Analysis
- max time kernel
142s - max time network
146s - platform
windows7_x64 - resource
win7-20241023-en - resource tags
- submitted
23/02/2025, 22:42
General
- Target quarantine/d.exe
- Size 2.9MB
- Sample250223-2mse6swpht
- SHA256 b5d4798fed8196e12260f2152245af80763fe877d807069d7f0ca08fd4ee6843
Malware Config
Extracted
-
amadey
-
5.21
-
a4d2cd
-
http://cobolrationumelawrtewarms.com
-
http://�������� jlgenfekjlfnvtgpegkwr.xyz
-
install_dir
a58456755d
-
install_file
Gxtuum.exe
-
strings_key
00fadbeacf092dfd58b48ef4ac68f826
-
url_paths
/3ofn3jf3e2ljk/index.php
Extracted
-
systembc
-
towerbingobongoboom.com
-
93.186.202.3
-
dns
5.132.191.104
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Systembc family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C0F60BDE-1575-4727-A7D2-B7E319B1E213} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cgnl\txfka.exeC:\ProgramData\cgnl\txfka.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
inet.exe
Gxtuum.exe
Test Task17.job
inet.exe
memory/264-73-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-80-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-64-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-63-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-67-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-92-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-90-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-88-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-86-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-84-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-82-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-70-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-59-0x0000000000400000-0x0000000000860000-memory.dmp
memory/264-77-0x0000000000400000-0x0000000000860000-memory.dmp
memory/2628-3-0x00000000012F0000-0x000000000161E000-memory.dmp
memory/2628-6-0x00000000012F0000-0x000000000161E000-memory.dmp
memory/2628-1-0x0000000077200000-0x0000000077202000-memory.dmp
memory/2628-19-0x0000000006AF0000-0x0000000006E1E000-memory.dmp
memory/2628-4-0x00000000012F0000-0x000000000161E000-memory.dmp
memory/2628-18-0x00000000012F0000-0x000000000161E000-memory.dmp
memory/2628-0-0x00000000012F0000-0x000000000161E000-memory.dmp
memory/2628-2-0x00000000012F1000-0x000000000131F000-memory.dmp
memory/2908-62-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-75-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-21-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-91-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-54-0x0000000006CE0000-0x0000000007140000-memory.dmp
memory/2908-23-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-50-0x0000000006CE0000-0x0000000007140000-memory.dmp
memory/2908-89-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-66-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-48-0x0000000006CE0000-0x0000000007140000-memory.dmp
memory/2908-22-0x0000000000F61000-0x0000000000F8F000-memory.dmp
memory/2908-69-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-36-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-87-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-72-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-38-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-25-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-57-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-85-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-37-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-26-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-79-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-28-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-81-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-27-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/2908-83-0x0000000000F60000-0x000000000128E000-memory.dmp
memory/3044-78-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-76-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-74-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-71-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-68-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-65-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-49-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-61-0x0000000000400000-0x0000000000860000-memory.dmp
memory/3044-58-0x0000000000400000-0x0000000000860000-memory.dmp