Overview

overview

10

Static

static

3

141096063a...84.exe

windows7-x64

10

141096063a...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    141096063a6c104ca94037a3bcecca28e9b5179fe3b5cbafa646b88a145c4f84

  • Size

    1.8MB

  • Sample

    250211-mxmkcavmhv

  • MD5

    e3cfc213f697b9ed0435f8052dfc0950

  • SHA1

    8755eb818d0c9dcb3fc0210207c64845e0e4f8f2

  • SHA256

    141096063a6c104ca94037a3bcecca28e9b5179fe3b5cbafa646b88a145c4f84

  • SHA512

    849e196510bdf4f265526fa75ba352deeaa4ecc3395054ef72e973579430c37aa24af798484226c143a4854f5c76ead73564866380a69adc5b3637ec6ae57fd1

  • SSDEEP

    49152:BMs7fUicQ3xMVwIpIhUI7Bspj68AQqypRo53:u6Uir36fpIpgA/

Score
10/10
amadeyhealerstealc9c9aa5fed3aarenodefense_evasiondiscoverydropperevasionexecutionpersistencestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

reno

C2

http://185.215.113.115

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/defend/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Targets

    • Target

      141096063a6c104ca94037a3bcecca28e9b5179fe3b5cbafa646b88a145c4f84

    • Size

      1.8MB

    • MD5

      e3cfc213f697b9ed0435f8052dfc0950

    • SHA1

      8755eb818d0c9dcb3fc0210207c64845e0e4f8f2

    • SHA256

      141096063a6c104ca94037a3bcecca28e9b5179fe3b5cbafa646b88a145c4f84

    • SHA512

      849e196510bdf4f265526fa75ba352deeaa4ecc3395054ef72e973579430c37aa24af798484226c143a4854f5c76ead73564866380a69adc5b3637ec6ae57fd1

    • SSDEEP

      49152:BMs7fUicQ3xMVwIpIhUI7Bspj68AQqypRo53:u6Uir36fpIpgA/

    Score
    10/10
    amadeystealc9c9aa5fed3aarenodefense_evasiondiscoverypersistencestealertrojanhealerdropperevasionexecution

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Amadey family

      amadey

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies Windows Defender notification settings

      defense_evasiontrojan

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Stealc family

      stealc

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Windows security modification

      defense_evasiontrojan

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

5
T1562

Disable or Modify Tools

5
T1562.001

Modify Registry

7
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks