amadey | 7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4

Analysis

max time kernel
20s
max time network
80s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Size

3.1MB
MD5

9c580391a930dd9a31ee8261b5d3cce0
SHA1

1239b6aa65563304efe387021eec0bc26290a7f1
SHA256

7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4
SHA512

54cf4fec7c756ee4dc7c7de194a86519a8ffe384cc944ed08dfe395e211e93f28d4feb404448e4db390583c4d36aed1cd8df7fce08927f3a91fc7f073db3865b
SSDEEP

49152:7crynO1MjEgjIsOzbrANo0ZQLkx5gNXcZ3BC/Uu+g4LeFTLTMQToPWAG:wr08vgjxOzgUkx0cPzLUHT7TLAG

Score

10^/10

amadey sality 9c9aa5 backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	skotes.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	skotes.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	skotes.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Executes dropped EXE 1 IoCs

pid	Process
2624	skotes.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe

Loads dropped DLL 1 IoCs

pid	Process
2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	skotes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	skotes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	skotes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	skotes.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	skotes.exe
File opened (read-only)	\??\E:	skotes.exe
File opened (read-only)	\??\G:	skotes.exe
File opened (read-only)	\??\H:	skotes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
2624	skotes.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-12-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-4-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-3-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-6-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-8-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-10-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-5-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-11-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-9-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-39-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2120-7-0x00000000008D0000-0x000000000198A000-memory.dmp	upx
behavioral1/memory/2624-74-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-82-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-79-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-81-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-80-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-85-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-83-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-84-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-78-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-76-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-104-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-103-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-105-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-106-0x0000000005890000-0x000000000694A000-memory.dmp	upx
behavioral1/memory/2624-107-0x0000000005890000-0x000000000694A000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\f76db90	skotes.exe
File created	C:\Windows\f76afdf	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
File opened for modification	C:\Windows\SYSTEM.INI	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
File created	C:\Windows\Tasks\skotes.job	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
2624	skotes.exe
2624	skotes.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe
Token: SeDebugPrivilege	2624	skotes.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1044	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	17
PID 2120 wrote to memory of 1068	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	18
PID 2120 wrote to memory of 1128	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	20
PID 2120 wrote to memory of 2004	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	23
PID 2120 wrote to memory of 2624	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	30
PID 2120 wrote to memory of 2624	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	30
PID 2120 wrote to memory of 2624	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	30
PID 2120 wrote to memory of 2624	2120	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe	30
PID 2624 wrote to memory of 1044	2624	skotes.exe	17
PID 2624 wrote to memory of 1068	2624	skotes.exe	18
PID 2624 wrote to memory of 1128	2624	skotes.exe	20
PID 2624 wrote to memory of 2004	2624	skotes.exe	23

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	skotes.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1044

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1068

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1128
- C:\Users\Admin\AppData\Local\Temp\7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe
  "C:\Users\Admin\AppData\Local\Temp\7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4N.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.1MB

MD5
9c580391a930dd9a31ee8261b5d3cce0

SHA1
1239b6aa65563304efe387021eec0bc26290a7f1

SHA256
7d4b3b7b052e2b296a24aadb95127191b717f4ba52853f21231241d8c0877bc4

SHA512
54cf4fec7c756ee4dc7c7de194a86519a8ffe384cc944ed08dfe395e211e93f28d4feb404448e4db390583c4d36aed1cd8df7fce08927f3a91fc7f073db3865b

Download Submit
C:\Windows\SYSTEM.INI

Filesize
257B

MD5
328b36b361271e299371bf479f2b0071

SHA1
d8ad63154146c558d8e029b912e70fd36e468dfa

SHA256
13acd03482bc53b18a1a9b7278de32556d9d4bb56c0f41e0b26f1ebdeb208863

SHA512
5dc32f7eb8b4e4aae2eafce2b88cd541f6a41a0ecdc96a8a6187b2e307454d6790e028cbe8f5e6d44057763164fe333b9a717eba8d888d22abecea36b2e58e2f

Download Submit
C:\ktpxi.exe

Filesize
97KB

MD5
20e144e434e4a9bca319e6e76bcfebca

SHA1
890d6860ea2799841cfb5fcabad1e7c6b86a1580

SHA256
26da0d67cd060af594c2d7d0977d9b4625aa9983b93ae7368e5e37a71b93e89e

SHA512
456be929dca0e0e916d4ea03a326ed05c0678dbdb23c79156356699a4bbd007701eb06513922d3d2b5680db4fc94e6e3dcbae4fa09700c2dcb0e3e36ea483f1d

Download Submit
memory/1044-18-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2120-64-0x0000000000401000-0x0000000000469000-memory.dmp

Filesize
416KB

Download
memory/2120-12-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-4-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-3-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-6-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-8-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-10-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-5-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-31-0x0000000001A60000-0x0000000001A62000-memory.dmp

Filesize
8KB

Download
memory/2120-33-0x0000000000401000-0x0000000000469000-memory.dmp

Filesize
416KB

Download
memory/2120-34-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-11-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-32-0x0000000001A60000-0x0000000001A62000-memory.dmp

Filesize
8KB

Download
memory/2120-35-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-9-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-30-0x0000000001A70000-0x0000000001A71000-memory.dmp

Filesize
4KB

Download
memory/2120-36-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-29-0x00000000776D0000-0x00000000776D2000-memory.dmp

Filesize
8KB

Download
memory/2120-26-0x0000000001A70000-0x0000000001A71000-memory.dmp

Filesize
4KB

Download
memory/2120-37-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-39-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2120-25-0x0000000001A60000-0x0000000001A62000-memory.dmp

Filesize
8KB

Download
memory/2120-61-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-45-0x0000000001A60000-0x0000000001A62000-memory.dmp

Filesize
8KB

Download
memory/2120-0-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-62-0x0000000008280000-0x000000000859F000-memory.dmp

Filesize
3.1MB

Download
memory/2120-7-0x00000000008D0000-0x000000000198A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-107-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-73-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-67-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-68-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-70-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-71-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-72-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-74-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-82-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-79-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-66-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-81-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-80-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-85-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-96-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/2624-83-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-84-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-78-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-97-0x0000000005740000-0x0000000005742000-memory.dmp

Filesize
8KB

Download
memory/2624-76-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-77-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-104-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-103-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-105-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-106-0x0000000005890000-0x000000000694A000-memory.dmp

Filesize
16.7MB

Download
memory/2624-65-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-115-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2624-118-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download