Analysis

  • max time kernel
    112s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 02:43

General

  • Target

    52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21fN.exe

  • Size

    2.9MB

  • MD5

    30825fab1d50f101d38373952e92f6e0

  • SHA1

    69d1860c308b3fb30519402aa1e08df365dc35e4

  • SHA256

    52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21f

  • SHA512

    c8f26dccc3fbfdf254a1d322fb2c32a9299be93f826d29339c05035594ee52bfc2ac5ce42baa21b1ae2a9063a0b5731e0c30399b0cb435b6440d27605dbee975

  • SSDEEP

    49152:cZ/jf/q95mWke8XmcIUJAkGXP5yJBHlyWhav:s/q95mWke82hUJAkGXBy7Hh

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3000
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4304
    • C:\Users\Admin\AppData\Local\Temp\52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21fN.exe
      "C:\Users\Admin\AppData\Local\Temp\52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21fN.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Users\Admin\AppData\Local\Temp\1006906001\397d8d4d18.exe
          "C:\Users\Admin\AppData\Local\Temp\1006906001\397d8d4d18.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3456
        • C:\Users\Admin\AppData\Local\Temp\1006907001\5fe0f93f98.exe
          "C:\Users\Admin\AppData\Local\Temp\1006907001\5fe0f93f98.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4528
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 536
            4⤵
            • Program crash
            PID:720
        • C:\Users\Admin\AppData\Local\Temp\1006908001\59f67974a8.exe
          "C:\Users\Admin\AppData\Local\Temp\1006908001\59f67974a8.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:756
        • C:\Users\Admin\AppData\Local\Temp\1006909001\db33e9282f.exe
          "C:\Users\Admin\AppData\Local\Temp\1006909001\db33e9282f.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2616
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:636
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4528 -ip 4528
      1⤵
        PID:2192
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2424

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1006906001\397d8d4d18.exe

        Filesize

        2.8MB

        MD5

        f10511fc918f0b1648e448adabadb5ac

        SHA1

        de86f9989345f527964309965735cdaee4935ff9

        SHA256

        b60a85fbc4a8c4db17b7a02e922fa6354ed7bab533fab292fc79b6c73e17e1b4

        SHA512

        414055e0a1f1d3c625de5f36e69530bf8f3e88b77e56ec95dd64761580a0f1ac32cd42b1ad30fb8ad9ae8382d610a4ea7d8c0c368b03a615b046cfeaea22040b

      • C:\Users\Admin\AppData\Local\Temp\1006907001\5fe0f93f98.exe

        Filesize

        1.9MB

        MD5

        129e9d731c27f28d25a824fecd066e54

        SHA1

        c42fb09e9dbbb309db3a30deecf9a0edd285e7a1

        SHA256

        0186a9725d8a17443751c82eee6683e68637fe4fd6f041f5d5855e6d8bd5ec47

        SHA512

        a243cc3e7fd661bc37f90165f8494d45edb1a038e2e56513c256d1666d901298992d42390baed8c18f1ea68ac5400a8d2da9c25e49fc89315b6a2ae07e96f6fb

      • C:\Users\Admin\AppData\Local\Temp\1006908001\59f67974a8.exe

        Filesize

        4.2MB

        MD5

        3fcd7adcd85540ce4d7097b400381963

        SHA1

        be68d28acb2c143a5d45bea59b9dfdf7bd4ad617

        SHA256

        08187fe32be97680f07b29be1fb116c2e19e2f380f6e5c2cdb18272bb3f9c2e7

        SHA512

        e8c7e58b9c9bcbe5a20b40207754c5345480a4d905f01be3ff1806f4708fca8263885ababf14b54fa7b38f6c4aaadd4c9284908c4e2bb09fd64933cfdb7fca55

      • C:\Users\Admin\AppData\Local\Temp\1006909001\db33e9282f.exe

        Filesize

        4.3MB

        MD5

        9bd5b9ceba49c19a9c2f80c23279d441

        SHA1

        58f855a1fd2fba52a9dab57da4b762e9620e437d

        SHA256

        ede017ad6960a447c0f2337c5bee277d1ce62ee31fb9685e5a2a4628f0e6b31f

        SHA512

        5a643d4afcd9eed9b2423256871c9d2859e14f5e8a36f6c8641efd95dfab5f86b82cbf2c1be32b85a954ce84c970e792759a5d29b7bb5d6bcdaa8a9e30a73f9a

      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

        Filesize

        2.9MB

        MD5

        30825fab1d50f101d38373952e92f6e0

        SHA1

        69d1860c308b3fb30519402aa1e08df365dc35e4

        SHA256

        52ce481ea201d8a0e9e9f5e89023b883334035e1427b85d2977f9c74e682d21f

        SHA512

        c8f26dccc3fbfdf254a1d322fb2c32a9299be93f826d29339c05035594ee52bfc2ac5ce42baa21b1ae2a9063a0b5731e0c30399b0cb435b6440d27605dbee975

      • memory/636-65-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/636-78-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/756-118-0x0000000000C40000-0x00000000018A1000-memory.dmp

        Filesize

        12.4MB

      • memory/756-117-0x0000000000C40000-0x00000000018A1000-memory.dmp

        Filesize

        12.4MB

      • memory/756-97-0x0000000000C40000-0x00000000018A1000-memory.dmp

        Filesize

        12.4MB

      • memory/2424-124-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/2424-126-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/2616-114-0x0000000000090000-0x0000000000CD0000-memory.dmp

        Filesize

        12.2MB

      • memory/2616-113-0x0000000000090000-0x0000000000CD0000-memory.dmp

        Filesize

        12.2MB

      • memory/3276-20-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-119-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-121-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-22-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-120-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-59-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-62-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-21-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-64-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-122-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-19-0x0000000000B81000-0x0000000000BAF000-memory.dmp

        Filesize

        184KB

      • memory/3276-81-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-115-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-18-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-127-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-128-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-129-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-130-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3276-131-0x0000000000B80000-0x0000000000EA2000-memory.dmp

        Filesize

        3.1MB

      • memory/3456-38-0x0000000000F50000-0x0000000001454000-memory.dmp

        Filesize

        5.0MB

      • memory/3456-41-0x0000000000F50000-0x0000000001454000-memory.dmp

        Filesize

        5.0MB

      • memory/3456-39-0x0000000000F51000-0x0000000000F68000-memory.dmp

        Filesize

        92KB

      • memory/3456-40-0x0000000000F50000-0x0000000001454000-memory.dmp

        Filesize

        5.0MB

      • memory/3916-1-0x0000000077D54000-0x0000000077D56000-memory.dmp

        Filesize

        8KB

      • memory/3916-2-0x0000000000311000-0x000000000033F000-memory.dmp

        Filesize

        184KB

      • memory/3916-3-0x0000000000310000-0x0000000000632000-memory.dmp

        Filesize

        3.1MB

      • memory/3916-4-0x0000000000310000-0x0000000000632000-memory.dmp

        Filesize

        3.1MB

      • memory/3916-17-0x0000000000310000-0x0000000000632000-memory.dmp

        Filesize

        3.1MB

      • memory/3916-0-0x0000000000310000-0x0000000000632000-memory.dmp

        Filesize

        3.1MB

      • memory/4304-71-0x0000000000D80000-0x0000000000D8A000-memory.dmp

        Filesize

        40KB

      • memory/4304-73-0x0000000001510000-0x0000000001910000-memory.dmp

        Filesize

        4.0MB

      • memory/4304-74-0x00007FFE82690000-0x00007FFE82885000-memory.dmp

        Filesize

        2.0MB

      • memory/4304-77-0x00000000775F0000-0x0000000077805000-memory.dmp

        Filesize

        2.1MB

      • memory/4528-60-0x0000000000D40000-0x0000000001208000-memory.dmp

        Filesize

        4.8MB

      • memory/4528-66-0x0000000005290000-0x0000000005690000-memory.dmp

        Filesize

        4.0MB

      • memory/4528-67-0x0000000005290000-0x0000000005690000-memory.dmp

        Filesize

        4.0MB

      • memory/4528-68-0x00007FFE82690000-0x00007FFE82885000-memory.dmp

        Filesize

        2.0MB

      • memory/4528-70-0x00000000775F0000-0x0000000077805000-memory.dmp

        Filesize

        2.1MB

      • memory/4528-80-0x0000000000D40000-0x0000000001208000-memory.dmp

        Filesize

        4.8MB