Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    305s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250207-es
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250207-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
  • submitted
    09/02/2025, 17:28

General

  • Target

    random.exe

  • Size

    1.8MB

  • MD5

    53bf4bc2cc4257121dc450c9c3167319

  • SHA1

    3c718864780bc87e6478041b8cbcf313e70d1505

  • SHA256

    bc634b49ae03f0905b72036605952afc3b9dc0ce3f1f57c578397dda2e3b8293

  • SHA512

    6a7552dd6bda139d5800241084a6bd7e8c55de4ae9f2c7af5b22d5b4f618e2ff5f897906c126ba7df6f139cc8946755c5dac7e733060222cbd54b8510bb9e80e

  • SSDEEP

    49152:b6VqLc5WAdbvR8skOmgoWGRjMFpDjecFM3r:b6V+xsbZ89OmgoTwjjHM3r

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file 4 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Users\Admin\AppData\Local\Temp\1001527001\alex12312312321.exe
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex12312312321.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Users\Admin\AppData\Local\Temp\1001527001\alex12312312321.exe
          "C:\Users\Admin\AppData\Local\Temp\1001527001\alex12312312321.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 824
          4⤵
          • Program crash
          PID:3052
      • C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe
        "C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe
          "C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4236
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 824
          4⤵
          • Program crash
          PID:4088
      • C:\Users\Admin\AppData\Local\Temp\1016645001\trano.exe
        "C:\Users\Admin\AppData\Local\Temp\1016645001\trano.exe"
        3⤵
        • Executes dropped EXE
        PID:2628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3992 -ip 3992
    1⤵
      PID:2644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5032 -ip 5032
      1⤵
        PID:1076
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDBCNzUyRjUtNUJDNy00Q0ZELUE1MjUtNDYwOTg3QTFCNDc0fSIgdXNlcmlkPSJ7Qzg5NjEzQ0UtODVGMi00RjkwLUJGREItOEZEOUNFMTAyMUVCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzREM0YzMDUtNUEzMS00QTk2LUE2MzctQjZGMkNFMzZDMDIzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NDIxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NzAxODEwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMwNjU3NTY0MSIvPjwvYXBwPjwvcmVxdWVzdD4
        1⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2208
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2112
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4368
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3560
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4660
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:4448

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1001527001\alex12312312321.exe

        Filesize

        563KB

        MD5

        4aa99fad3331371b00eaca12eb716d40

        SHA1

        dc0dcf92fb24643c925d94c84f665fae02dab9b9

        SHA256

        6438ceb9af6892efa6ca2f1fa3057d98cb5fcdc029f249194a058b1b5af36e5b

        SHA512

        2bf15f12c1cd278e2fe35667eb5c2203a32806daca018a04aaddd45019196df44beb3394f55f20e789fcc6ed2de010f731a4776f65e1070e3f578ef830f4f7a0

      • C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe

        Filesize

        501KB

        MD5

        c80b4443546055bfdc0f3edc5b88abe8

        SHA1

        4df4951f787aca9b1fbeafa4590614fa9db9db4a

        SHA256

        6d15b1a8ef83b775e3a71618c88a2e1b4dbffb8b81afe61552e8af2d77214d64

        SHA512

        1388114d4cf91a7ae5bc1c37a1caae5e3c17cfd02a2730fa3398582ad8896d8f7a94bf7f730d855cebe9dff1af31abafc3d82e831514a16d5f17333879d5c324

      • C:\Users\Admin\AppData\Local\Temp\1016645001\trano.exe

        Filesize

        1.4MB

        MD5

        3e3cb81d7d7eba7012187207743c591d

        SHA1

        47cd94363625c9caf4bd82f0c29aa51c311e061f

        SHA256

        44ae92658a72a11893a9cb92d44b7cb55e1259335b5cfe71487339b510fc2370

        SHA512

        dd2d714555b7f24761c08639eecae74706e544b846107ae78db7e951573e5a7b841714b8ebe4d293df53a32c7da1823adeb8bdc4baaf1b0d7bf07febb3f741cd

