Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe
Resource
win10v2004-20240426-en
General
-
Target
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe
-
Size
1.8MB
-
MD5
85366d6b902fe5c56dfb87e266bba63b
-
SHA1
3111c219af8dc0aa5d9b50eba007faa048d40ba5
-
SHA256
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3
-
SHA512
d2f16e667e4b6870ba90a834da3df8ba1dd5be6eed356aebf78b6be514897bb25b4ee037cf7a21ea1cc25a381ffe0ec8a7198d9b5ed18b9a5e83941df88805a1
-
SSDEEP
49152:UWLz4Lx7MhcwBU55ghwa1llg1Drp809EgUke6rQV:Bz++cwSshwz1DrllU6QV
Malware Config
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
axplont.exeaxplont.exeaxplont.execec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplont.exeaxplont.exeaxplont.exeaxplont.execec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe -
Executes dropped EXE 4 IoCs
Processes:
axplont.exeaxplont.exeaxplont.exeaxplont.exepid process 4340 axplont.exe 3980 axplont.exe 884 axplont.exe 2772 axplont.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exeaxplont.exeaxplont.exeaxplont.exeaxplont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exeaxplont.exeaxplont.exeaxplont.exeaxplont.exepid process 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe 4340 axplont.exe 3980 axplont.exe 884 axplont.exe 2772 axplont.exe -
Drops file in Windows directory 1 IoCs
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exedescription ioc process File created C:\Windows\Tasks\axplont.job cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exeaxplont.exeaxplont.exeaxplont.exeaxplont.exepid process 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe 4340 axplont.exe 4340 axplont.exe 3980 axplont.exe 3980 axplont.exe 884 axplont.exe 884 axplont.exe 2772 axplont.exe 2772 axplont.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exepid process 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exedescription pid process target process PID 2396 wrote to memory of 4340 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe axplont.exe PID 2396 wrote to memory of 4340 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe axplont.exe PID 2396 wrote to memory of 4340 2396 cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe axplont.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe"C:\Users\Admin\AppData\Local\Temp\cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeFilesize
1.8MB
MD585366d6b902fe5c56dfb87e266bba63b
SHA13111c219af8dc0aa5d9b50eba007faa048d40ba5
SHA256cec5bf38d5bd86d7aaa920777a22cea7c67aa5acc370ac4f76b4a3fcfb7035c3
SHA512d2f16e667e4b6870ba90a834da3df8ba1dd5be6eed356aebf78b6be514897bb25b4ee037cf7a21ea1cc25a381ffe0ec8a7198d9b5ed18b9a5e83941df88805a1
-
memory/884-39-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/884-40-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/2396-3-0x0000000000650000-0x0000000000B11000-memory.dmpFilesize
4.8MB
-
memory/2396-5-0x0000000000650000-0x0000000000B11000-memory.dmpFilesize
4.8MB
-
memory/2396-17-0x0000000000650000-0x0000000000B11000-memory.dmpFilesize
4.8MB
-
memory/2396-2-0x0000000000651000-0x000000000067F000-memory.dmpFilesize
184KB
-
memory/2396-1-0x0000000077774000-0x0000000077776000-memory.dmpFilesize
8KB
-
memory/2396-0-0x0000000000650000-0x0000000000B11000-memory.dmpFilesize
4.8MB
-
memory/2772-49-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/2772-48-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/3980-27-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/3980-24-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/3980-25-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-31-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-21-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-29-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-30-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-22-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-32-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-33-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-34-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-35-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-36-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-37-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-28-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-20-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-41-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-42-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-43-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-44-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-45-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-46-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-19-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-18-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB
-
memory/4340-50-0x00000000001F0000-0x00000000006B1000-memory.dmpFilesize
4.8MB