amadey | 5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09

Virtualization/Sandbox Evasion

Processes:

e3c5ecf51e.exeaxplont.exeamers.exeaxplont.exe11fdc4c629.exeexplortu.exeaxplont.exe5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exeexplortu.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e3c5ecf51e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amers.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	11fdc4c629.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

Processes:

explortu.exe11fdc4c629.exeaxplont.exeexplortu.exe5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exeaxplont.exee3c5ecf51e.exeamers.exeexplortu.exeaxplont.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	11fdc4c629.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	11fdc4c629.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e3c5ecf51e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e3c5ecf51e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amers.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amers.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe

Executes dropped EXE 9 IoCs

Processes:

explortu.exeamers.exeaxplont.exe11fdc4c629.exee3c5ecf51e.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exe

pid	process
3440	explortu.exe
540	amers.exe
2388	axplont.exe
4940	11fdc4c629.exe
2740	e3c5ecf51e.exe
3864	explortu.exe
952	axplont.exe
864	explortu.exe
1892	axplont.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

explortu.exee3c5ecf51e.exeexplortu.exeaxplont.exe5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exeamers.exeaxplont.exeexplortu.exeaxplont.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	e3c5ecf51e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	amers.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine	axplont.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000003001\11fdc4c629.exe	themida
behavioral2/memory/4940-73-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-75-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-77-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-78-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-79-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-76-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-74-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-72-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida
behavioral2/memory/4940-101-0x0000000000B50000-0x00000000011C3000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explortu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\11fdc4c629.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000003001\\11fdc4c629.exe"	explortu.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

11fdc4c629.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 11fdc4c629.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	11fdc4c629.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exeexplortu.exeamers.exeaxplont.exee3c5ecf51e.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exe

pid	process
2500	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
3440	explortu.exe
540	amers.exe
2388	axplont.exe
2740	e3c5ecf51e.exe
952	axplont.exe
3864	explortu.exe
864	explortu.exe
1892	axplont.exe

Drops file in Windows directory 2 IoCs

Processes:

amers.exe5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe

description	ioc	process
File created	C:\Windows\Tasks\axplont.job	amers.exe
File created	C:\Windows\Tasks\explortu.job	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exeexplortu.exeamers.exeaxplont.exee3c5ecf51e.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exe

pid	process
2500	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
2500	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
3440	explortu.exe
3440	explortu.exe
540	amers.exe
540	amers.exe
2388	axplont.exe
2388	axplont.exe
2740	e3c5ecf51e.exe
2740	e3c5ecf51e.exe
3864	explortu.exe
3864	explortu.exe
952	axplont.exe
952	axplont.exe
864	explortu.exe
864	explortu.exe
1892	axplont.exe
1892	axplont.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe

pid process

2500 5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exeexplortu.exeamers.exe

description	pid	process	target process
PID 2500 wrote to memory of 3440	2500	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe	explortu.exe
PID 2500 wrote to memory of 3440	2500	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe	explortu.exe
PID 2500 wrote to memory of 3440	2500	5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe	explortu.exe
PID 3440 wrote to memory of 2012	3440	explortu.exe	explortu.exe
PID 3440 wrote to memory of 2012	3440	explortu.exe	explortu.exe
PID 3440 wrote to memory of 2012	3440	explortu.exe	explortu.exe
PID 3440 wrote to memory of 540	3440	explortu.exe	amers.exe
PID 3440 wrote to memory of 540	3440	explortu.exe	amers.exe
PID 3440 wrote to memory of 540	3440	explortu.exe	amers.exe
PID 540 wrote to memory of 2388	540	amers.exe	axplont.exe
PID 540 wrote to memory of 2388	540	amers.exe	axplont.exe
PID 540 wrote to memory of 2388	540	amers.exe	axplont.exe
PID 3440 wrote to memory of 4940	3440	explortu.exe	11fdc4c629.exe
PID 3440 wrote to memory of 4940	3440	explortu.exe	11fdc4c629.exe
PID 3440 wrote to memory of 4940	3440	explortu.exe	11fdc4c629.exe
PID 3440 wrote to memory of 2740	3440	explortu.exe	e3c5ecf51e.exe
PID 3440 wrote to memory of 2740	3440	explortu.exe	e3c5ecf51e.exe
PID 3440 wrote to memory of 2740	3440	explortu.exe	e3c5ecf51e.exe

C:\Users\Admin\AppData\Local\Temp\5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe
"C:\Users\Admin\AppData\Local\Temp\5326e0e7a15ab2e5392db6c221d9003146f13b0ff6aad6c2ef3725fdc8b44a09.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2500

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3440

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
3⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\1000002001\amers.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\amers.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2388

C:\Users\Admin\AppData\Local\Temp\1000003001\11fdc4c629.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\11fdc4c629.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4940

C:\Users\Admin\1000004002\e3c5ecf51e.exe
"C:\Users\Admin\1000004002\e3c5ecf51e.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2740

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3864

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:952

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

2

Credential Access

Discovery

Query Registry

3

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2