB

      MD5

      f10511fc918f0b1648e448adabadb5ac

      SHA1

      de86f9989345f527964309965735cdaee4935ff9

      SHA256

      b60a85fbc4a8c4db17b7a02e922fa6354ed7bab533fab292fc79b6c73e17e1b4

      SHA512

      414055e0a1f1d3c625de5f36e69530bf8f3e88b77e56ec95dd64761580a0f1ac32cd42b1ad30fb8ad9ae8382d610a4ea7d8c0c368b03a615b046cfeaea22040b

    • C:\Users\Admin\AppData\Local\Temp\1006907001\9a588140ce.exe

      Filesize

      1.9MB

      MD5

      129e9d731c27f28d25a824fecd066e54

      SHA1

      c42fb09e9dbbb309db3a30deecf9a0edd285e7a1

      SHA256

      0186a9725d8a17443751c82eee6683e68637fe4fd6f041f5d5855e6d8bd5ec47

      SHA512

      a243cc3e7fd661bc37f90165f8494d45edb1a038e2e56513c256d1666d901298992d42390baed8c18f1ea68ac5400a8d2da9c25e49fc89315b6a2ae07e96f6fb

    • C:\Users\Admin\AppData\Local\Temp\1006908001\22b1f31335.exe

      Filesize

      4.2MB

      MD5

      3fcd7adcd85540ce4d7097b400381963

      SHA1

      be68d28acb2c143a5d45bea59b9dfdf7bd4ad617

      SHA256

      08187fe32be97680f07b29be1fb116c2e19e2f380f6e5c2cdb18272bb3f9c2e7

      SHA512

      e8c7e58b9c9bcbe5a20b40207754c5345480a4d905f01be3ff1806f4708fca8263885ababf14b54fa7b38f6c4aaadd4c9284908c4e2bb09fd64933cfdb7fca55

    • C:\Users\Admin\AppData\Local\Temp\1006909001\495561f58f.exe

      Filesize

      4.3MB

      MD5

      9bd5b9ceba49c19a9c2f80c23279d441

      SHA1

      58f855a1fd2fba52a9dab57da4b762e9620e437d

      SHA256

      ede017ad6960a447c0f2337c5bee277d1ce62ee31fb9685e5a2a4628f0e6b31f

      SHA512

      5a643d4afcd9eed9b2423256871c9d2859e14f5e8a36f6c8641efd95dfab5f86b82cbf2c1be32b85a954ce84c970e792759a5d29b7bb5d6bcdaa8a9e30a73f9a

    • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

      Filesize

      2.9MB

      MD5

      30825fab1d50f101d38373952e92f6e0

      SHA1

      69d1860c308b3fb30519402aa1e08df365dc35e4

      SHA256

      52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21f

      SHA512

      c8f26dccc3fbfdf254a1d322fb2c32a9299be93f826d29339c05035594ee52bfc2ac5ce42baa21b1ae2a9063a0b5731e0c30399b0cb435b6440d27605dbee975

    • memory/1068-125-0x00000000009F0000-0x0000000001651000-memory.dmp

      Filesize

      12.4MB

    • memory/1068-124-0x00000000009F0000-0x0000000001651000-memory.dmp

      Filesize

      12.4MB

    • memory/1068-123-0x00000000009F0000-0x0000000001651000-memory.dmp

      Filesize

      12.4MB

    • memory/1068-101-0x00000000009F0000-0x0000000001651000-memory.dmp

      Filesize

      12.4MB

    • memory/1080-44-0x0000000000FF0000-0x00000000014F4000-memory.dmp

      Filesize

      5.0MB

    • memory/1080-41-0x0000000000FF0000-0x00000000014F4000-memory.dmp

      Filesize

      5.0MB

    • memory/1280-72-0x0000000075A90000-0x0000000075AD7000-memory.dmp

      Filesize

      284KB

    • memory/1280-69-0x0000000004BA0000-0x0000000004FA0000-memory.dmp

      Filesize

      4.0MB

    • memory/1280-68-0x0000000004BA0000-0x0000000004FA0000-memory.dmp

      Filesize

      4.0MB

    • memory/1280-70-0x0000000077270000-0x0000000077419000-memory.dmp

      Filesize

      1.7MB

    • memory/1280-64-0x00000000009C0000-0x0000000000E88000-memory.dmp

      Filesize

      4.8MB

    • memory/1280-76-0x00000000009C0000-0x0000000000E88000-memory.dmp

      Filesize

      4.8MB

    • memory/2344-4-0x0000000000C70000-0x0000000000F92000-memory.dmp

      Filesize

      3.1MB

    • memory/2344-6-0x0000000000C70000-0x0000000000F92000-memory.dmp

      Filesize

      3.1MB

    • memory/2344-19-0x0000000000C70000-0x0000000000F92000-memory.dmp

      Filesize

      3.1MB

    • memory/2344-5-0x0000000000C70000-0x0000000000F92000-memory.dmp

      Filesize

      3.1MB

    • memory/2344-3-0x0000000000C70000-0x0000000000F92000-memory.dmp

      Filesize

      3.1MB

    • memory/2344-2-0x0000000000C71000-0x0000000000C9F000-memory.dmp

      Filesize

      184KB

    • memory/2344-0-0x0000000000C70000-0x0000000000F92000-memory.dmp

      Filesize

      3.1MB

    • memory/2344-1-0x0000000077460000-0x0000000077462000-memory.dmp

      Filesize

      8KB

    • memory/2408-81-0x0000000075A90000-0x0000000075AD7000-memory.dmp

      Filesize

      284KB

    • memory/2408-79-0x0000000077270000-0x0000000077419000-memory.dmp

      Filesize

      1.7MB

    • memory/2408-78-0x0000000001F10000-0x0000000002310000-memory.dmp

      Filesize

      4.0MB

    • memory/2408-74-0x0000000000080000-0x000000000008A000-memory.dmp

      Filesize

      40KB

    • memory/2492-121-0x0000000000CE0000-0x0000000001920000-memory.dmp

      Filesize

      12.2MB

    • memory/2492-119-0x0000000000CE0000-0x0000000001920000-memory.dmp

      Filesize

      12.2MB

    • memory/2864-99-0x00000000060E0000-0x0000000006D41000-memory.dmp

      Filesize

      12.4MB

    • memory/2864-135-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-118-0x00000000060E0000-0x0000000006D20000-memory.dmp

      Filesize

      12.2MB

    • memory/2864-63-0x00000000060E0000-0x00000000065A8000-memory.dmp

      Filesize

      4.8MB

    • memory/2864-61-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-21-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-91-0x00000000060E0000-0x00000000065E4000-memory.dmp

      Filesize

      5.0MB

    • memory/2864-67-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-100-0x00000000060E0000-0x0000000006D41000-memory.dmp

      Filesize

      12.4MB

    • memory/2864-42-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-103-0x00000000060E0000-0x00000000065A8000-memory.dmp

      Filesize

      4.8MB

    • memory/2864-102-0x00000000060E0000-0x00000000065A8000-memory.dmp

      Filesize

      4.8MB

    • memory/2864-104-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-22-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-62-0x00000000060E0000-0x00000000065A8000-memory.dmp

      Filesize

      4.8MB

    • memory/2864-24-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-65-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-122-0x00000000060E0000-0x0000000006D41000-memory.dmp

      Filesize

      12.4MB

    • memory/2864-40-0x00000000060E0000-0x00000000065E4000-memory.dmp

      Filesize

      5.0MB

    • memory/2864-23-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-26-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-126-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-127-0x00000000060E0000-0x0000000006D20000-memory.dmp

      Filesize

      12.2MB

    • memory/2864-128-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-129-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-130-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-131-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-132-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-133-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-134-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB

    • memory/2864-66-0x0000000000BD0000-0x0000000000EF2000-memory.dmp

      Filesize

      3.1MB