Windows
Analysis Report
setup.exe
Overview
General Information
Detection
Amadey, RisePro Stealer
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Amadeys stealer DLL
Yara detected RisePro Stealer
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Creates multiple autostart registry keys
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Suspicious Add Scheduled Task Parent
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Classification
- System is w10x64
setup.exe (PID: 6256 cmdline:
"C:\Users\ user\Deskt op\setup.e xe" MD5: 20FE52F3BA934B9B7454C194F44D74D0) explortu.exe (PID: 2892 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\921703 7dc9\explo rtu.exe" MD5: 20FE52F3BA934B9B7454C194F44D74D0) explortu.exe (PID: 7308 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\921703 7dc9\explo rtu.exe" MD5: 20FE52F3BA934B9B7454C194F44D74D0) b6042db502.exe (PID: 7332 cmdline:
"C:\Users\ user\10000 15002\b604 2db502.exe " MD5: 1259EEE53EAE1FC7B96F6DFEB18C47D7) axplong.exe (PID: 7592 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\825462 4243\axplo ng.exe" MD5: 1259EEE53EAE1FC7B96F6DFEB18C47D7) eaa97795e9.exe (PID: 7600 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\100001 6001\eaa97 795e9.exe" MD5: CA515D624D046E04A75136AB4E44D2D6) schtasks.exe (PID: 8096 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MPGPH131\ MPGPH131.e xe" /tn "M PGPH131 HR " /sc HOUR LY /rl HIG HEST MD5: 48C2FE20575769DE916F48EF0676A965) conhost.exe (PID: 8104 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) schtasks.exe (PID: 8136 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MPGPH131\ MPGPH131.e xe" /tn "M PGPH131 LG " /sc ONLO GON /rl HI GHEST MD5: 48C2FE20575769DE916F48EF0676A965) conhost.exe (PID: 8144 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 8bcaec3fef.exe (PID: 7984 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\100001 7001\8bcae c3fef.exe" MD5: 69A4A65B5EC85EA408BE9CD4CD98302B) chrome.exe (PID: 3620 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" http s://www.yo utube.com/ account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) chrome.exe (PID: 6436 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2140 --fi eld-trial- handle=200 8,i,876982 0692203852 644,108849 0053356293 250,262144 /prefetch :8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) chrome.exe (PID: 8808 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=55 00 --field -trial-han dle=2008,i ,876982069 2203852644 ,108849005 3356293250 ,262144 /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) chrome.exe (PID: 8824 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=3572 --f ield-trial -handle=20 08,i,87698 2069220385 2644,10884 9005335629 3250,26214 4 /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
explortu.exe (PID: 4764 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\9217037 dc9\explor tu.exe MD5: 20FE52F3BA934B9B7454C194F44D74D0)
MPGPH131.exe (PID: 8184 cmdline:
C:\Program Data\MPGPH 131\MPGPH1 31.exe MD5: CA515D624D046E04A75136AB4E44D2D6)
MPGPH131.exe (PID: 4696 cmdline:
C:\Program Data\MPGPH 131\MPGPH1 31.exe MD5: CA515D624D046E04A75136AB4E44D2D6)
eaa97795e9.exe (PID: 5668 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\100001 6001\eaa97 795e9.exe" MD5: CA515D624D046E04A75136AB4E44D2D6)
RageMP131.exe (PID: 8780 cmdline:
"C:\Users\ user\AppDa ta\Local\R ageMP131\R ageMP131.e xe" MD5: CA515D624D046E04A75136AB4E44D2D6)
eaa97795e9.exe (PID: 8524 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\100001 6001\eaa97 795e9.exe" MD5: CA515D624D046E04A75136AB4E44D2D6)
RageMP131.exe (PID: 8896 cmdline:
"C:\Users\ user\AppDa ta\Local\R ageMP131\R ageMP131.e xe" MD5: CA515D624D046E04A75136AB4E44D2D6)
axplong.exe (PID: 8252 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\8254624 243\axplon g.exe MD5: 1259EEE53EAE1FC7B96F6DFEB18C47D7)
explortu.exe (PID: 1096 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\9217037 dc9\explor tu.exe MD5: 20FE52F3BA934B9B7454C194F44D74D0)
- cleanup