      • C:\Users\Admin\AppData\Local\Temp\1019420001\14f0c81e1b.exe

        Filesize

        48KB

        MD5

        b5ecbf9fe4b69ce4da2906e147f41533

        SHA1

        5cf1c6507918601652608da01147e86e092f67f8

        SHA256

        0114eed12b6d310f76f20befc54711eaef992a4794a238a47ea24763268863e3

        SHA512

        adf000bd87f7ae64c46debe06c0fed46b02d08c0c046ed8eb3ecab5690348e4b727c29ff9d6cab95b530d2e9307b5caeb1a2a616469ca26d32d25f5c2f7f9b72

      • C:\Users\Admin\AppData\Local\Temp\1019421001\6991e4c6f0.exe

        Filesize

        832KB

        MD5

        c870279df0a51f6ddf48bf678314c5ca

        SHA1

        1d017a2ddbe20193bd0a71ff136cd191aa0122b3

        SHA256

        579ccfc532969587f39437d3ddeb96b89291ea9a2dae1a0cf28c14f6f84a75fd

        SHA512

        a9b7d319fe184a32a862d268c59388ff7785c742b77682267e058fdfd8fd404b11548df53b3654f27ee58d18b2ffb369f34f5602dabc9b54c8c95ec177ef9d9c

      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

        Filesize

        1.8MB

        MD5

        53bf4bc2cc4257121dc450c9c3167319

        SHA1

        3c718864780bc87e6478041b8cbcf313e70d1505

        SHA256

        bc634b49ae03f0905b72036605952afc3b9dc0ce3f1f57c578397dda2e3b8293

        SHA512

        6a7552dd6bda139d5800241084a6bd7e8c55de4ae9f2c7af5b22d5b4f618e2ff5f897906c126ba7df6f139cc8946755c5dac7e733060222cbd54b8510bb9e80e

      • memory/2112-84-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/2112-83-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/2804-57-0x0000000000400000-0x000000000045C000-memory.dmp

        Filesize

        368KB

      • memory/2804-55-0x0000000000400000-0x000000000045C000-memory.dmp

        Filesize

        368KB

      • memory/3560-119-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/3840-3-0x0000000000C30000-0x00000000010F8000-memory.dmp

        Filesize

        4.8MB

      • memory/3840-7-0x0000000000C30000-0x00000000010F8000-memory.dmp

        Filesize

        4.8MB

      • memory/3840-1-0x0000000077BC5000-0x0000000077BC7000-memory.dmp

        Filesize

        8KB

      • memory/3840-5-0x0000000000C30000-0x00000000010F8000-memory.dmp

        Filesize

        4.8MB

      • memory/3840-2-0x0000000000C31000-0x0000000000C5F000-memory.dmp

        Filesize

        184KB

      • memory/3840-0-0x0000000000C30000-0x00000000010F8000-memory.dmp

        Filesize

        4.8MB

      • memory/3992-52-0x00000000005A0000-0x0000000000630000-memory.dmp

        Filesize

        576KB

      • memory/3992-53-0x00000000058B0000-0x0000000005E56000-memory.dmp

        Filesize

        5.6MB

      • memory/4236-78-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

      • memory/4236-80-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

      • memory/4368-93-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4448-169-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4660-144-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-89-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-116-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-8-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-10-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-81-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-9-0x00000000004D1000-0x00000000004FF000-memory.dmp

        Filesize

        184KB

      • memory/4956-11-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-85-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-86-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-87-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-88-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-12-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-91-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-33-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-94-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-32-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-113-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-114-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-115-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-13-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-117-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-31-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-16-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-137-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-138-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-139-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-140-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-141-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-142-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-15-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-145-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-146-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-14-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-164-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-165-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-166-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/4956-167-0x00000000004D0000-0x0000000000998000-memory.dmp

        Filesize

        4.8MB

      • memory/5032-76-0x0000000000360000-0x00000000003E0000-memory.dmp

        Filesize

        512KB