amadey | 1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Size

1.9MB
MD5

fd33c5a6ec043a22780094069ecd4f90
SHA1

2716ddb4df3dbe2c859b5e1dd1b29d1ff7583012
SHA256

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c
SHA512

5544cfe5f7b6ab87c5b5141834d251d0b78993e9b25aa3a8d709cb85192cd9af4c30e23ea46df362b1855e01eb0b06761a66b6a9c2af168ec13ecd0bdf1f40a0
SSDEEP

49152:zMeVDM2T+DYFlJN6q4CpQYE5AS5lEABphy:4e+xMMBCplEyS56G

Score

10^/10

amadey 0e6740 evasion trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exeexplortu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Executes dropped EXE 1 IoCs

Processes:

explortu.exe

pid process

2576 explortu.exe

pid	process
2576	explortu.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Wine	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Key opened	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Wine	explortu.exe

Loads dropped DLL 1 IoCs

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

pid process

2352 1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exeexplortu.exe

pid process

2352 1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
2576 explortu.exe
Drops file in Windows directory 1 IoCs

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

description ioc process

File created C:\Windows\Tasks\explortu.job 1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2876 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1860 taskkill.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exeexplortu.exe

pid process

2352 1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
2576 explortu.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1860 taskkill.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

pid process

2352 1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

pid	process
2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

pid	process
2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
2576	explortu.exe

description	ioc	process
File created	C:\Windows\Tasks\explortu.job	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

pid	process
2876	timeout.exe

pid	process
1860	taskkill.exe

pid	process
2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
2576	explortu.exe

description	pid	process
Token: SeDebugPrivilege	1860	taskkill.exe

pid	process
2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exeexplortu.execmd.exe

description	pid	process	target process
PID 2352 wrote to memory of 2576	2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe	explortu.exe
PID 2352 wrote to memory of 2576	2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe	explortu.exe
PID 2352 wrote to memory of 2576	2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe	explortu.exe
PID 2352 wrote to memory of 2576	2352	1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe	explortu.exe
PID 2576 wrote to memory of 1836	2576	explortu.exe	cmd.exe
PID 2576 wrote to memory of 1836	2576	explortu.exe	cmd.exe
PID 2576 wrote to memory of 1836	2576	explortu.exe	cmd.exe
PID 2576 wrote to memory of 1836	2576	explortu.exe	cmd.exe
PID 1836 wrote to memory of 1860	1836	cmd.exe	taskkill.exe
PID 1836 wrote to memory of 1860	1836	cmd.exe	taskkill.exe
PID 1836 wrote to memory of 1860	1836	cmd.exe	taskkill.exe
PID 1836 wrote to memory of 1860	1836	cmd.exe	taskkill.exe
PID 1836 wrote to memory of 2876	1836	cmd.exe	timeout.exe
PID 1836 wrote to memory of 2876	1836	cmd.exe	timeout.exe
PID 1836 wrote to memory of 2876	1836	cmd.exe	timeout.exe
PID 1836 wrote to memory of 2876	1836	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c_NeikiAnalytics.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explortu.exe" && timeout 1 && del "explortu.exe" && ren 0e6740 explortu.exe && C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe && Exit"
3⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "explortu.exe"
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\timeout.exe
timeout 1
4⤵
- Delays execution with timeout.exe
PID:2876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9217037dc9\0e6740
Filesize
1.9MB

MD5
bdd815f2c39b64071c5bad4abea96874

SHA1
27131297c873f15f69d24574805e7673e6ab9a3c

SHA256
209bd81408b26b110c198cb7ba7995c6ea030fc477e37e9c92156e5a58ce25fd

SHA512
7657c448865e356b3e9a39a1cfdb2c92fde1e3dcb3de1484bbc180603cda8b640fcdd4f707cbd9e9a844b32b8620dda440a1fee01524e2b4e52afc04492613d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Filesize
1.9MB

MD5
fd33c5a6ec043a22780094069ecd4f90

SHA1
2716ddb4df3dbe2c859b5e1dd1b29d1ff7583012

SHA256
1e69e4d306ec24d60a4d1714126c5a93d6e960e47c779e74c6f2ee0de411c56c

SHA512
5544cfe5f7b6ab87c5b5141834d251d0b78993e9b25aa3a8d709cb85192cd9af4c30e23ea46df362b1855e01eb0b06761a66b6a9c2af168ec13ecd0bdf1f40a0

Download Submit
memory/2352-0-0x0000000001290000-0x0000000001765000-memory.dmp

Filesize
4.8MB

Download
memory/2352-1-0x00000000770F0000-0x00000000770F2000-memory.dmp

Filesize
8KB

Download
memory/2352-2-0x0000000001291000-0x00000000012BF000-memory.dmp

Filesize
184KB

Download
memory/2352-3-0x0000000001290000-0x0000000001765000-memory.dmp

Filesize
4.8MB

Download
memory/2352-5-0x0000000001290000-0x0000000001765000-memory.dmp

Filesize
4.8MB

Download
memory/2352-9-0x0000000001290000-0x0000000001765000-memory.dmp

Filesize
4.8MB

Download
memory/2352-16-0x0000000001290000-0x0000000001765000-memory.dmp

Filesize
4.8MB

Download
memory/2352-17-0x0000000006D20000-0x00000000071F5000-memory.dmp

Filesize
4.8MB

Download
memory/2576-19-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-20-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-22-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-23-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-24-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-25-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-26-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-18-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-35-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download
memory/2576-36-0x0000000001240000-0x0000000001715000-memory.dmp

Filesize
4.8MB

Download