amadey | 5e3b337f41ccbe39106b15ea3a07759c01ee41e7d18ed62395f277767634c768

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v1584Cq.exetz6332.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v1584Cq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v1584Cq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v1584Cq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v1584Cq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v1584Cq.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/804-149-0x0000000002470000-0x00000000024B6000-memory.dmp	family_redline
behavioral1/memory/804-150-0x00000000024B0000-0x00000000024F4000-memory.dmp	family_redline
behavioral1/memory/804-151-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-152-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-156-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-154-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-158-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-162-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-160-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-164-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-170-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-168-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-166-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-172-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-175-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-179-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-183-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-181-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-185-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline
behavioral1/memory/804-187-0x00000000024B0000-0x00000000024EE000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	serv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	serv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	serv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	serv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	serv.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	serv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	serv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	serv.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

serv.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions serv.exe
Downloads MZ/PE file
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

serv.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	serv.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

serv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	serv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	serv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	serv.exe

Executes dropped EXE 13 IoCs

Processes:

zap6706.exezap1083.exezap0037.exetz6332.exev1584Cq.exew71By41.exexbsuQ12.exey73Vf37.exelegenda.exeserv.exesvchost.exeYJROPMCQjRX9.exelegenda.exe

pid	process
1692	zap6706.exe
1544	zap1083.exe
564	zap0037.exe
648	tz6332.exe
1796	v1584Cq.exe
804	w71By41.exe
892	xbsuQ12.exe
1448	y73Vf37.exe
1108	legenda.exe
1724	serv.exe
1256	svchost.exe
1048	YJROPMCQjRX9.exe
1588	legenda.exe

Loads dropped DLL 31 IoCs

Processes:

setup.exezap6706.exezap1083.exezap0037.exev1584Cq.exew71By41.exexbsuQ12.exey73Vf37.exelegenda.exeserv.exesvchost.exeYJROPMCQjRX9.exerundll32.exe

pid	process
1696	setup.exe
1692	zap6706.exe
1692	zap6706.exe
1544	zap1083.exe
1544	zap1083.exe
564	zap0037.exe
564	zap0037.exe
564	zap0037.exe
564	zap0037.exe
1796	v1584Cq.exe
1544	zap1083.exe
1544	zap1083.exe
804	w71By41.exe
1692	zap6706.exe
892	xbsuQ12.exe
1696	setup.exe
1448	y73Vf37.exe
1448	y73Vf37.exe
1108	legenda.exe
1108	legenda.exe
1108	legenda.exe
1724	serv.exe
1108	legenda.exe
1108	legenda.exe
1256	svchost.exe
1108	legenda.exe
1048	YJROPMCQjRX9.exe
700	rundll32.exe
700	rundll32.exe
700	rundll32.exe
700	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

tz6332.exev1584Cq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	tz6332.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz6332.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	v1584Cq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v1584Cq.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

zap1083.exezap0037.exesetup.exezap6706.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1083.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap0037.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	setup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap6706.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

serv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	serv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	serv.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

serv.exe

pid process

1724 serv.exe
1724 serv.exe
1724 serv.exe
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

serv.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN serv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1724	serv.exe
1724	serv.exe
1724	serv.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	serv.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

628 schtasks.exe

pid	process
628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

tz6332.exev1584Cq.exew71By41.exexbsuQ12.exeYJROPMCQjRX9.exeserv.exe

pid	process
648	tz6332.exe
648	tz6332.exe
1796	v1584Cq.exe
1796	v1584Cq.exe
804	w71By41.exe
804	w71By41.exe
892	xbsuQ12.exe
892	xbsuQ12.exe
1048	YJROPMCQjRX9.exe
1048	YJROPMCQjRX9.exe
1048	YJROPMCQjRX9.exe
1048	YJROPMCQjRX9.exe
1048	YJROPMCQjRX9.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe
1724	serv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tz6332.exev1584Cq.exew71By41.exexbsuQ12.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	648	tz6332.exe
Token: SeDebugPrivilege	1796	v1584Cq.exe
Token: SeDebugPrivilege	804	w71By41.exe
Token: SeDebugPrivilege	892	xbsuQ12.exe
Token: SeIncreaseQuotaPrivilege	1596	wmic.exe
Token: SeSecurityPrivilege	1596	wmic.exe
Token: SeTakeOwnershipPrivilege	1596	wmic.exe
Token: SeLoadDriverPrivilege	1596	wmic.exe
Token: SeSystemProfilePrivilege	1596	wmic.exe
Token: SeSystemtimePrivilege	1596	wmic.exe
Token: SeProfSingleProcessPrivilege	1596	wmic.exe
Token: SeIncBasePriorityPrivilege	1596	wmic.exe
Token: SeCreatePagefilePrivilege	1596	wmic.exe
Token: SeBackupPrivilege	1596	wmic.exe
Token: SeRestorePrivilege	1596	wmic.exe
Token: SeShutdownPrivilege	1596	wmic.exe
Token: SeDebugPrivilege	1596	wmic.exe
Token: SeSystemEnvironmentPrivilege	1596	wmic.exe
Token: SeRemoteShutdownPrivilege	1596	wmic.exe
Token: SeUndockPrivilege	1596	wmic.exe
Token: SeManageVolumePrivilege	1596	wmic.exe
Token: 33	1596	wmic.exe
Token: 34	1596	wmic.exe
Token: 35	1596	wmic.exe
Token: SeIncreaseQuotaPrivilege	1596	wmic.exe
Token: SeSecurityPrivilege	1596	wmic.exe
Token: SeTakeOwnershipPrivilege	1596	wmic.exe
Token: SeLoadDriverPrivilege	1596	wmic.exe
Token: SeSystemProfilePrivilege	1596	wmic.exe
Token: SeSystemtimePrivilege	1596	wmic.exe
Token: SeProfSingleProcessPrivilege	1596	wmic.exe
Token: SeIncBasePriorityPrivilege	1596	wmic.exe
Token: SeCreatePagefilePrivilege	1596	wmic.exe
Token: SeBackupPrivilege	1596	wmic.exe
Token: SeRestorePrivilege	1596	wmic.exe
Token: SeShutdownPrivilege	1596	wmic.exe
Token: SeDebugPrivilege	1596	wmic.exe
Token: SeSystemEnvironmentPrivilege	1596	wmic.exe
Token: SeRemoteShutdownPrivilege	1596	wmic.exe
Token: SeUndockPrivilege	1596	wmic.exe
Token: SeManageVolumePrivilege	1596	wmic.exe
Token: 33	1596	wmic.exe
Token: 34	1596	wmic.exe
Token: 35	1596	wmic.exe
Token: SeIncreaseQuotaPrivilege	1540	WMIC.exe
Token: SeSecurityPrivilege	1540	WMIC.exe
Token: SeTakeOwnershipPrivilege	1540	WMIC.exe
Token: SeLoadDriverPrivilege	1540	WMIC.exe
Token: SeSystemProfilePrivilege	1540	WMIC.exe
Token: SeSystemtimePrivilege	1540	WMIC.exe
Token: SeProfSingleProcessPrivilege	1540	WMIC.exe
Token: SeIncBasePriorityPrivilege	1540	WMIC.exe
Token: SeCreatePagefilePrivilege	1540	WMIC.exe
Token: SeBackupPrivilege	1540	WMIC.exe
Token: SeRestorePrivilege	1540	WMIC.exe
Token: SeShutdownPrivilege	1540	WMIC.exe
Token: SeDebugPrivilege	1540	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1540	WMIC.exe
Token: SeRemoteShutdownPrivilege	1540	WMIC.exe
Token: SeUndockPrivilege	1540	WMIC.exe
Token: SeManageVolumePrivilege	1540	WMIC.exe
Token: 33	1540	WMIC.exe
Token: 34	1540	WMIC.exe
Token: 35	1540	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup.exezap6706.exezap1083.exezap0037.exey73Vf37.exelegenda.exe

description	pid	process	target process
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1696 wrote to memory of 1692	1696	setup.exe	zap6706.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1692 wrote to memory of 1544	1692	zap6706.exe	zap1083.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 1544 wrote to memory of 564	1544	zap1083.exe	zap0037.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 648	564	zap0037.exe	tz6332.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 564 wrote to memory of 1796	564	zap0037.exe	v1584Cq.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1544 wrote to memory of 804	1544	zap1083.exe	w71By41.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1692 wrote to memory of 892	1692	zap6706.exe	xbsuQ12.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1696 wrote to memory of 1448	1696	setup.exe	y73Vf37.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1448 wrote to memory of 1108	1448	y73Vf37.exe	legenda.exe
PID 1108 wrote to memory of 628	1108	legenda.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6706.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6706.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1083.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1083.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0037.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0037.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6332.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6332.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1584Cq.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1584Cq.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w71By41.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w71By41.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbsuQ12.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbsuQ12.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y73Vf37.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y73Vf37.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1500

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:1284

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1288

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:1836

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"
4⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1724

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
PID:1912

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
PID:1624

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:904

C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
"C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1048

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:700

C:\Windows\system32\taskeng.exe
taskeng.exe {C0EE1DA2-F301-44E8-83D3-5E89D61F7F85} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]
1⤵
PID:2016

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
2⤵
- Executes dropped EXE
PID:1588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery