Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 10:50

General

  • Target

    091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade.exe

  • Size

    2.9MB

  • MD5

    657b1d5bada53a94c7eb16a8f6780aef

  • SHA1

    3f913ed5ca66f8d29d2ea004792ba71fd3b157bc

  • SHA256

    091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade

  • SHA512

    7d3c5072fd4f5a3d542028798dddce15d0cf8c4a682c897d9075a8a825739842320bea82592ff9fbdc977519e5f933e8e78ac203b2c8d67ae5de62ae414cb4a9

  • SSDEEP

    49152:zG+JsK+1+7eu5B7x+DBPdkR/QkQJYVHgwLrNIX:zG+Jskeu5nknkNnRHNI

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

cryptbot

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2996
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3928
    • C:\Users\Admin\AppData\Local\Temp\091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade.exe
      "C:\Users\Admin\AppData\Local\Temp\091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Users\Admin\AppData\Local\Temp\1016876001\5b375ee085.exe
          "C:\Users\Admin\AppData\Local\Temp\1016876001\5b375ee085.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 536
            4⤵
            • Program crash
            PID:3360
        • C:\Users\Admin\AppData\Local\Temp\1016877001\93d1ebe82d.exe
          "C:\Users\Admin\AppData\Local\Temp\1016877001\93d1ebe82d.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2188
          • C:\Users\Admin\AppData\Local\Temp\1016877001\93d1ebe82d.exe
            "C:\Users\Admin\AppData\Local\Temp\1016877001\93d1ebe82d.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4336
        • C:\Users\Admin\AppData\Local\Temp\1016878001\c44673a8fa.exe
          "C:\Users\Admin\AppData\Local\Temp\1016878001\c44673a8fa.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2516
        • C:\Users\Admin\AppData\Local\Temp\1016879001\8fd9317161.exe
          "C:\Users\Admin\AppData\Local\Temp\1016879001\8fd9317161.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Users\Admin\AppData\Local\Temp\1016879001\8fd9317161.exe
            "C:\Users\Admin\AppData\Local\Temp\1016879001\8fd9317161.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2568
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1372 -ip 1372
      1⤵
        PID:944
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3596
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3248
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4572

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1016876001\5b375ee085.exe

        Filesize

        1.9MB

        MD5

        914bc5e4ca51b1218f63a8539614dcbc

        SHA1

        5edab3b12041e423a1321bd656b55f7f6a3c76f9

        SHA256

        e77eb409d5ab219632439eddc1019746c132ca68cbdbf3f63deda117f010bb01

        SHA512

        7d301c0e284ccff3694108e48e027784a7292dd17b9c9746822b64d0415f26cc3d737d6f19a8bc912b4a44c9b262aba00bae5cd484c3e0b9b8dc63ac889229fb

      • C:\Users\Admin\AppData\Local\Temp\1016877001\93d1ebe82d.exe

        Filesize

        747KB

        MD5

        8a9cb17c0224a01bd34b46495983c50a

        SHA1

        00296ea6a56f6e10a0f1450a20c5fb329b8856c1

        SHA256

        3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

        SHA512

        1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

      • C:\Users\Admin\AppData\Local\Temp\1016878001\c44673a8fa.exe

        Filesize

        4.3MB

        MD5

        3287ce2d6be3f77c5d1e7cc351f4ad5f

        SHA1

        d9f04b9c1d610402c10c27772169d9e911d9adf5

        SHA256

        7619900af0011cd2b40be259c52acf7e7415532d002a09267bcfb823ea1f38c4

        SHA512

        f3f99e918f412a511c1324e89359645a37933f855b3da5214611906b861203ae6aad20dab6e04ee5bae3fa134ae604ce61c08f9de3cd2718fb1090f193477d95

      • C:\Users\Admin\AppData\Local\Temp\1016879001\8fd9317161.exe

        Filesize

        758KB

        MD5

        afd936e441bf5cbdb858e96833cc6ed3

        SHA1

        3491edd8c7caf9ae169e21fb58bccd29d95aefef

        SHA256

        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

        SHA512

        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

        Filesize

        2.9MB

        MD5

        657b1d5bada53a94c7eb16a8f6780aef

        SHA1

        3f913ed5ca66f8d29d2ea004792ba71fd3b157bc

        SHA256

        091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade

        SHA512

        7d3c5072fd4f5a3d542028798dddce15d0cf8c4a682c897d9075a8a825739842320bea82592ff9fbdc977519e5f933e8e78ac203b2c8d67ae5de62ae414cb4a9

      • memory/1372-50-0x0000000000F70000-0x0000000001420000-memory.dmp

        Filesize

        4.7MB

      • memory/1372-51-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

        Filesize

        2.0MB

      • memory/1372-48-0x00000000055B0000-0x00000000059B0000-memory.dmp

        Filesize

        4.0MB

      • memory/1372-62-0x0000000000F71000-0x0000000000FB5000-memory.dmp

        Filesize

        272KB

      • memory/1372-53-0x0000000075850000-0x0000000075A65000-memory.dmp

        Filesize

        2.1MB

      • memory/1372-45-0x0000000000F70000-0x0000000001420000-memory.dmp

        Filesize

        4.7MB

      • memory/1372-46-0x0000000000F71000-0x0000000000FB5000-memory.dmp

        Filesize

        272KB

      • memory/1372-47-0x0000000000F70000-0x0000000001420000-memory.dmp

        Filesize

        4.7MB

      • memory/1372-49-0x00000000055B0000-0x00000000059B0000-memory.dmp

        Filesize

        4.0MB

      • memory/2516-99-0x0000000000EC0000-0x0000000001A26000-memory.dmp

        Filesize

        11.4MB

      • memory/2516-122-0x0000000000EC0000-0x0000000001A26000-memory.dmp

        Filesize

        11.4MB

      • memory/2516-120-0x0000000000EC0000-0x0000000001A26000-memory.dmp

        Filesize

        11.4MB

      • memory/2516-121-0x0000000000EC0000-0x0000000001A26000-memory.dmp

        Filesize

        11.4MB

      • memory/2568-119-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2568-117-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2680-17-0x0000000000A50000-0x0000000000D6A000-memory.dmp

        Filesize

        3.1MB

      • memory/2680-4-0x0000000000A50000-0x0000000000D6A000-memory.dmp

        Filesize

        3.1MB

      • memory/2680-3-0x0000000000A50000-0x0000000000D6A000-memory.dmp

        Filesize

        3.1MB

      • memory/2680-2-0x0000000000A51000-0x0000000000A7F000-memory.dmp

        Filesize

        184KB

      • memory/2680-0-0x0000000000A50000-0x0000000000D6A000-memory.dmp

        Filesize

        3.1MB

      • memory/2680-1-0x00000000773E4000-0x00000000773E6000-memory.dmp

        Filesize

        8KB

      • memory/3248-129-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/3248-130-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/3596-83-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/3596-100-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/3928-60-0x0000000075850000-0x0000000075A65000-memory.dmp

        Filesize

        2.1MB

      • memory/3928-58-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

        Filesize

        2.0MB

      • memory/3928-56-0x00000000010C0000-0x00000000010CA000-memory.dmp

        Filesize

        40KB

      • memory/3928-57-0x0000000001650000-0x0000000001A50000-memory.dmp

        Filesize

        4.0MB

      • memory/4336-79-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/4336-81-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/4512-126-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-135-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-25-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-22-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-21-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-19-0x0000000000061000-0x000000000008F000-memory.dmp

        Filesize

        184KB

      • memory/4512-123-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-127-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-125-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-78-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-124-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-20-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-18-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-131-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-132-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-133-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-134-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-101-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4512-136-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB

      • memory/4572-138-0x0000000000060000-0x000000000037A000-memory.dmp

        Filesize

        3.1MB