Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 22:19
Behavioral task
behavioral1
Sample
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe
Resource
win7-20231129-en
General
-
Target
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe
-
Size
1.8MB
-
MD5
cdc65246c0f8b5a8b817385647c65dd2
-
SHA1
254ed48e117fb89462e1e2c713baad6d2f76fb49
-
SHA256
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93
-
SHA512
65f3c526eb906d64bbbd704730e97b0ddfc2c65ae43ac396402b41d04019775aa028d7fe15f46bb82a4fd75498e97d9dadb2b19123e736aea5785d041951e7df
-
SSDEEP
49152:pn3ZJ5CTaCMUTPNDWp3C3fvsS/MhQmI7v4UI:Bv5C7M8PNDS3CvvihVI7vTI
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
amadey
4.20
c767c0
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Detects executables packed with Themida 47 IoCs
Processes:
resource yara_rule behavioral2/memory/412-1-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-0-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-3-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-4-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-8-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-7-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-5-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-6-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-2-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-20-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/412-21-0x0000000000220000-0x0000000000778000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-27-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-24-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-30-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-29-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-28-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-26-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-25-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-23-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Users\Admin\AppData\Local\Temp\1000014001\c37ac1adc8.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-82-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-86-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-87-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-84-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-83-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-85-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-88-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-90-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-91-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-89-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4244-110-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/740-111-0x0000000000150000-0x00000000007C4000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-122-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-124-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-123-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-121-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-119-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-117-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-120-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-118-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5072-127-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5096-149-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5096-151-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5096-157-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5096-150-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/5096-159-0x0000000000790000-0x0000000000CE8000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
Processes:
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exeexplorku.exeamers.exeaxplons.exec37ac1adc8.exeaxplons.exeexplorku.exeaxplons.exe8016eb9e7a.exeexplorku.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amers.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c37ac1adc8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8016eb9e7a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorku.exeamers.exeexplorku.exe4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exeaxplons.exec37ac1adc8.exe8016eb9e7a.exeexplorku.exeaxplons.exeaxplons.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c37ac1adc8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c37ac1adc8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8016eb9e7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8016eb9e7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exeexplorku.exeamers.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation explorku.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation amers.exe -
Executes dropped EXE 9 IoCs
Processes:
explorku.exeamers.exeaxplons.exec37ac1adc8.exe8016eb9e7a.exeexplorku.exeaxplons.exeaxplons.exeexplorku.exepid process 4244 explorku.exe 2044 amers.exe 3632 axplons.exe 740 c37ac1adc8.exe 904 8016eb9e7a.exe 5072 explorku.exe 604 axplons.exe 684 axplons.exe 5096 explorku.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
amers.exeaxplons.exe8016eb9e7a.exeaxplons.exeaxplons.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine amers.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine 8016eb9e7a.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine axplons.exe -
Processes:
resource yara_rule behavioral2/memory/412-1-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-0-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-3-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-4-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-8-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-7-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-5-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-6-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/412-2-0x0000000000220000-0x0000000000778000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe themida behavioral2/memory/4244-20-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/412-21-0x0000000000220000-0x0000000000778000-memory.dmp themida behavioral2/memory/4244-27-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-24-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-30-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-29-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-28-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-26-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-25-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/4244-23-0x0000000000790000-0x0000000000CE8000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\1000014001\c37ac1adc8.exe themida behavioral2/memory/4244-82-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/740-86-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-87-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-84-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-83-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-85-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-88-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-90-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-91-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/740-89-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/4244-110-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/740-111-0x0000000000150000-0x00000000007C4000-memory.dmp themida behavioral2/memory/5072-122-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-124-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-123-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-121-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-119-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-117-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-120-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-118-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5072-127-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5096-149-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5096-151-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5096-157-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5096-150-0x0000000000790000-0x0000000000CE8000-memory.dmp themida behavioral2/memory/5096-159-0x0000000000790000-0x0000000000CE8000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorku.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c37ac1adc8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\c37ac1adc8.exe" explorku.exe -
Processes:
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exeexplorku.exec37ac1adc8.exeexplorku.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c37ac1adc8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
amers.exeaxplons.exe8016eb9e7a.exeaxplons.exeaxplons.exepid process 2044 amers.exe 3632 axplons.exe 904 8016eb9e7a.exe 604 axplons.exe 684 axplons.exe -
Drops file in Windows directory 2 IoCs
Processes:
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exeamers.exedescription ioc process File created C:\Windows\Tasks\explorku.job 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe File created C:\Windows\Tasks\axplons.job amers.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
amers.exeaxplons.exe8016eb9e7a.exeaxplons.exeaxplons.exepid process 2044 amers.exe 2044 amers.exe 3632 axplons.exe 3632 axplons.exe 904 8016eb9e7a.exe 904 8016eb9e7a.exe 604 axplons.exe 604 axplons.exe 684 axplons.exe 684 axplons.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
amers.exepid process 2044 amers.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exeexplorku.exeamers.exedescription pid process target process PID 412 wrote to memory of 4244 412 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe explorku.exe PID 412 wrote to memory of 4244 412 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe explorku.exe PID 412 wrote to memory of 4244 412 4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe explorku.exe PID 4244 wrote to memory of 2496 4244 explorku.exe explorku.exe PID 4244 wrote to memory of 2496 4244 explorku.exe explorku.exe PID 4244 wrote to memory of 2496 4244 explorku.exe explorku.exe PID 4244 wrote to memory of 2044 4244 explorku.exe amers.exe PID 4244 wrote to memory of 2044 4244 explorku.exe amers.exe PID 4244 wrote to memory of 2044 4244 explorku.exe amers.exe PID 2044 wrote to memory of 3632 2044 amers.exe axplons.exe PID 2044 wrote to memory of 3632 2044 amers.exe axplons.exe PID 2044 wrote to memory of 3632 2044 amers.exe axplons.exe PID 4244 wrote to memory of 740 4244 explorku.exe c37ac1adc8.exe PID 4244 wrote to memory of 740 4244 explorku.exe c37ac1adc8.exe PID 4244 wrote to memory of 740 4244 explorku.exe c37ac1adc8.exe PID 4244 wrote to memory of 904 4244 explorku.exe 8016eb9e7a.exe PID 4244 wrote to memory of 904 4244 explorku.exe 8016eb9e7a.exe PID 4244 wrote to memory of 904 4244 explorku.exe 8016eb9e7a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe"C:\Users\Admin\AppData\Local\Temp\4f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000014001\c37ac1adc8.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\c37ac1adc8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\1000017002\8016eb9e7a.exe"C:\Users\Admin\1000017002\8016eb9e7a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exeFilesize
1.8MB
MD5892705659d5306f4bc035c5336467bd0
SHA13f7933c4077786fb4470fc22d1ce8d3461c60ad9
SHA256e3842feba845bde8f3578d681363bb71ce13669992b140846aa3d03002773af0
SHA5127afec2802a48aa88996853a082880d1b10218b9c707c0d9408c8e10a3879235cd3501322e8d5d527440f34cc3a54c9286b73d508c36b1331dddf3193a5418170
-
C:\Users\Admin\AppData\Local\Temp\1000014001\c37ac1adc8.exeFilesize
2.1MB
MD5f4283e1713cbe7ec9d63bd5425fc7fad
SHA1d3927818b39a3dc0161008f6e9a83d0f189ec7e0
SHA2564af883a4eba393535752e1b52a78719f277c5ea50807d40dc5cc86e4f9dd54d6
SHA512415550b3a79c44508aaf1dc71315fe777cdf5eaac2c80ea44f602e1740156539b984cc718cee21853268057b7d7f901a4f51a748242d769a12f5dc437f1032ba
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.8MB
MD5cdc65246c0f8b5a8b817385647c65dd2
SHA1254ed48e117fb89462e1e2c713baad6d2f76fb49
SHA2564f7bb05edfb383b45568b57b070655812cbc2f7cbbc6fe6f772e16dc55c27e93
SHA51265f3c526eb906d64bbbd704730e97b0ddfc2c65ae43ac396402b41d04019775aa028d7fe15f46bb82a4fd75498e97d9dadb2b19123e736aea5785d041951e7df
-
memory/412-4-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-8-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-7-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-5-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-6-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-2-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-1-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-21-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-3-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/412-0-0x0000000000220000-0x0000000000778000-memory.dmpFilesize
5.3MB
-
memory/604-125-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/604-128-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/684-161-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/684-156-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/740-91-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-85-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-86-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-87-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-89-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-90-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-88-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-84-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-111-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/740-83-0x0000000000150000-0x00000000007C4000-memory.dmpFilesize
6.5MB
-
memory/904-108-0x0000000000F80000-0x0000000001445000-memory.dmpFilesize
4.8MB
-
memory/904-107-0x0000000000F80000-0x0000000001445000-memory.dmpFilesize
4.8MB
-
memory/2044-63-0x0000000000A90000-0x0000000000F55000-memory.dmpFilesize
4.8MB
-
memory/2044-49-0x0000000077D04000-0x0000000077D06000-memory.dmpFilesize
8KB
-
memory/2044-48-0x0000000000A90000-0x0000000000F55000-memory.dmpFilesize
4.8MB
-
memory/3632-109-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-135-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-145-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-60-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-139-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-133-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-142-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-113-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/3632-130-0x0000000000FC0000-0x0000000001485000-memory.dmpFilesize
4.8MB
-
memory/4244-28-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-82-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-20-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-110-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-27-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-24-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-30-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-29-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-26-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-25-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/4244-23-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-117-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-123-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-118-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-120-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-122-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-119-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-121-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-124-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5072-127-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5096-157-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5096-151-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5096-150-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5096-159-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB
-
memory/5096-149-0x0000000000790000-0x0000000000CE8000-memory.dmpFilesize
5.3MB