amadey | 453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b

Virtualization/Sandbox Evasion

Processes:

explorgu.exerandom.exeamert.exerandom.exe453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

flow pid process

72 1332 rundll32.exe
77 456 rundll32.exe
130 3528 rundll32.exe
131 1512 rundll32.exe

flow	pid	process
72	1332	rundll32.exe
77	456	rundll32.exe
130	3528	rundll32.exe
131	1512	rundll32.exe

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe	dave

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exerandom.exerandom.exeexplorgu.exeamert.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

RegAsm.exenewsun.exechrosha.exense8FAB.tmpexplorgu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	newsun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	chrosha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	nse8FAB.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	explorgu.exe

Executes dropped EXE 25 IoCs

Processes:

explorgu.exedais.exealex12.exeosminog.exefate.exeolehpsp.exegoldprime123.exejuditttt.exestub.exejokerpos.exewin.exesad182772.exeswizzy.exeAmadeygold.exerandom.exeInstallSetup3.exelumma28282828.exenewsun.exelastrovs.exense8FAB.tmpchrosha.exenewsun.exeamert.exeseratwo.exerandom.exe

pid	process
3484	explorgu.exe
1988	dais.exe
856	alex12.exe
2180	osminog.exe
2756	fate.exe
2488	olehpsp.exe
2680	goldprime123.exe
860	juditttt.exe
4160	stub.exe
412	jokerpos.exe
1060	win.exe
972	sad182772.exe
2844	swizzy.exe
4000	Amadeygold.exe
2088	random.exe
4868	InstallSetup3.exe
540	lumma28282828.exe
4516	newsun.exe
4312	lastrovs.exe
5076	nse8FAB.tmp
4824	chrosha.exe
4580	newsun.exe
5056	amert.exe
4340	seratwo.exe
3664	random.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

amert.exerandom.exe453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exeexplorgu.exerandom.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	random.exe

Loads dropped DLL 50 IoCs

Processes:

rundll32.exerundll32.exestub.exerundll32.exeRegAsm.exeInstallSetup3.exeRegAsm.exense8FAB.tmprundll32.exerundll32.exeRegAsm.exerundll32.exe

pid	process
1100	rundll32.exe
1332	rundll32.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
4160	stub.exe
456	rundll32.exe
4924	RegAsm.exe
4924	RegAsm.exe
4868	InstallSetup3.exe
4868	InstallSetup3.exe
4868	InstallSetup3.exe
4560	RegAsm.exe
4560	RegAsm.exe
5076	nse8FAB.tmp
5076	nse8FAB.tmp
4868	InstallSetup3.exe
4868	InstallSetup3.exe
1960	rundll32.exe
3528	rundll32.exe
1880	RegAsm.exe
1880	RegAsm.exe
1512	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorgu.exechrosha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000851001\\random.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000048001\\random.exe"	chrosha.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

114 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exeexplorgu.exerandom.exeamert.exerandom.exe

pid process

4876 453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
3484 explorgu.exe
2088 random.exe
5056 amert.exe
3664 random.exe

flow	ioc
114	ip-api.com

Suspicious use of SetThreadContext 7 IoCs

Processes:

alex12.exeosminog.exegoldprime123.exejokerpos.exesad182772.exeswizzy.exelumma28282828.exe

description	pid	process	target process
PID 856 set thread context of 3996	856	alex12.exe	RegAsm.exe
PID 2180 set thread context of 4924	2180	osminog.exe	RegAsm.exe
PID 2680 set thread context of 428	2680	goldprime123.exe	RegAsm.exe
PID 412 set thread context of 4924	412	jokerpos.exe	RegAsm.exe
PID 972 set thread context of 1880	972	sad182772.exe	RegAsm.exe
PID 2844 set thread context of 4560	2844	swizzy.exe	RegAsm.exe
PID 540 set thread context of 4160	540	lumma28282828.exe	RegAsm.exe

Drops file in Windows directory 2 IoCs

Processes:

453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exeAmadeygold.exe

description	ioc	process
File created	C:\Windows\Tasks\explorgu.job	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
File created	C:\Windows\Tasks\chrosha.job	Amadeygold.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2728 5076 WerFault.exe nse8FAB.tmp

pid	pid_target	process	target process
2728	5076	WerFault.exe	nse8FAB.tmp

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exense8FAB.tmpRegAsm.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nse8FAB.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nse8FAB.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5032 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4368 timeout.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

2480 WMIC.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2968 tasklist.exe
4112 tasklist.exe

pid	process
5032	schtasks.exe

pid	process
4368	timeout.exe

pid	process
2480	WMIC.exe

pid	process
2968	tasklist.exe
4112	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exeexplorgu.exedais.exerundll32.exeolehpsp.exepowershell.exeRegAsm.exefate.exerandom.exeRegAsm.exeRegAsm.exense8FAB.tmpamert.exerandom.exeRegAsm.exerundll32.exepowershell.exe

pid	process
4876	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
4876	453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
3484	explorgu.exe
3484	explorgu.exe
1988	dais.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
2488	olehpsp.exe
2488	olehpsp.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
4924	RegAsm.exe
4924	RegAsm.exe
2756	fate.exe
2756	fate.exe
2756	fate.exe
2756	fate.exe
2088	random.exe
2088	random.exe
428	RegAsm.exe
4924	RegAsm.exe
4924	RegAsm.exe
2756	fate.exe
2756	fate.exe
428	RegAsm.exe
428	RegAsm.exe
428	RegAsm.exe
428	RegAsm.exe
4560	RegAsm.exe
4560	RegAsm.exe
4560	RegAsm.exe
4560	RegAsm.exe
5076	nse8FAB.tmp
5076	nse8FAB.tmp
5076	nse8FAB.tmp
5076	nse8FAB.tmp
5056	amert.exe
5056	amert.exe
3664	random.exe
3664	random.exe
1880	RegAsm.exe
1880	RegAsm.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe
1880	RegAsm.exe
1880	RegAsm.exe
4200	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

dais.exeolehpsp.exegoldprime123.exeWMIC.exetasklist.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1988	dais.exe
Token: SeDebugPrivilege	2488	olehpsp.exe
Token: SeDebugPrivilege	2680	goldprime123.exe
Token: SeIncreaseQuotaPrivilege	4860	WMIC.exe
Token: SeSecurityPrivilege	4860	WMIC.exe
Token: SeTakeOwnershipPrivilege	4860	WMIC.exe
Token: SeLoadDriverPrivilege	4860	WMIC.exe
Token: SeSystemProfilePrivilege	4860	WMIC.exe
Token: SeSystemtimePrivilege	4860	WMIC.exe
Token: SeProfSingleProcessPrivilege	4860	WMIC.exe
Token: SeIncBasePriorityPrivilege	4860	WMIC.exe
Token: SeCreatePagefilePrivilege	4860	WMIC.exe
Token: SeBackupPrivilege	4860	WMIC.exe
Token: SeRestorePrivilege	4860	WMIC.exe
Token: SeShutdownPrivilege	4860	WMIC.exe
Token: SeDebugPrivilege	4860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4860	WMIC.exe
Token: SeRemoteShutdownPrivilege	4860	WMIC.exe
Token: SeUndockPrivilege	4860	WMIC.exe
Token: SeManageVolumePrivilege	4860	WMIC.exe
Token: 33	4860	WMIC.exe
Token: 34	4860	WMIC.exe
Token: 35	4860	WMIC.exe
Token: 36	4860	WMIC.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2480	WMIC.exe
Token: SeSecurityPrivilege	2480	WMIC.exe
Token: SeTakeOwnershipPrivilege	2480	WMIC.exe
Token: SeLoadDriverPrivilege	2480	WMIC.exe
Token: SeSystemProfilePrivilege	2480	WMIC.exe
Token: SeSystemtimePrivilege	2480	WMIC.exe
Token: SeProfSingleProcessPrivilege	2480	WMIC.exe
Token: SeIncBasePriorityPrivilege	2480	WMIC.exe
Token: SeCreatePagefilePrivilege	2480	WMIC.exe
Token: SeBackupPrivilege	2480	WMIC.exe
Token: SeRestorePrivilege	2480	WMIC.exe
Token: SeShutdownPrivilege	2480	WMIC.exe
Token: SeDebugPrivilege	2480	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2480	WMIC.exe
Token: SeRemoteShutdownPrivilege	2480	WMIC.exe
Token: SeUndockPrivilege	2480	WMIC.exe
Token: SeManageVolumePrivilege	2480	WMIC.exe
Token: 33	2480	WMIC.exe
Token: 34	2480	WMIC.exe
Token: 35	2480	WMIC.exe
Token: 36	2480	WMIC.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeIncreaseQuotaPrivilege	4860	WMIC.exe
Token: SeSecurityPrivilege	4860	WMIC.exe
Token: SeTakeOwnershipPrivilege	4860	WMIC.exe
Token: SeLoadDriverPrivilege	4860	WMIC.exe
Token: SeSystemProfilePrivilege	4860	WMIC.exe
Token: SeSystemtimePrivilege	4860	WMIC.exe
Token: SeProfSingleProcessPrivilege	4860	WMIC.exe
Token: SeIncBasePriorityPrivilege	4860	WMIC.exe
Token: SeCreatePagefilePrivilege	4860	WMIC.exe
Token: SeBackupPrivilege	4860	WMIC.exe
Token: SeRestorePrivilege	4860	WMIC.exe
Token: SeShutdownPrivilege	4860	WMIC.exe
Token: SeDebugPrivilege	4860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4860	WMIC.exe
Token: SeRemoteShutdownPrivilege	4860	WMIC.exe
Token: SeUndockPrivilege	4860	WMIC.exe
Token: SeManageVolumePrivilege	4860	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

explorgu.exealex12.exeRegAsm.exeosminog.exegoldprime123.exerundll32.exerundll32.exejuditttt.exestub.exe

description	pid	process	target process
PID 3484 wrote to memory of 1988	3484	explorgu.exe	dais.exe
PID 3484 wrote to memory of 1988	3484	explorgu.exe	dais.exe
PID 3484 wrote to memory of 856	3484	explorgu.exe	alex12.exe
PID 3484 wrote to memory of 856	3484	explorgu.exe	alex12.exe
PID 3484 wrote to memory of 856	3484	explorgu.exe	alex12.exe
PID 856 wrote to memory of 4672	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 4672	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 4672	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 856 wrote to memory of 3996	856	alex12.exe	RegAsm.exe
PID 3484 wrote to memory of 2180	3484	explorgu.exe	osminog.exe
PID 3484 wrote to memory of 2180	3484	explorgu.exe	osminog.exe
PID 3484 wrote to memory of 2180	3484	explorgu.exe	osminog.exe
PID 3996 wrote to memory of 2756	3996	RegAsm.exe	fate.exe
PID 3996 wrote to memory of 2756	3996	RegAsm.exe	fate.exe
PID 3996 wrote to memory of 2756	3996	RegAsm.exe	fate.exe
PID 3996 wrote to memory of 2488	3996	RegAsm.exe	olehpsp.exe
PID 3996 wrote to memory of 2488	3996	RegAsm.exe	olehpsp.exe
PID 2180 wrote to memory of 2104	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 2104	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 2104	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 2180 wrote to memory of 4924	2180	osminog.exe	RegAsm.exe
PID 3484 wrote to memory of 2680	3484	explorgu.exe	goldprime123.exe
PID 3484 wrote to memory of 2680	3484	explorgu.exe	goldprime123.exe
PID 3484 wrote to memory of 2680	3484	explorgu.exe	goldprime123.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 2680 wrote to memory of 428	2680	goldprime123.exe	RegAsm.exe
PID 3484 wrote to memory of 1100	3484	explorgu.exe	rundll32.exe
PID 3484 wrote to memory of 1100	3484	explorgu.exe	rundll32.exe
PID 3484 wrote to memory of 1100	3484	explorgu.exe	rundll32.exe
PID 1100 wrote to memory of 1332	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1332	1100	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 3312	1332	rundll32.exe	netsh.exe
PID 1332 wrote to memory of 3312	1332	rundll32.exe	netsh.exe
PID 3484 wrote to memory of 860	3484	explorgu.exe	juditttt.exe
PID 3484 wrote to memory of 860	3484	explorgu.exe	juditttt.exe
PID 860 wrote to memory of 4160	860	juditttt.exe	RegAsm.exe
PID 860 wrote to memory of 4160	860	juditttt.exe	RegAsm.exe
PID 4160 wrote to memory of 4200	4160	stub.exe	cmd.exe
PID 4160 wrote to memory of 4200	4160	stub.exe	cmd.exe
PID 4160 wrote to memory of 2936	4160	stub.exe	cmd.exe
PID 4160 wrote to memory of 2936	4160	stub.exe	cmd.exe
PID 4160 wrote to memory of 2976	4160	stub.exe	cmd.exe
PID 4160 wrote to memory of 2976	4160	stub.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe
"C:\Users\Admin\AppData\Local\Temp\453af88f18c2a8321b0a27589f1e5a61a653b1dd4763dbefce8ab5fc6a2a2c1b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3484

C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exe
"C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exe
"C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3996

C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:4152

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4924

C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe
"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:3312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\831553292808_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe
"C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\onefile_860_133539916971226169\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:4200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:2936

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
4⤵
PID:2976

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get Manufacturer
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "gdb --version"
4⤵
PID:3244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:4684

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
4⤵
PID:4500

C:\Windows\System32\Wbem\WMIC.exe
wmic path Win32_ComputerSystem get Manufacturer
5⤵
PID:2272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:3900

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2480

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:1936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:2108

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:4112

C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exe
"C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4924

C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe
"C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe"
2⤵
- Executes dropped EXE
PID:1060

C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exe
"C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:456

C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exe
"C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4560

C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe
"C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4000

C:\Users\Admin\AppData\Local\Temp\1000851001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000851001\random.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2088

C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exe
"C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4868

C:\Users\Admin\AppData\Local\Temp\nse8FAB.tmp
C:\Users\Admin\AppData\Local\Temp\nse8FAB.tmp
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nse8FAB.tmp" & del "C:\ProgramData\*.dll"" & exit
4⤵
PID:3904

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
5⤵
- Delays execution with timeout.exe
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 2544
4⤵
- Program crash
PID:2728

C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe
"C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
"C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4516

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN newsun.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe" /F
3⤵
- Creates scheduled task(s)
PID:5032

C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exe
"C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exe"
2⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4824

C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exe
"C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exe"
2⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\AppData\Local\Temp\1000048001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000048001\random.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3664

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:1960

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3528

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:4144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\831553292808_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1512

C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5076 -ip 5076
1⤵
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery