Behavioral task
behavioral1
Sample
1644-3-0x0000000000210000-0x00000000006DC000-memory.exe
Resource
win7-20240508-en
General
-
Target
1644-3-0x0000000000210000-0x00000000006DC000-memory.dmp
-
Size
4.8MB
-
MD5
392798d04132c97c3b60bc6d2a36f49a
-
SHA1
00b7d18f437b1c96016b106b3037243b4fa04d26
-
SHA256
a9854e3e7a7a3ff8c28ebfa2bfa717f6c27070ad6b24c0078a8a5045c4bcc6e9
-
SHA512
9202a38a55ce7ee35007af559a694816ed8b790d1cf2fe7bb8f9b7b87a37049a46c2a1e909d073c872e7a6f04ceb291697d05679ad3b5a100d09669f594a0ee7
-
SSDEEP
98304:hGRAHdsAiPZhshdWXfPcFLaUHKzuEu7bOGf81gZWQ:hBxhUcEUxE8OG/
Malware Config
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1644-3-0x0000000000210000-0x00000000006DC000-memory.dmp
Files
-
1644-3-0x0000000000210000-0x00000000006DC000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hsbvuxlq Size: 1.6MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vmqwujgy Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE