amadey | e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
167	4264	rundll32.exe
168	5028	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	explorgu.exe

Executes dropped EXE 7 IoCs

pid	Process
3148	explorgu.exe
1440	osminog.exe
4864	goldprime123.exe
1640	judith.exe
544	stub.exe
1460	swizzyy.exe
1264	Amadeygold.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Wine	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Wine	explorgu.exe

Loads dropped DLL 34 IoCs

pid	Process
968	rundll32.exe
4264	rundll32.exe
5028	rundll32.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe
544	stub.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3360	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
3148	explorgu.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 4456	1440	osminog.exe	109
PID 4864 set thread context of 4448	4864	goldprime123.exe	112
PID 1460 set thread context of 2280	1460	swizzyy.exe	125

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
4168	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2964	tasklist.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3360	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
3360	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
3148	explorgu.exe
3148	explorgu.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
4264	rundll32.exe
388	powershell.exe
388	powershell.exe
388	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	goldprime123.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	2280	RegAsm.exe
Token: SeIncreaseQuotaPrivilege	2068	WMIC.exe
Token: SeSecurityPrivilege	2068	WMIC.exe
Token: SeTakeOwnershipPrivilege	2068	WMIC.exe
Token: SeLoadDriverPrivilege	2068	WMIC.exe
Token: SeSystemProfilePrivilege	2068	WMIC.exe
Token: SeSystemtimePrivilege	2068	WMIC.exe
Token: SeProfSingleProcessPrivilege	2068	WMIC.exe
Token: SeIncBasePriorityPrivilege	2068	WMIC.exe
Token: SeCreatePagefilePrivilege	2068	WMIC.exe
Token: SeBackupPrivilege	2068	WMIC.exe
Token: SeRestorePrivilege	2068	WMIC.exe
Token: SeShutdownPrivilege	2068	WMIC.exe
Token: SeDebugPrivilege	2068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2068	WMIC.exe
Token: SeRemoteShutdownPrivilege	2068	WMIC.exe
Token: SeUndockPrivilege	2068	WMIC.exe
Token: SeManageVolumePrivilege	2068	WMIC.exe
Token: 33	2068	WMIC.exe
Token: 34	2068	WMIC.exe
Token: 35	2068	WMIC.exe
Token: 36	2068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4168	WMIC.exe
Token: SeSecurityPrivilege	4168	WMIC.exe
Token: SeTakeOwnershipPrivilege	4168	WMIC.exe
Token: SeLoadDriverPrivilege	4168	WMIC.exe
Token: SeSystemProfilePrivilege	4168	WMIC.exe
Token: SeSystemtimePrivilege	4168	WMIC.exe
Token: SeProfSingleProcessPrivilege	4168	WMIC.exe
Token: SeIncBasePriorityPrivilege	4168	WMIC.exe
Token: SeCreatePagefilePrivilege	4168	WMIC.exe
Token: SeBackupPrivilege	4168	WMIC.exe
Token: SeRestorePrivilege	4168	WMIC.exe
Token: SeShutdownPrivilege	4168	WMIC.exe
Token: SeDebugPrivilege	4168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4168	WMIC.exe
Token: SeRemoteShutdownPrivilege	4168	WMIC.exe
Token: SeUndockPrivilege	4168	WMIC.exe
Token: SeManageVolumePrivilege	4168	WMIC.exe
Token: 33	4168	WMIC.exe
Token: 34	4168	WMIC.exe
Token: 35	4168	WMIC.exe
Token: 36	4168	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3360	e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 1440	3148	explorgu.exe	107
PID 3148 wrote to memory of 1440	3148	explorgu.exe	107
PID 3148 wrote to memory of 1440	3148	explorgu.exe	107
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 1440 wrote to memory of 4456	1440	osminog.exe	109
PID 3148 wrote to memory of 4864	3148	explorgu.exe	110
PID 3148 wrote to memory of 4864	3148	explorgu.exe	110
PID 3148 wrote to memory of 4864	3148	explorgu.exe	110
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 4864 wrote to memory of 4448	4864	goldprime123.exe	112
PID 3148 wrote to memory of 968	3148	explorgu.exe	113
PID 3148 wrote to memory of 968	3148	explorgu.exe	113
PID 3148 wrote to memory of 968	3148	explorgu.exe	113
PID 968 wrote to memory of 4264	968	rundll32.exe	114
PID 968 wrote to memory of 4264	968	rundll32.exe	114
PID 4264 wrote to memory of 5040	4264	rundll32.exe	115
PID 4264 wrote to memory of 5040	4264	rundll32.exe	115
PID 4264 wrote to memory of 388	4264	rundll32.exe	117
PID 4264 wrote to memory of 388	4264	rundll32.exe	117
PID 3148 wrote to memory of 5028	3148	explorgu.exe	119
PID 3148 wrote to memory of 5028	3148	explorgu.exe	119
PID 3148 wrote to memory of 5028	3148	explorgu.exe	119
PID 3148 wrote to memory of 1640	3148	explorgu.exe	121
PID 3148 wrote to memory of 1640	3148	explorgu.exe	121
PID 1640 wrote to memory of 544	1640	judith.exe	122
PID 1640 wrote to memory of 544	1640	judith.exe	122
PID 3148 wrote to memory of 1460	3148	explorgu.exe	123
PID 3148 wrote to memory of 1460	3148	explorgu.exe	123
PID 3148 wrote to memory of 1460	3148	explorgu.exe	123
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 1460 wrote to memory of 2280	1460	swizzyy.exe	125
PID 544 wrote to memory of 4104	544	stub.exe	126
PID 544 wrote to memory of 4104	544	stub.exe	126
PID 544 wrote to memory of 5060	544	stub.exe	128
PID 544 wrote to memory of 5060	544	stub.exe	128
PID 544 wrote to memory of 1604	544	stub.exe	129
PID 544 wrote to memory of 1604	544	stub.exe	129
PID 544 wrote to memory of 1076	544	stub.exe	130
PID 544 wrote to memory of 1076	544	stub.exe	130
PID 544 wrote to memory of 636	544	stub.exe	131
PID 544 wrote to memory of 636	544	stub.exe	131
PID 1604 wrote to memory of 2068	1604	cmd.exe	136
PID 1604 wrote to memory of 2068	1604	cmd.exe	136
PID 5060 wrote to memory of 4168	5060	cmd.exe	137
PID 5060 wrote to memory of 4168	5060	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe
"C:\Users\Admin\AppData\Local\Temp\e5a4738de69040a176db92bbe2f8fdfae9e0df9b7e0719f9cea75862cbf6c120.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3360

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
  "C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4456
- C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe
  "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\098131212907_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:388
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe
  "C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\onefile_1640_133541432652904043\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:1076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      PID:3948
- C:\Users\Admin\AppData\Local\Temp\1000843001\swizzyy.exe
  "C:\Users\Admin\AppData\Local\Temp\1000843001\swizzyy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"
  2⤵
  - Executes dropped EXE
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion