Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 10:21
Static task
static1
Behavioral task
behavioral1
Sample
0a8673bbea31ae21e9e87be408752436.exe
Resource
win7-20240903-en
General
-
Target
0a8673bbea31ae21e9e87be408752436.exe
-
Size
3.1MB
-
MD5
0a8673bbea31ae21e9e87be408752436
-
SHA1
a8c29df353c7af7928ce3e24a9f606f0787109ac
-
SHA256
e2ae261a55bc83c0e3c9ab657a16d2c76a329b6a4ff40370119e079f2631b69c
-
SHA512
31d1336cf35adecbed5d42e6910b24fbe01e4671aa12815c5d1d00b27f93228f35f290f570c4142622d53f8b91b4adc764020ec2d52a5ed18794308ebc64aad3
-
SSDEEP
49152:aUnOVfsVG4mPq3wMSk7+7NNnAXbfHQfiXCbSByOPssk:vnafcXmPUwMSk7+TnuLyTO0
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0a8673bbea31ae21e9e87be408752436.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0a8673bbea31ae21e9e87be408752436.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0a8673bbea31ae21e9e87be408752436.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 0a8673bbea31ae21e9e87be408752436.exe -
Executes dropped EXE 3 IoCs
pid Process 3100 skotes.exe 4952 skotes.exe 4272 skotes.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine 0a8673bbea31ae21e9e87be408752436.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4748 0a8673bbea31ae21e9e87be408752436.exe 3100 skotes.exe 4952 skotes.exe 4272 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 0a8673bbea31ae21e9e87be408752436.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a8673bbea31ae21e9e87be408752436.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4748 0a8673bbea31ae21e9e87be408752436.exe 4748 0a8673bbea31ae21e9e87be408752436.exe 3100 skotes.exe 3100 skotes.exe 4952 skotes.exe 4952 skotes.exe 4272 skotes.exe 4272 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4748 0a8673bbea31ae21e9e87be408752436.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4748 wrote to memory of 3100 4748 0a8673bbea31ae21e9e87be408752436.exe 83 PID 4748 wrote to memory of 3100 4748 0a8673bbea31ae21e9e87be408752436.exe 83 PID 4748 wrote to memory of 3100 4748 0a8673bbea31ae21e9e87be408752436.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a8673bbea31ae21e9e87be408752436.exe"C:\Users\Admin\AppData\Local\Temp\0a8673bbea31ae21e9e87be408752436.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4952
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD50a8673bbea31ae21e9e87be408752436
SHA1a8c29df353c7af7928ce3e24a9f606f0787109ac
SHA256e2ae261a55bc83c0e3c9ab657a16d2c76a329b6a4ff40370119e079f2631b69c
SHA51231d1336cf35adecbed5d42e6910b24fbe01e4671aa12815c5d1d00b27f93228f35f290f570c4142622d53f8b91b4adc764020ec2d52a5ed18794308ebc64aad3