Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
25/02/2025, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe
Resource
win7-20241023-en
General
-
Target
8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe
-
Size
2.0MB
-
MD5
19fca4fabaa73be98669749a82d53459
-
SHA1
3b8f2040be87305d18848dadd8d5b166f53b77a3
-
SHA256
8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e
-
SHA512
c85a6b898c3d90323bc34d43b8b614d3fb225ac79c056315045ecca9509bf18eebcd60c88a281377e8b51f495916e8e2b8f5f9728c2ba7098a05f7d8c7a198f6
-
SSDEEP
49152:+VK/i8wM0kPUWvjthabZ001lMw8KVlefo9rVahYgNFvo:NaVM0YbjthubWKd9r8hYIV
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
reno
http://185.215.113.115
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Gcleaner family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2b3971fee3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bd7052ada0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e8720e5d16.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 53697b98ef.exe -
Downloads MZ/PE file 4 IoCs
flow pid Process 14 2908 BitLockerToGo.exe 16 2872 BitLockerToGo.exe 5 2876 skotes.exe 12 2876 skotes.exe -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e8720e5d16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 53697b98ef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bd7052ada0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e8720e5d16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 53697b98ef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2b3971fee3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2b3971fee3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bd7052ada0.exe -
Executes dropped EXE 5 IoCs
pid Process 2876 skotes.exe 3016 e8720e5d16.exe 2300 53697b98ef.exe 1904 2b3971fee3.exe 1980 bd7052ada0.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine e8720e5d16.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 53697b98ef.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 2b3971fee3.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine bd7052ada0.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe -
Loads dropped DLL 12 IoCs
pid Process 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2908 BitLockerToGo.exe 2872 BitLockerToGo.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b3971fee3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1091951001\\2b3971fee3.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\bd7052ada0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1091952001\\bd7052ada0.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\e8720e5d16.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1091949001\\e8720e5d16.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\53697b98ef.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1091950001\\53697b98ef.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 2876 skotes.exe 3016 e8720e5d16.exe 2300 53697b98ef.exe 1904 2b3971fee3.exe 1980 bd7052ada0.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1904 set thread context of 2908 1904 2b3971fee3.exe 38 PID 1980 set thread context of 2872 1980 bd7052ada0.exe 40 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53697b98ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b3971fee3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8720e5d16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd7052ada0.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 2876 skotes.exe 3016 e8720e5d16.exe 3016 e8720e5d16.exe 3016 e8720e5d16.exe 3016 e8720e5d16.exe 3016 e8720e5d16.exe 2300 53697b98ef.exe 1904 2b3971fee3.exe 1980 bd7052ada0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2876 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 30 PID 2628 wrote to memory of 2876 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 30 PID 2628 wrote to memory of 2876 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 30 PID 2628 wrote to memory of 2876 2628 8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe 30 PID 2876 wrote to memory of 3016 2876 skotes.exe 33 PID 2876 wrote to memory of 3016 2876 skotes.exe 33 PID 2876 wrote to memory of 3016 2876 skotes.exe 33 PID 2876 wrote to memory of 3016 2876 skotes.exe 33 PID 2876 wrote to memory of 2300 2876 skotes.exe 35 PID 2876 wrote to memory of 2300 2876 skotes.exe 35 PID 2876 wrote to memory of 2300 2876 skotes.exe 35 PID 2876 wrote to memory of 2300 2876 skotes.exe 35 PID 2876 wrote to memory of 1904 2876 skotes.exe 36 PID 2876 wrote to memory of 1904 2876 skotes.exe 36 PID 2876 wrote to memory of 1904 2876 skotes.exe 36 PID 2876 wrote to memory of 1904 2876 skotes.exe 36 PID 2876 wrote to memory of 1980 2876 skotes.exe 37 PID 2876 wrote to memory of 1980 2876 skotes.exe 37 PID 2876 wrote to memory of 1980 2876 skotes.exe 37 PID 2876 wrote to memory of 1980 2876 skotes.exe 37 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1904 wrote to memory of 2908 1904 2b3971fee3.exe 38 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40 PID 1980 wrote to memory of 2872 1980 bd7052ada0.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe"C:\Users\Admin\AppData\Local\Temp\8ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1091949001\e8720e5d16.exe"C:\Users\Admin\AppData\Local\Temp\1091949001\e8720e5d16.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\1091950001\53697b98ef.exe"C:\Users\Admin\AppData\Local\Temp\1091950001\53697b98ef.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\1091951001\2b3971fee3.exe"C:\Users\Admin\AppData\Local\Temp\1091951001\2b3971fee3.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"4⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2908
-
-
-
C:\Users\Admin\AppData\Local\Temp\1091952001\bd7052ada0.exe"C:\Users\Admin\AppData\Local\Temp\1091952001\bd7052ada0.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"4⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2872
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\success[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
3.0MB
MD55e79df97975b488e901487db545d5de8
SHA12cc617e5bd4cf348b8a1fccf2716686cf2c63fe6
SHA256aa38c813aafc36532f6d8e826f2f7665b26c2c0ef2ff7395c21230f2640cb966
SHA5125bbfee010c11ba03ef2db2a7a0280aae19f94aced5b2bb2085d5ea97a5d321d89368912cf8d563cbeb7de0f755ef5990adf9199b5f172d115bdc6e6e4442571f
-
Filesize
1.7MB
MD5847574da42ba3d0640c821e8eb11e286
SHA1f63a12f36991a1aab0b0cfa89e48ad7138aaac59
SHA256b730e010dc5deb7b1e33bc057ec8839e99c7943f136f4fe0a20b3a6d4d628202
SHA512edff0a63a03d94684a695a57b10fc956792014dbcd31fe295dfca5ee19411e367d2129740157fc1c816e5890d736d53b4c81980de1faa1a7cf70f985f78325b1
-
Filesize
4.5MB
MD5bb5bc7f7f6489e3a703d4fcf18554467
SHA144a93921748e1051481baf3271d6c421c32d53cb
SHA256e76c3bdf717a538b047299677f983cb5e1cf7cafb9beca20c65476da22940c56
SHA5128cdfffa7a72f6f515f5a5c9a2c208bd628d38b7b396d3c5fb9f751c518723d0ef678dafbca61c34f16cc79241ac39008f0d9ec68f8e4bdf7625c42abbaa83cc6
-
Filesize
3.7MB
MD5fae501d9b4f30abb0d17a8730bfd3add
SHA1bfa6e3f691f4b820901976930899157cb9c31aff
SHA256ab05ab4f827e9d34656735940f05e9ad6c2250690dfe6fe3631b2b7cb15e7568
SHA512b60c40c8b4ec8b927ef873daade12c17527a830aac137a7d1006c30ae4c550e1573d00c04c6340a2eca7db5595e5bc72a02dcd5fe610e0fe7d8c1473ccf44960
-
Filesize
987KB
MD5f49d1aaae28b92052e997480c504aa3b
SHA1a422f6403847405cee6068f3394bb151d8591fb5
SHA25681e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0
SHA51241f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773
-
Filesize
2.0MB
MD519fca4fabaa73be98669749a82d53459
SHA13b8f2040be87305d18848dadd8d5b166f53b77a3
SHA2568ebb67a43d170a47eb3dc6a797088b9d67cad7fbed176c146823490168bc120e
SHA512c85a6b898c3d90323bc34d43b8b614d3fb225ac79c056315045ecca9509bf18eebcd60c88a281377e8b51f495916e8e2b8f5f9728c2ba7098a05f7d8c7a198f6