Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2025 07:09

General

  • Target

    81ac1af2fb04e03376e43045b7834d47a4f763ab8d5b21ab77a5be382b7de974.exe

  • Size

    3.0MB

  • MD5

    eaf8c350c3e06f8a31894226e24daccf

  • SHA1

    4d2be3a9313ede7cf1028dc3d573f4194b6c05bd

  • SHA256

    81ac1af2fb04e03376e43045b7834d47a4f763ab8d5b21ab77a5be382b7de974

  • SHA512

    df494c2988c59156773df91bfcddd6bece0e1146d3407ab641c8b4be765b3e3918c76acd3d5082deff09bd3902a985327a0f8eebb558ec60a0202a87aa493a46

  • SSDEEP

    49152:2oGsWNnkMSa4qBenO8LJ3/Qh2O7uI7QBSQL29pPW5h7M42sSQ3Yd3vLfc/wnVNDf:jGv7IJHeRhqWFJtBbmne

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81ac1af2fb04e03376e43045b7834d47a4f763ab8d5b21ab77a5be382b7de974.exe
    "C:\Users\Admin\AppData\Local\Temp\81ac1af2fb04e03376e43045b7834d47a4f763ab8d5b21ab77a5be382b7de974.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3404
  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1376
  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4280

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    5.114.82.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    5.114.82.104.in-addr.arpa
    IN PTR
    Response
    5.114.82.104.in-addr.arpa
    IN PTR
    a104-82-114-5deploystaticakamaitechnologiescom
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    181.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    181.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 185.215.113.43:80
    skotes.exe
    260 B
    5
  • 185.215.113.43:80
    skotes.exe
    260 B
    5
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    5.114.82.104.in-addr.arpa
    dns
    71 B
    135 B
    1
    1

    DNS Request

    5.114.82.104.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    181.129.81.91.in-addr.arpa
    dns
    72 B
    147 B
    1
    1

    DNS Request

    181.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

    Filesize

    3.0MB

    MD5

    eaf8c350c3e06f8a31894226e24daccf

    SHA1

    4d2be3a9313ede7cf1028dc3d573f4194b6c05bd

    SHA256

    81ac1af2fb04e03376e43045b7834d47a4f763ab8d5b21ab77a5be382b7de974

    SHA512

    df494c2988c59156773df91bfcddd6bece0e1146d3407ab641c8b4be765b3e3918c76acd3d5082deff09bd3902a985327a0f8eebb558ec60a0202a87aa493a46

  • memory/1376-37-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/1376-35-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/1376-34-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/1376-33-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3200-0-0x0000000000930000-0x0000000000C38000-memory.dmp

    Filesize

    3.0MB

  • memory/3200-1-0x0000000076EE4000-0x0000000076EE6000-memory.dmp

    Filesize

    8KB

  • memory/3200-2-0x0000000000931000-0x0000000000999000-memory.dmp

    Filesize

    416KB

  • memory/3200-3-0x0000000000930000-0x0000000000C38000-memory.dmp

    Filesize

    3.0MB

  • memory/3200-4-0x0000000000930000-0x0000000000C38000-memory.dmp

    Filesize

    3.0MB

  • memory/3200-19-0x0000000000931000-0x0000000000999000-memory.dmp

    Filesize

    416KB

  • memory/3200-18-0x0000000000930000-0x0000000000C38000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-30-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-17-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-25-0x00000000002C1000-0x0000000000329000-memory.dmp

    Filesize

    416KB

  • memory/3404-26-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-28-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-29-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-22-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-31-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-23-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-21-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-20-0x00000000002C1000-0x0000000000329000-memory.dmp

    Filesize

    416KB

  • memory/3404-24-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-38-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-39-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-40-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-41-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-42-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-43-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-50-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-49-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-47-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/3404-48-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/4280-46-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

  • memory/4280-45-0x00000000002C0000-0x00000000005C8000-memory.dmp

    Filesize

    3.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.