amadey | 833e356ad60d06a5f8a75c7cfacb09fa977f8d95076a50786582553090a02753

Virtualization/Sandbox Evasion

Processes:

6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exeexplorgu.exerandom.exeamert.exerandom.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

flow pid process

70 756 rundll32.exe
73 4520 rundll32.exe
135 4496 rundll32.exe
136 1620 rundll32.exe

flow	pid	process
70	756	rundll32.exe
73	4520	rundll32.exe
135	4496	rundll32.exe
136	1620	rundll32.exe

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe	dave

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exeexplorgu.exeamert.exerandom.exerandom.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

newsun.exensn7156.tmpchrosha.exeexplorgu.exeRegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	newsun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	nsn7156.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	chrosha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 26 IoCs

Processes:

explorgu.exedais.exealex12.exeosminog.exegoldprime123.exeolehpsp.exefate.exejuditttt.exestub.exejokerpos.exewin.exesad182772.exeswizzy.exeAmadeygold.exerandom.exeInstallSetup3.exelumma28282828.exenewsun.exelastrovs.exensn7156.tmpchrosha.exenewsun.exeamert.exeseratwo.exerandom.exenewsun.exe

pid	process
2196	explorgu.exe
552	dais.exe
4952	alex12.exe
1528	osminog.exe
2380	goldprime123.exe
2448	olehpsp.exe
3232	fate.exe
2804	juditttt.exe
1656	stub.exe
3560	jokerpos.exe
1056	win.exe
712	sad182772.exe
1192	swizzy.exe
3760	Amadeygold.exe
4132	random.exe
4192	InstallSetup3.exe
4908	lumma28282828.exe
1380	newsun.exe
3100	lastrovs.exe
4672	nsn7156.tmp
1112	chrosha.exe
916	newsun.exe
1356	amert.exe
3236	seratwo.exe
2076	random.exe
2728	newsun.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exeexplorgu.exerandom.exeamert.exerandom.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	random.exe

Loads dropped DLL 51 IoCs

Processes:

rundll32.exerundll32.exerundll32.exestub.exeRegAsm.exeInstallSetup3.exeRegAsm.exensn7156.tmpRegAsm.exerundll32.exerundll32.exerundll32.exe

pid	process
4040	rundll32.exe
756	rundll32.exe
4520	rundll32.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1656	stub.exe
1228	RegAsm.exe
1228	RegAsm.exe
4192	InstallSetup3.exe
4436	RegAsm.exe
4436	RegAsm.exe
4192	InstallSetup3.exe
4192	InstallSetup3.exe
4672	nsn7156.tmp
4672	nsn7156.tmp
4192	InstallSetup3.exe
4192	InstallSetup3.exe
3756	RegAsm.exe
3756	RegAsm.exe
3272	rundll32.exe
4496	rundll32.exe
1620	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

chrosha.exeexplorgu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000048001\\random.exe"	chrosha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000851001\\random.exe"	explorgu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

115 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exeexplorgu.exerandom.exeamert.exerandom.exe

pid process

3832 6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
2196 explorgu.exe
4132 random.exe
1356 amert.exe
2076 random.exe

flow	ioc
115	ip-api.com

Suspicious use of SetThreadContext 7 IoCs

Processes:

osminog.exealex12.exegoldprime123.exejokerpos.exesad182772.exeswizzy.exelumma28282828.exe

description	pid	process	target process
PID 1528 set thread context of 2216	1528	osminog.exe	RegAsm.exe
PID 4952 set thread context of 3268	4952	alex12.exe	RegAsm.exe
PID 2380 set thread context of 4200	2380	goldprime123.exe	RegAsm.exe
PID 3560 set thread context of 1228	3560	jokerpos.exe	RegAsm.exe
PID 712 set thread context of 4436	712	sad182772.exe	RegAsm.exe
PID 1192 set thread context of 3756	1192	swizzy.exe	RegAsm.exe
PID 4908 set thread context of 3768	4908	lumma28282828.exe	RegAsm.exe

Drops file in Windows directory 2 IoCs

Processes:

Amadeygold.exe6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe

description	ioc	process
File created	C:\Windows\Tasks\chrosha.job	Amadeygold.exe
File created	C:\Windows\Tasks\explorgu.job	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3956 4672 WerFault.exe nsn7156.tmp

pid	pid_target	process	target process
3956	4672	WerFault.exe	nsn7156.tmp

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exeRegAsm.exensn7156.tmpRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsn7156.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsn7156.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4664 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4780 timeout.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

3636 WMIC.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4864 tasklist.exe
2324 tasklist.exe

pid	process
4664	schtasks.exe

pid	process
4780	timeout.exe

pid	process
3636	WMIC.exe

pid	process
4864	tasklist.exe
2324	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exeexplorgu.exerundll32.exedais.exepowershell.exeolehpsp.exeRegAsm.exeRegAsm.exefate.exerandom.exeRegAsm.exensn7156.tmpamert.exerandom.exeRegAsm.exerundll32.exe

pid	process
3832	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
3832	6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
2196	explorgu.exe
2196	explorgu.exe
756	rundll32.exe
756	rundll32.exe
756	rundll32.exe
756	rundll32.exe
756	rundll32.exe
756	rundll32.exe
552	dais.exe
552	dais.exe
756	rundll32.exe
756	rundll32.exe
756	rundll32.exe
756	rundll32.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
2448	olehpsp.exe
2448	olehpsp.exe
1228	RegAsm.exe
1228	RegAsm.exe
4200	RegAsm.exe
4200	RegAsm.exe
4200	RegAsm.exe
4200	RegAsm.exe
1228	RegAsm.exe
1228	RegAsm.exe
3232	fate.exe
3232	fate.exe
3232	fate.exe
3232	fate.exe
4200	RegAsm.exe
4200	RegAsm.exe
4132	random.exe
4132	random.exe
4436	RegAsm.exe
4436	RegAsm.exe
3232	fate.exe
3232	fate.exe
4436	RegAsm.exe
4436	RegAsm.exe
4672	nsn7156.tmp
4672	nsn7156.tmp
4672	nsn7156.tmp
4672	nsn7156.tmp
1356	amert.exe
1356	amert.exe
2076	random.exe
2076	random.exe
3756	RegAsm.exe
3756	RegAsm.exe
3756	RegAsm.exe
3756	RegAsm.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

dais.exegoldprime123.exeolehpsp.exepowershell.exetasklist.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	552	dais.exe
Token: SeDebugPrivilege	2380	goldprime123.exe
Token: SeDebugPrivilege	2448	olehpsp.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3636	WMIC.exe
Token: SeSecurityPrivilege	3636	WMIC.exe
Token: SeTakeOwnershipPrivilege	3636	WMIC.exe
Token: SeLoadDriverPrivilege	3636	WMIC.exe
Token: SeSystemProfilePrivilege	3636	WMIC.exe
Token: SeSystemtimePrivilege	3636	WMIC.exe
Token: SeProfSingleProcessPrivilege	3636	WMIC.exe
Token: SeIncBasePriorityPrivilege	3636	WMIC.exe
Token: SeCreatePagefilePrivilege	3636	WMIC.exe
Token: SeBackupPrivilege	3636	WMIC.exe
Token: SeRestorePrivilege	3636	WMIC.exe
Token: SeShutdownPrivilege	3636	WMIC.exe
Token: SeDebugPrivilege	3636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3636	WMIC.exe
Token: SeRemoteShutdownPrivilege	3636	WMIC.exe
Token: SeUndockPrivilege	3636	WMIC.exe
Token: SeManageVolumePrivilege	3636	WMIC.exe
Token: 33	3636	WMIC.exe
Token: 34	3636	WMIC.exe
Token: 35	3636	WMIC.exe
Token: 36	3636	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3316	WMIC.exe
Token: SeSecurityPrivilege	3316	WMIC.exe
Token: SeTakeOwnershipPrivilege	3316	WMIC.exe
Token: SeLoadDriverPrivilege	3316	WMIC.exe
Token: SeSystemProfilePrivilege	3316	WMIC.exe
Token: SeSystemtimePrivilege	3316	WMIC.exe
Token: SeProfSingleProcessPrivilege	3316	WMIC.exe
Token: SeIncBasePriorityPrivilege	3316	WMIC.exe
Token: SeCreatePagefilePrivilege	3316	WMIC.exe
Token: SeBackupPrivilege	3316	WMIC.exe
Token: SeRestorePrivilege	3316	WMIC.exe
Token: SeShutdownPrivilege	3316	WMIC.exe
Token: SeDebugPrivilege	3316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3316	WMIC.exe
Token: SeRemoteShutdownPrivilege	3316	WMIC.exe
Token: SeUndockPrivilege	3316	WMIC.exe
Token: SeManageVolumePrivilege	3316	WMIC.exe
Token: 33	3316	WMIC.exe
Token: 34	3316	WMIC.exe
Token: 35	3316	WMIC.exe
Token: 36	3316	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3636	WMIC.exe
Token: SeSecurityPrivilege	3636	WMIC.exe
Token: SeTakeOwnershipPrivilege	3636	WMIC.exe
Token: SeLoadDriverPrivilege	3636	WMIC.exe
Token: SeSystemProfilePrivilege	3636	WMIC.exe
Token: SeSystemtimePrivilege	3636	WMIC.exe
Token: SeProfSingleProcessPrivilege	3636	WMIC.exe
Token: SeIncBasePriorityPrivilege	3636	WMIC.exe
Token: SeCreatePagefilePrivilege	3636	WMIC.exe
Token: SeBackupPrivilege	3636	WMIC.exe
Token: SeRestorePrivilege	3636	WMIC.exe
Token: SeShutdownPrivilege	3636	WMIC.exe
Token: SeDebugPrivilege	3636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3636	WMIC.exe
Token: SeRemoteShutdownPrivilege	3636	WMIC.exe
Token: SeUndockPrivilege	3636	WMIC.exe
Token: SeManageVolumePrivilege	3636	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exeAmadeygold.exe

pid process

3832 6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
3760 Amadeygold.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

explorgu.exeosminog.exealex12.exegoldprime123.exeRegAsm.exerundll32.exerundll32.exejuditttt.exe

description	pid	process	target process
PID 2196 wrote to memory of 552	2196	explorgu.exe	dais.exe
PID 2196 wrote to memory of 552	2196	explorgu.exe	dais.exe
PID 2196 wrote to memory of 4952	2196	explorgu.exe	alex12.exe
PID 2196 wrote to memory of 4952	2196	explorgu.exe	alex12.exe
PID 2196 wrote to memory of 4952	2196	explorgu.exe	alex12.exe
PID 2196 wrote to memory of 1528	2196	explorgu.exe	osminog.exe
PID 2196 wrote to memory of 1528	2196	explorgu.exe	osminog.exe
PID 2196 wrote to memory of 1528	2196	explorgu.exe	osminog.exe
PID 1528 wrote to memory of 4124	1528	osminog.exe	Conhost.exe
PID 1528 wrote to memory of 4124	1528	osminog.exe	Conhost.exe
PID 1528 wrote to memory of 4124	1528	osminog.exe	Conhost.exe
PID 4952 wrote to memory of 244	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 244	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 244	4952	alex12.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 1528 wrote to memory of 2216	1528	osminog.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 4952 wrote to memory of 3268	4952	alex12.exe	RegAsm.exe
PID 2196 wrote to memory of 2380	2196	explorgu.exe	goldprime123.exe
PID 2196 wrote to memory of 2380	2196	explorgu.exe	goldprime123.exe
PID 2196 wrote to memory of 2380	2196	explorgu.exe	goldprime123.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 2380 wrote to memory of 4200	2380	goldprime123.exe	RegAsm.exe
PID 3268 wrote to memory of 2448	3268	RegAsm.exe	olehpsp.exe
PID 3268 wrote to memory of 2448	3268	RegAsm.exe	olehpsp.exe
PID 3268 wrote to memory of 3232	3268	RegAsm.exe	fate.exe
PID 3268 wrote to memory of 3232	3268	RegAsm.exe	fate.exe
PID 3268 wrote to memory of 3232	3268	RegAsm.exe	fate.exe
PID 2196 wrote to memory of 4040	2196	explorgu.exe	rundll32.exe
PID 2196 wrote to memory of 4040	2196	explorgu.exe	rundll32.exe
PID 2196 wrote to memory of 4040	2196	explorgu.exe	rundll32.exe
PID 4040 wrote to memory of 756	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 756	4040	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 2020	756	rundll32.exe	netsh.exe
PID 756 wrote to memory of 2020	756	rundll32.exe	netsh.exe
PID 756 wrote to memory of 1408	756	rundll32.exe	powershell.exe
PID 756 wrote to memory of 1408	756	rundll32.exe	powershell.exe
PID 2196 wrote to memory of 2804	2196	explorgu.exe	juditttt.exe
PID 2196 wrote to memory of 2804	2196	explorgu.exe	juditttt.exe
PID 2196 wrote to memory of 4520	2196	explorgu.exe	rundll32.exe
PID 2196 wrote to memory of 4520	2196	explorgu.exe	rundll32.exe
PID 2196 wrote to memory of 4520	2196	explorgu.exe	rundll32.exe
PID 2804 wrote to memory of 1656	2804	juditttt.exe	stub.exe
PID 2804 wrote to memory of 1656	2804	juditttt.exe	stub.exe
PID 2196 wrote to memory of 3560	2196	explorgu.exe	jokerpos.exe

C:\Users\Admin\AppData\Local\Temp\6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe
"C:\Users\Admin\AppData\Local\Temp\6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3832

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exe
"C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exe
"C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3268

C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:2176

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:8

C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe
"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:2020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\134859772495_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe
"C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\onefile_2804_133539881642265827\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:4936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:4564

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
4⤵
PID:2528

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get Manufacturer
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "gdb --version"
4⤵
PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:2596

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
4⤵
PID:3452

C:\Windows\System32\Wbem\WMIC.exe
wmic path Win32_ComputerSystem get Manufacturer
5⤵
PID:1188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:3448

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:4764

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:2324

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4520

C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exe
"C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1228

C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe
"C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe"
2⤵
- Executes dropped EXE
PID:1056

C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exe
"C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4436

C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exe
"C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3756

C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe
"C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:3760

C:\Users\Admin\AppData\Local\Temp\1000851001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000851001\random.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4132

C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exe
"C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4192

C:\Users\Admin\AppData\Local\Temp\nsn7156.tmp
C:\Users\Admin\AppData\Local\Temp\nsn7156.tmp
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsn7156.tmp" & del "C:\ProgramData\*.dll"" & exit
4⤵
PID:1476

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
5⤵
- Delays execution with timeout.exe
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 2480
4⤵
- Program crash
PID:3956

C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe
"C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3768

C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
"C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1380

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN newsun.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe" /F
3⤵
- Creates scheduled task(s)
PID:4664

C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exe
"C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exe"
2⤵
- Executes dropped EXE
PID:3100

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:1112

C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1356

C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exe
"C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exe"
2⤵
- Executes dropped EXE
PID:3236

C:\Users\Admin\AppData\Local\Temp\1000048001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000048001\random.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2076

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:3272

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:2324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\134859772495_Desktop.zip' -CompressionLevel Optimal
4⤵
PID:4532

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4672 -ip 4672
1⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
1⤵
- Executes dropped EXE
PID:916

C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
1⤵
- Executes dropped EXE
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery