amadey | 84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AA78.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
88	3732	rundll32.exe
93	2388	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AA78.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AA78.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	explorgu.exe

Deletes itself 1 IoCs

pid	Process
3584	Process not Found

Executes dropped EXE 7 IoCs

pid	Process
5100	AA78.exe
3700	explorgu.exe
3372	1691.exe
2624	osminog.exe
3320	goldprime1234.exe
2620	620E.exe
2428	841D.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	AA78.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	explorgu.exe

Loads dropped DLL 4 IoCs

pid	Process
3060	rundll32.exe
3732	rundll32.exe
2388	rundll32.exe
3372	1691.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	841D.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5100	AA78.exe
3700	explorgu.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 4308	2624	osminog.exe	111
PID 3320 set thread context of 3288	3320	goldprime1234.exe	118
PID 3372 set thread context of 688	3372	1691.exe	127

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	AA78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1088	4308	WerFault.exe	111
4052	4308	WerFault.exe	111
228	3372	WerFault.exe	107
2364	688	WerFault.exe	127
1580	2620	WerFault.exe	136

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1940	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
1940	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1940	84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeDebugPrivilege	2624	osminog.exe
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeDebugPrivilege	3320	goldprime1234.exe
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3584	Process not Found

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 5100	3584	Process not Found	103
PID 3584 wrote to memory of 5100	3584	Process not Found	103
PID 3584 wrote to memory of 5100	3584	Process not Found	103
PID 3584 wrote to memory of 3372	3584	Process not Found	107
PID 3584 wrote to memory of 3372	3584	Process not Found	107
PID 3584 wrote to memory of 3372	3584	Process not Found	107
PID 3700 wrote to memory of 2624	3700	explorgu.exe	108
PID 3700 wrote to memory of 2624	3700	explorgu.exe	108
PID 3700 wrote to memory of 2624	3700	explorgu.exe	108
PID 2624 wrote to memory of 364	2624	osminog.exe	110
PID 2624 wrote to memory of 364	2624	osminog.exe	110
PID 2624 wrote to memory of 364	2624	osminog.exe	110
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 2624 wrote to memory of 4308	2624	osminog.exe	111
PID 3700 wrote to memory of 3320	3700	explorgu.exe	116
PID 3700 wrote to memory of 3320	3700	explorgu.exe	116
PID 3700 wrote to memory of 3320	3700	explorgu.exe	116
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3320 wrote to memory of 3288	3320	goldprime1234.exe	118
PID 3700 wrote to memory of 3060	3700	explorgu.exe	120
PID 3700 wrote to memory of 3060	3700	explorgu.exe	120
PID 3700 wrote to memory of 3060	3700	explorgu.exe	120
PID 3060 wrote to memory of 3732	3060	rundll32.exe	121
PID 3060 wrote to memory of 3732	3060	rundll32.exe	121
PID 3732 wrote to memory of 1460	3732	rundll32.exe	122
PID 3732 wrote to memory of 1460	3732	rundll32.exe	122
PID 3732 wrote to memory of 3448	3732	rundll32.exe	124
PID 3732 wrote to memory of 3448	3732	rundll32.exe	124
PID 3700 wrote to memory of 2388	3700	explorgu.exe	126
PID 3700 wrote to memory of 2388	3700	explorgu.exe	126
PID 3700 wrote to memory of 2388	3700	explorgu.exe	126
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3372 wrote to memory of 688	3372	1691.exe	127
PID 3584 wrote to memory of 2620	3584	Process not Found	136
PID 3584 wrote to memory of 2620	3584	Process not Found	136
PID 3584 wrote to memory of 2620	3584	Process not Found	136
PID 3584 wrote to memory of 2428	3584	Process not Found	142
PID 3584 wrote to memory of 2428	3584	Process not Found	142
PID 3584 wrote to memory of 2428	3584	Process not Found	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe
"C:\Users\Admin\AppData\Local\Temp\84c81970d4af15114473225603bae7517743476e0bb4fc65dc0f890cf61e7ca6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1940

C:\Users\Admin\AppData\Local\Temp\AA78.exe
C:\Users\Admin\AppData\Local\Temp\AA78.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
PID:5100

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
  "C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:364
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1244
      4⤵
      Program crash
      PID:1088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1228
      4⤵
      Program crash
      PID:4052
- C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:1460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\999976163400_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2388

C:\Users\Admin\AppData\Local\Temp\1691.exe
C:\Users\Admin\AppData\Local\Temp\1691.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 612
    3⤵
    - Program crash
    PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1020
  2⤵
  - Program crash
  PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4308 -ip 4308
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4308 -ip 4308
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3372 -ip 3372
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 688 -ip 688
1⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\620E.exe
C:\Users\Admin\AppData\Local\Temp\620E.exe
1⤵
- Executes dropped EXE
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1080
  2⤵
  - Program crash
  PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2620 -ip 2620
1⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\841D.exe
C:\Users\Admin\AppData\Local\Temp\841D.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion