amadey | d9ed35ad9a48a546ade2bb12b34b3e66a12239a2bfe742afae6d83490c6defc9

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oneetx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostamd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostclp.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x0006000000023261-285.dat	net_reactor
behavioral2/files/0x0006000000023261-291.dat	net_reactor
behavioral2/files/0x0006000000023261-292.dat	net_reactor
behavioral2/memory/2076-294-0x0000000000410000-0x0000000000780000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostamd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostamd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oneetx.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	taskhostamd.exe

Executes dropped EXE 3 IoCs

pid	Process
1956	taskhostamd.exe
4776	taskhostclp.exe
2832	oneetx.exe

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000600000002324d-184.dat	themida
behavioral2/files/0x000600000002324d-186.dat	themida
behavioral2/memory/1956-187-0x0000000000850000-0x0000000000F46000-memory.dmp	themida
behavioral2/memory/1956-192-0x0000000000850000-0x0000000000F46000-memory.dmp	themida
behavioral2/memory/1956-193-0x0000000000850000-0x0000000000F46000-memory.dmp	themida
behavioral2/memory/1956-194-0x0000000000850000-0x0000000000F46000-memory.dmp	themida
behavioral2/memory/1956-195-0x0000000000850000-0x0000000000F46000-memory.dmp	themida
behavioral2/files/0x000600000002324d-208.dat	themida
behavioral2/files/0x0006000000023252-221.dat	themida
behavioral2/memory/2832-225-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/memory/1956-219-0x0000000000850000-0x0000000000F46000-memory.dmp	themida
behavioral2/memory/2832-236-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/memory/2832-237-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/memory/2832-238-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/memory/2832-239-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/files/0x0006000000023252-242.dat	themida
behavioral2/memory/2832-241-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/memory/2832-267-0x0000000000930000-0x0000000001026000-memory.dmp	themida
behavioral2/memory/2832-300-0x0000000000930000-0x0000000001026000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	taskhostclp.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostamd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oneetx.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1956	taskhostamd.exe
4776	taskhostclp.exe
2832	oneetx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2224	sc.exe
468	sc.exe
3952	sc.exe
4968	sc.exe
1756	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2416	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	63	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
776	MsBuild.exe
776	MsBuild.exe
1956	taskhostamd.exe
1956	taskhostamd.exe
2832	oneetx.exe
2832	oneetx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe
Token: SeDebugPrivilege	776	MsBuild.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	taskhostamd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 4528 wrote to memory of 776	4528	0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe	91
PID 776 wrote to memory of 1956	776	MsBuild.exe	93
PID 776 wrote to memory of 1956	776	MsBuild.exe	93
PID 776 wrote to memory of 1956	776	MsBuild.exe	93
PID 776 wrote to memory of 4776	776	MsBuild.exe	95
PID 776 wrote to memory of 4776	776	MsBuild.exe	95
PID 1956 wrote to memory of 2832	1956	taskhostamd.exe	97
PID 1956 wrote to memory of 2832	1956	taskhostamd.exe	97
PID 1956 wrote to memory of 2832	1956	taskhostamd.exe	97

C:\Users\Admin\AppData\Local\Temp\0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe
"C:\Users\Admin\AppData\Local\Temp\0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Users\Admin\AppData\Local\Temp\taskhostamd.exe
    "C:\Users\Admin\AppData\Local\Temp\taskhostamd.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2832
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2416
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\eb0f58bce7" /P "Admin:N"&&CACLS "..\eb0f58bce7" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:1932
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3564
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        6⤵
        
        PID:3584
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        6⤵
        
        PID:4684
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\eb0f58bce7" /P "Admin:N"
        6⤵
        
        PID:468
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3000
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\eb0f58bce7" /P "Admin:R" /E
        6⤵
        
        PID:1160
- - C:\Users\Admin\AppData\Local\Temp\taskhostclp.exe
    "C:\Users\Admin\AppData\Local\Temp\taskhostclp.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4776
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      PID:3180
- - C:\Users\Admin\AppData\Local\Temp\rdpcllp.exe
    "C:\Users\Admin\AppData\Local\Temp\rdpcllp.exe"
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\taskmask.exe
    "C:\Users\Admin\AppData\Local\Temp\taskmask.exe"
    3⤵
    PID:2076
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      4⤵
      PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      4⤵
      PID:3412
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      4⤵
      PID:3464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2492

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1972
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4968
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1756
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2224
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:468
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:3952

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:4796
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:1544
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:3012
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:1560
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:4108

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:3760

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery