Analysis
- max time kernel
134s - max time network
302s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
08/03/2024, 04:51
General
- Target 3c26086d42e1cfb9a4cdcf340f37d1c18952e2b264e6f374858b642117fa26f2.exe
- Size 1.9MB
- Sample240308-fg34tsge2y
- SHA256 3c26086d42e1cfb9a4cdcf340f37d1c18952e2b264e6f374858b642117fa26f2
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
20.218.68.91:7690
Extracted
-
lumma
-
https://resergvearyinitiani.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
-
https://executivebrakeji.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 3 IoCs
- Detected google phishing page
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Contacts a large (4828) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 21 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 37 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Windows directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- NSIS installer 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c26086d42e1cfb9a4cdcf340f37d1c18952e2b264e6f374858b642117fa26f2.exe"C:\Users\Admin\AppData\Local\Temp\3c26086d42e1cfb9a4cdcf340f37d1c18952e2b264e6f374858b642117fa26f2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\824464007487_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_1924_133543471840460123\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 11324⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000864001\InstallSetup_three.exe"C:\Users\Admin\AppData\Local\Temp\1000864001\InstallSetup_three.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u64.0.exe"C:\Users\Admin\AppData\Local\Temp\u64.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\u64.1.exe"C:\Users\Admin\AppData\Local\Temp\u64.1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000865001\dais.exe"C:\Users\Admin\AppData\Local\Temp\1000865001\dais.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000871001\lastrovs.exe"C:\Users\Admin\AppData\Local\Temp\1000871001\lastrovs.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000874021\random.cmd" "2⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\824464007487_Desktop.zip' -CompressionLevel Optimal6⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000881001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000881001\file300un.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000881001\file300un.exe" -Force3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Users\Admin\Pictures\YSRS4LczCmit76Z9ZSaisCxl.exe"C:\Users\Admin\Pictures\YSRS4LczCmit76Z9ZSaisCxl.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\wfplwfs.exeC:\Users\Admin\AppData\Local\Temp\wfplwfs.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\2.3.1.1.exeC:\Users\Admin\AppData\Local\Temp\2.3.1.1.exe6⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 21932 -s 14647⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\Pictures\YSRS4LczCmit76Z9ZSaisCxl.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Pictures\0hViPHcc6VvRjK58VN974sjL.exe"C:\Users\Admin\Pictures\0hViPHcc6VvRjK58VN974sjL.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\0hViPHcc6VvRjK58VN974sjL.exe"C:\Users\Admin\Pictures\0hViPHcc6VvRjK58VN974sjL.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\HluQ5l6CphzGT9yDwy8bUwSw.exe"C:\Users\Admin\Pictures\HluQ5l6CphzGT9yDwy8bUwSw.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\HluQ5l6CphzGT9yDwy8bUwSw.exe"C:\Users\Admin\Pictures\HluQ5l6CphzGT9yDwy8bUwSw.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\mlOQJvKoaiCyb1OgwsCrCthg.exe"C:\Users\Admin\Pictures\mlOQJvKoaiCyb1OgwsCrCthg.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\mlOQJvKoaiCyb1OgwsCrCthg.exe"C:\Users\Admin\Pictures\mlOQJvKoaiCyb1OgwsCrCthg.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\hf4hrQ18n0on5CRrZ3U8p7Cm.exe"C:\Users\Admin\Pictures\hf4hrQ18n0on5CRrZ3U8p7Cm.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\hf4hrQ18n0on5CRrZ3U8p7Cm.exe"C:\Users\Admin\Pictures\hf4hrQ18n0on5CRrZ3U8p7Cm.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\thIAXXHXOuQerJAc3HbeFJhS.exe"C:\Users\Admin\Pictures\thIAXXHXOuQerJAc3HbeFJhS.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\syncUpd.exeC:\Users\Admin\AppData\Local\Temp\syncUpd.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\Pictures\5VTiWBBlkwPD1ruXX281pi1a.exe"C:\Users\Admin\Pictures\5VTiWBBlkwPD1ruXX281pi1a.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\syncUpd.exeC:\Users\Admin\AppData\Local\Temp\syncUpd.exe5⤵
-
-
-
C:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exe"C:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exeC:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6dee21c8,0x6dee21d4,0x6dee21e05⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\o9CJfZ5qjg0Td2BPz5HNRlme.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\o9CJfZ5qjg0Td2BPz5HNRlme.exe" --version5⤵
-
-
C:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exe"C:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=7624 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240308045452" --session-guid=9dc1cf90-2aa6-4652-b525-11fa784fe29f --server-tracking-blob=YjM4MWMzZGJkMDRlMzcwZTJhYmU3MmVmZTAzNmYxMDZiZTc1Y2NmNzhmNzY2ZGJmZThiZWY4MTk1MGFjZDU4NDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwOTg3MzY2Ny40MzAxIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIyMDU4Mjc1OS1lNTVjLTQzZWEtYTc2Ni1mMjUyYzNhYmVkMDYifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=50040000000000005⤵
-
C:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exeC:\Users\Admin\Pictures\o9CJfZ5qjg0Td2BPz5HNRlme.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x6d5621c8,0x6d5621d4,0x6d5621e06⤵
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\824464007487_Desktop.zip' -CompressionLevel Optimal4⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
3tIX5M4qxqc8sxMGKhwfRRIW.exe
GcvOk7QObXCVpMMXNEnhlbBN.exe
edgecompatviewlist[1].xml
accounts.google[1].xml
favicon[1].ico
4Kv5U5b1o3f[1].png
explorgu.exe
explorgu.exe
osminog.exe
goldprime123.exe
judith.exe
Amadeygold.exe
lumma28282828.exe
alex12341.exe
InstallSetup_three.exe
dais.exe
lastrovs.exe
Reload.exe
random.exe
random.cmd
amadka.exe
file300un.exe
824464007487_Desktop.zip
BroomSetup.exe
_ctypes.pyd
_sqlite3.pyd
_rust.pyd
libcrypto-1_1.dll
libffi-7.dll
sqlite3.dll
unicodedata.pyd
Opera_installer_24030804545231322692.dll
__PSScriptPolicyTest_zjbkbdrx.bx1.ps1
INetC.dll
VCRUNTIME140.dll
python310.dll
stub.exe
stub.exe
syncUpd.exe
m5QAwEQsY6wYqTLhwfCRonRZ.exe
clip64.dll
cred64.dll
clip64.dll
cred64.dll
clip64.dll
cred64.dll
FjykRPfL3xvHZi5cLSbcl4NW.exe
hiNTSKjy04Q0Ycp9cguiNhdS.exe
o9CJfZ5qjg0Td2BPz5HNRlme.exe
oiqvI8loNWTtxvataPYk5RfA.exe
_asyncio.pyd
_bz2.pyd
_cffi_backend.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_helpers.pyd
_rust.pyd
libcrypto-1_1.dll
libcrypto-1_1.dll
libssl-1_1.dll
_multidict.pyd
select.pyd
sqlite3.dll
unicodedata.pyd
_quoting_c.pyd
python3.dll
memory/212-600-0x000001508DD20000-0x000001508DD30000-memory.dmp
memory/212-621-0x000001508E700000-0x000001508E710000-memory.dmp
memory/216-90-0x0000000007D00000-0x0000000007D3E000-memory.dmp
memory/216-82-0x00000000050B0000-0x0000000005142000-memory.dmp
memory/216-77-0x0000000000400000-0x0000000000450000-memory.dmp
memory/216-184-0x0000000072840000-0x0000000072F2E000-memory.dmp
memory/216-79-0x0000000005410000-0x000000000590E000-memory.dmp
memory/216-84-0x0000000005050000-0x000000000505A000-memory.dmp
memory/216-97-0x00000000088F0000-0x0000000008940000-memory.dmp
memory/216-96-0x0000000008E20000-0x000000000934C000-memory.dmp
memory/216-95-0x0000000008720000-0x00000000088E2000-memory.dmp
memory/216-94-0x0000000007E60000-0x0000000007EC6000-memory.dmp
memory/216-91-0x0000000007D40000-0x0000000007D8B000-memory.dmp
memory/216-89-0x0000000006410000-0x0000000006422000-memory.dmp
memory/216-88-0x0000000007BB0000-0x0000000007CBA000-memory.dmp
memory/216-87-0x0000000006460000-0x0000000006A66000-memory.dmp
memory/216-86-0x0000000072840000-0x0000000072F2E000-memory.dmp
memory/220-467-0x0000000000400000-0x0000000001A50000-memory.dmp
memory/1508-51-0x0000000002C80000-0x0000000004C80000-memory.dmp
memory/1508-98-0x0000000002C80000-0x0000000004C80000-memory.dmp
memory/1508-41-0x0000000000930000-0x0000000000986000-memory.dmp
memory/1508-42-0x0000000072990000-0x000000007307E000-memory.dmp
memory/1508-43-0x0000000005310000-0x0000000005320000-memory.dmp
memory/1508-52-0x0000000072990000-0x000000007307E000-memory.dmp
memory/1520-183-0x0000000003250000-0x0000000005250000-memory.dmp
memory/1520-72-0x0000000000F30000-0x0000000000FC2000-memory.dmp
memory/1520-83-0x0000000072840000-0x0000000072F2E000-memory.dmp
memory/1520-85-0x0000000003250000-0x0000000005250000-memory.dmp
memory/1520-74-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/1520-73-0x0000000072840000-0x0000000072F2E000-memory.dmp
memory/1924-344-0x00007FF668A60000-0x00007FF669537000-memory.dmp
memory/3060-55-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/3060-54-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/3060-53-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/3060-49-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3060-46-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3060-56-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/3060-57-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/3060-58-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3204-353-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3204-350-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3344-5-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/3344-7-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/3344-2-0x0000000000FD0000-0x00000000014A2000-memory.dmp
memory/3344-3-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/3344-4-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/3344-1-0x0000000077744000-0x0000000077745000-memory.dmp
memory/3344-15-0x0000000000FD0000-0x00000000014A2000-memory.dmp
memory/3344-11-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/3344-0-0x0000000000FD0000-0x00000000014A2000-memory.dmp
memory/3344-6-0x0000000000FC0000-0x0000000000FC1000-memory.dmp
memory/3344-10-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/3344-8-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/3600-541-0x0000000000400000-0x0000000000930000-memory.dmp
memory/3812-328-0x00007FF79AAF0000-0x00007FF79BD29000-memory.dmp
memory/4240-376-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4416-20-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/4416-25-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/4416-200-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-508-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-199-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-561-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-196-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-346-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-425-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-93-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-92-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-80-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-26-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/4416-27-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/4416-21-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/4416-23-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/4416-24-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/4416-143-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-22-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/4416-19-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-201-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4416-18-0x0000000000C10000-0x00000000010E2000-memory.dmp
memory/4468-120-0x00000148E7DA0000-0x00000148E7DB0000-memory.dmp
memory/4468-144-0x00000148E7DA0000-0x00000148E7DB0000-memory.dmp
memory/4468-115-0x00000148E7E50000-0x00000148E7E72000-memory.dmp
memory/4468-158-0x00000148E8080000-0x00000148E8092000-memory.dmp
memory/4468-171-0x00000148E7FE0000-0x00000148E7FEA000-memory.dmp
memory/4468-182-0x00007FF952B20000-0x00007FF95350C000-memory.dmp
memory/4468-119-0x00007FF952B20000-0x00007FF95350C000-memory.dmp
memory/4468-118-0x00000148E8000000-0x00000148E8076000-memory.dmp
memory/4468-121-0x00000148E7DA0000-0x00000148E7DB0000-memory.dmp
memory/4984-477-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4984-537-0x0000000000400000-0x0000000001A30000-memory.dmp