amadey | 8bee452d2535953e7ad9d18fffacbef60560fc05647c735ef55393c0869b673d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files/Setup.exe
Size 202KB
Sample240620-byeeks1enh
SHA256 c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
MD5 64179e64675e822559cac6652298bdfc
SHA1 cceed3b2441146762512918af7bf7f89fb055583
SHA512 ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280
SSDEEP 3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc vidar xmrig ffb1b9 discovery miner spyware stealer trojan upx

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

amadey

Version

4.30

Botnet

ffb1b9

http://proresupdate.com

Attributes

install_dir
4bbb72a446
install_file
Hkbsse.exe
strings_key
1ebbd218121948a356341fff55521237
url_paths
/h9fmdW5/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral2/memory/4516-26-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-38-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect binaries embedding considerable number of MFA browser extension IDs. 6 IoCs

resource	yara_rule
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 6 IoCs

resource	yara_rule
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 8 IoCs

resource	yara_rule
behavioral2/memory/4516-26-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-38-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs

resource	yara_rule
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 8 IoCs

resource	yara_rule
behavioral2/memory/4516-26-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-38-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing potential Windows Defender anti-emulation checks 8 IoCs

resource	yara_rule
behavioral2/memory/4516-26-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-38-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000235a7-122.dat	INDICATOR_EXE_Packed_Fody

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4084-216-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/4084-219-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/4084-218-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX
behavioral2/memory/4084-221-0x0000000140000000-0x00000001407DC000-memory.dmp	UPX

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/4084-219-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/4084-221-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4084-216-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/4084-219-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/4084-218-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/4084-221-0x0000000140000000-0x00000001407DC000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	CUF.au3

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 3700	2160	Setup.exe	86
PID 3780 set thread context of 1852	3780	DBGHJEBKJE.exe	101
PID 2488 set thread context of 1124	2488	DBKEHDGDGH.exe	104
PID 1124 set thread context of 1080	1124	ftp.exe	112
PID 1080 set thread context of 4084	1080	MSBuild.exe	120

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Watcher Com SH.job	ftp.exe
File created	C:\Windows\Tasks\TWI Cloud Host.job	ftp.exe

Executes dropped EXE 2 IoCs

pid	Process
3780	DBGHJEBKJE.exe
2488	DBKEHDGDGH.exe

Loads dropped DLL 3 IoCs

pid	Process
4516	CUF.au3
4516	CUF.au3
4516	CUF.au3

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CUF.au3

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4464	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Setup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	CUF.au3
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CUF.au3

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2160	Setup.exe
2160	Setup.exe
3700	more.com
3700	more.com
4516	CUF.au3
4516	CUF.au3
3780	DBGHJEBKJE.exe
3780	DBGHJEBKJE.exe
2488	DBKEHDGDGH.exe
2488	DBKEHDGDGH.exe
4516	CUF.au3
4516	CUF.au3
1852	ftp.exe
1852	ftp.exe
1124	ftp.exe
1124	ftp.exe
1080	MSBuild.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2160	Setup.exe
3700	more.com
3780	DBGHJEBKJE.exe
2488	DBKEHDGDGH.exe
1852	ftp.exe
1124	ftp.exe
1124	ftp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2160	Setup.exe
Token: SeTakeOwnershipPrivilege	2160	Setup.exe
Token: SeDebugPrivilege	1080	MSBuild.exe
Token: SeLockMemoryPrivilege	4084	ngen.exe
Token: SeLockMemoryPrivilege	4084	ngen.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4084	ngen.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3700	2160	Setup.exe	86
PID 2160 wrote to memory of 3700	2160	Setup.exe	86
PID 2160 wrote to memory of 3700	2160	Setup.exe	86
PID 2160 wrote to memory of 3700	2160	Setup.exe	86
PID 3700 wrote to memory of 4516	3700	more.com	95
PID 3700 wrote to memory of 4516	3700	more.com	95
PID 3700 wrote to memory of 4516	3700	more.com	95
PID 3700 wrote to memory of 4516	3700	more.com	95
PID 3700 wrote to memory of 4516	3700	more.com	95
PID 4516 wrote to memory of 3780	4516	CUF.au3	99
PID 4516 wrote to memory of 3780	4516	CUF.au3	99
PID 4516 wrote to memory of 3780	4516	CUF.au3	99
PID 3780 wrote to memory of 1852	3780	DBGHJEBKJE.exe	101
PID 3780 wrote to memory of 1852	3780	DBGHJEBKJE.exe	101
PID 3780 wrote to memory of 1852	3780	DBGHJEBKJE.exe	101
PID 4516 wrote to memory of 2488	4516	CUF.au3	103
PID 4516 wrote to memory of 2488	4516	CUF.au3	103
PID 4516 wrote to memory of 2488	4516	CUF.au3	103
PID 2488 wrote to memory of 1124	2488	DBKEHDGDGH.exe	104
PID 2488 wrote to memory of 1124	2488	DBKEHDGDGH.exe	104
PID 2488 wrote to memory of 1124	2488	DBKEHDGDGH.exe	104
PID 3780 wrote to memory of 1852	3780	DBGHJEBKJE.exe	101
PID 2488 wrote to memory of 1124	2488	DBKEHDGDGH.exe	104
PID 4516 wrote to memory of 4844	4516	CUF.au3	108
PID 4516 wrote to memory of 4844	4516	CUF.au3	108
PID 4516 wrote to memory of 4844	4516	CUF.au3	108
PID 4844 wrote to memory of 4464	4844	cmd.exe	110
PID 4844 wrote to memory of 4464	4844	cmd.exe	110
PID 4844 wrote to memory of 4464	4844	cmd.exe	110
PID 1852 wrote to memory of 3108	1852	ftp.exe	111
PID 1852 wrote to memory of 3108	1852	ftp.exe	111
PID 1852 wrote to memory of 3108	1852	ftp.exe	111
PID 1124 wrote to memory of 1080	1124	ftp.exe	112
PID 1124 wrote to memory of 1080	1124	ftp.exe	112
PID 1852 wrote to memory of 3108	1852	ftp.exe	111
PID 1124 wrote to memory of 1080	1124	ftp.exe	112
PID 1124 wrote to memory of 1080	1124	ftp.exe	112
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120
PID 1080 wrote to memory of 4084	1080	MSBuild.exe	120

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\CUF.au3
    C:\Users\Admin\AppData\Local\Temp\CUF.au3
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\ProgramData\DBGHJEBKJE.exe
      "C:\ProgramData\DBGHJEBKJE.exe"
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\Windows\SysWOW64\ftp.exe
        
        C:\Windows\SysWOW64\ftp.exe
        5⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        
        PID:3108
  - - C:\ProgramData\DBKEHDGDGH.exe
      "C:\ProgramData\DBKEHDGDGH.exe"
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SysWOW64\ftp.exe
        
        C:\Windows\SysWOW64\ftp.exe
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1124
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4084
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDAAEHDHIIJ" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNT~1.DLL

Path C:\ProgramData\BGDAAEHDHIIJ\VCRUNT~1.DLL
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\BGDAAEHDHIIJ\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\BGDAAEHDHIIJ\msvcp140.dll
Size 439KB
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
SSDEEP 12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\BGDAAEHDHIIJ\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\ProgramData\BGDAAEHDHIIJ\softokn3.dll
Size 251KB
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP 6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

DBGHJEBKJE.exe

Path C:\ProgramData\DBGHJEBKJE.exe
Size 8.6MB
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8
SSDEEP 98304:kHRNlpNpt3gSuDdFeznbkRBLwX1Pgedmv72Im/xAgDXMnw4bmVKAHNAXqcMHKYsN:uRrptYDdF8komd8xAUXMwIwHNvcMmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

DBKEHDGDGH.exe

Path C:\ProgramData\DBKEHDGDGH.exe
Size 2.3MB
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3
SSDEEP 49152:QMVZsEVMBOL5BdKOPp/6VHAZCRiiQSPyAH0ehXC4KblR1pzA:TVZsHBSBdlSHwJiQSPvHjhy4K/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

9e3a3507

Path C:\Users\Admin\AppData\Local\Temp\9e3a3507
Size 6.8MB
SHA256 de2690431d7a8982839e0c40cc4051d49378e6f750269d5dfb397a5345193b47
MD5 3580f7f7dfcbe541692a7d64ff370339
SHA1 9d973563a8917462062da1e62e509ea66c990dfa
SHA512 a0ef879fde86359d86a653af9bee94b58597bb2022e70fc4f09ed74d2aa346a89fe6712baaafee31c7c8d7cd84350fad9dbf5a75952458bcebebc5ce7d9ee77c
SSDEEP 196608:nQ3lyzs68TADb0j0kx63u22KdcPuijWMUf7lsFM9:Q3ld/TA0gkxiuFKguijtcluM9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUF.au3

Path C:\Users\Admin\AppData\Local\Temp\CUF.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

e66f7ae9

Path C:\Users\Admin\AppData\Local\Temp\e66f7ae9
Size 1.1MB
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5
SSDEEP 24576:3v/gJp5kBRawWokpLs/GFR7v1aV2W5WG9HjLTQ:3AXyRTeI/Gfd8n5WG9DLTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

e8881e54

Path C:\Users\Admin\AppData\Local\Temp\e8881e54
Size 1.1MB
SHA256 b51b908b2677937966747d7d9918ad7cdf605413ee05d851f79ab8b0709e71ed
MD5 26e1ae64df91bf978c857d2cf472c939
SHA1 2cc616bd9b1c7dc24b8ce09f28b4742d3b8259d2
SHA512 527a2159431c58028e870968ff3571b4315955a1e6172ebf435ba286d3a6f251ada9a85c795ef3abec41ecc86cddb3e5801166099be3d62a4c33ee086ef38251
SSDEEP 24576:znm19T3qZsCUfZn9dewfq7XJlpKvcYADQWZIhg0wdKt1jWm192:znK9T6sCY13C7tK9ADzZithWm192
MD5 SHA1 SHA512 SSDEEP

Submit Download

eee3e429

Path C:\Users\Admin\AppData\Local\Temp\eee3e429
Size 951KB
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092
SSDEEP 24576:iHXwrLprR8zlPaiQSPOlAqVap0M5PgwXXCDoC+GqVn:iHAZCRiiQSPyAH0ehXC4n
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1c8f740

Path C:\Users\Admin\AppData\Local\Temp\f1c8f740
Size 736KB
SHA256 0b48969ba80a746ec2bc16acc34df69129f6a45ccd2615dc51853406fc7d6303
MD5 d0f9bff531c4ac1a88b4282f41d53418
SHA1 f52b9f60631389042ce6ebfa7b199298ee93b82e
SHA512 1508aecab18733ae113209940432b3334eaf02dac828cc88bb80057e1f5ebb3885a1f4de59fabfc786089914d981332be969bebd6c8e9c3a366ed8117e5f160b
SSDEEP 12288:J1fSP2o7LKqCO3W8zDdKja5t94STBsMzIrNTvx4cmeh37v1Gknuml9RKg/6vYzt:J1fSP2o3KdP8zDd8a794esSIR2u96mlL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1080-207-0x00007FFC99D30000-0x00007FFC9B3A7000-memory.dmp

Download

memory/1080-211-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/1124-187-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/1852-188-0x00000000727F0000-0x000000007296B000-memory.dmp

Download

memory/1852-177-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/1852-203-0x00000000727F0000-0x000000007296B000-memory.dmp

Download

memory/2160-1-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/2160-11-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/2160-10-0x0000000073A82000-0x0000000073A84000-memory.dmp

Download

memory/2160-12-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/2160-0-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/2488-148-0x00000000008B0000-0x0000000000AF8000-memory.dmp

Download

memory/2488-168-0x00000000727F0000-0x000000007296B000-memory.dmp

Download

memory/2488-154-0x00000000727F0000-0x000000007296B000-memory.dmp

Download

memory/2488-155-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/3108-212-0x0000000000300000-0x0000000000371000-memory.dmp

Download

memory/3108-210-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/3700-16-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/3700-24-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/3700-14-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/3700-20-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/3700-18-0x0000000073A70000-0x0000000073BEB000-memory.dmp

Download

memory/3780-137-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/3780-136-0x00000000727F0000-0x000000007296B000-memory.dmp

Download

memory/3780-165-0x00000000727F0000-0x000000007296B000-memory.dmp

Download

memory/3780-130-0x00000000008F0000-0x0000000000E03000-memory.dmp

Download

memory/4084-216-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/4084-221-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/4084-218-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/4084-219-0x0000000140000000-0x00000001407DC000-memory.dmp

Download

memory/4084-220-0x0000022EC0090000-0x0000022EC00B0000-memory.dmp

Download

memory/4516-26-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-116-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-164-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-41-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4516-60-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-38-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-28-0x00007FFCBAC30000-0x00007FFCBAE25000-memory.dmp

Download

memory/4516-163-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-186-0x0000000001200000-0x000000000194B000-memory.dmp

Download

memory/4516-183-0x0000000001200000-0x000000000194B000-memory.dmp

Download