amadey | b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282

Analysis

max time kernel
146s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
15-05-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
Size

1.8MB
MD5

4bd3e99486ffbbd065656e0300d56c3e
SHA1

d65965f613f83d235f0bfcabea5505a7c547eeca
SHA256

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282
SHA512

856330451d808359d077c05387eac0a5b97f331e8abcb14a57f40887577d3905718b4263ada0c82af1284cba57d9da375e2827311736a56a3dcc27f7e63d0ee9
SSDEEP

49152:jzn259kIST2OIxVfd3T3ndRd/qwNqD4JId+6nYKHR:ja59tSKOYVf1TfRYD4J0+W3

Score

10^/10

amadey evasion trojan

Malware Config

Extracted

Family

amadey

Version

4.20

http://5.42.96.7

Attributes

install_dir
7af68cdb52
install_file
axplons.exe
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
url_paths
/zamo7h/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exeaxplons.exeaxplons.exeaxplons.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

axplons.exeb1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exeaxplons.exeaxplons.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe

Executes dropped EXE 4 IoCs

Processes:

axplons.exeaxplons.exeaxplons.exeaxplons.exe

pid process

2648 axplons.exe
1072 axplons.exe
4348 axplons.exe
2804 axplons.exe

pid	process
2648	axplons.exe
1072	axplons.exe
4348	axplons.exe
2804	axplons.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplons.exeaxplons.exeb1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exeaxplons.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	axplons.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exeaxplons.exeaxplons.exeaxplons.exe

pid process

4344 b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
2648 axplons.exe
1072 axplons.exe
4348 axplons.exe
Drops file in Windows directory 1 IoCs

Processes:

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe

description ioc process

File created C:\Windows\Tasks\axplons.job b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\axplons.job	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exeaxplons.exeaxplons.exeaxplons.exe

pid	process
4344	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
4344	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
2648	axplons.exe
2648	axplons.exe
1072	axplons.exe
1072	axplons.exe
4348	axplons.exe
4348	axplons.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe

description	pid	process	target process
PID 4344 wrote to memory of 2648	4344	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe	axplons.exe
PID 4344 wrote to memory of 2648	4344	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe	axplons.exe
PID 4344 wrote to memory of 2648	4344	b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe	axplons.exe

C:\Users\Admin\AppData\Local\Temp\b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe
"C:\Users\Admin\AppData\Local\Temp\b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2648

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1072

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Executes dropped EXE
PID:2804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
Filesize
1.8MB

MD5
4bd3e99486ffbbd065656e0300d56c3e

SHA1
d65965f613f83d235f0bfcabea5505a7c547eeca

SHA256
b1b7cc600c87f314a20d14a8657181e6577d163d333a503c3a366da53212b282

SHA512
856330451d808359d077c05387eac0a5b97f331e8abcb14a57f40887577d3905718b4263ada0c82af1284cba57d9da375e2827311736a56a3dcc27f7e63d0ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
Filesize
268KB

MD5
7a083e6b6a86fd3e6217ab4f352f2b07

SHA1
ba1e4287ab23f507a692eed48c414faac6b7ca93

SHA256
d0aac2799f081b4dda83561a35cdc101a8cb07772922fd82cc5f3d8c6014d6ee

SHA512
3c9a4a23bc31e26d0e09e4a20e9338f48f9c267b0e0ac830fecdd57e667bd098a66b05d1875a77e2a8112d5f885cab31a520057671090f525ecf22f1adebe416

Download Submit
memory/1072-27-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/1072-30-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/1072-29-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/1072-28-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-19-0x0000000000521000-0x000000000054F000-memory.dmp

Filesize
184KB

Download
memory/2648-33-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-20-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-46-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-21-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-22-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-23-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-24-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-26-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-45-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-44-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-43-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-42-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-31-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-32-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-18-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-34-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-35-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-36-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2648-41-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2804-48-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/2804-49-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/4344-2-0x0000000000231000-0x000000000025F000-memory.dmp

Filesize
184KB

Download
memory/4344-3-0x0000000000230000-0x00000000006DE000-memory.dmp

Filesize
4.7MB

Download
memory/4344-4-0x0000000000230000-0x00000000006DE000-memory.dmp

Filesize
4.7MB

Download
memory/4344-17-0x0000000000230000-0x00000000006DE000-memory.dmp

Filesize
4.7MB

Download
memory/4344-0-0x0000000000230000-0x00000000006DE000-memory.dmp

Filesize
4.7MB

Download
memory/4344-1-0x00000000770B6000-0x00000000770B8000-memory.dmp

Filesize
8KB

Download
memory/4348-40-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download
memory/4348-38-0x0000000000520000-0x00000000009CE000-memory.dmp

Filesize
4.7MB

Download