amadey | 8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
21/06/2024, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
Size 1.8MB
Sample240621-n3939ssepp
SHA256 8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09
MD5 0f234a1bdec0749d3c76fdab81149351
SHA1 e4f464a1ff073c699085f273bcd5112479602d6c
SHA512 e21cccb4c31052ad5306632266e0eff3f6d73a32a35f4daa5bfe32aa93c67f11e6d3bd060760130ccd5bf1bb16403eb484f3bfad796a3f2b49b9ab0ec3fd5040
SSDEEP 49152:4P3rMgJGuJXlzoHahX5dKDWb9heJPY4elr:arlJGUGkX5IDWxwMZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3b386b8159.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a558e99af7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3b386b8159.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3b386b8159.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a558e99af7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a558e99af7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Executes dropped EXE 6 IoCs

pid	Process
2140	explortu.exe
3036	3b386b8159.exe
680	a558e99af7.exe
2408	explortu.exe
1488	explortu.exe
2720	explortu.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	3b386b8159.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	a558e99af7.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\3b386b8159.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\3b386b8159.exe"	explortu.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/680-140-0x0000000000290000-0x00000000007D2000-memory.dmp	autoit_exe
behavioral2/memory/680-153-0x0000000000290000-0x00000000007D2000-memory.dmp	autoit_exe
behavioral2/memory/680-160-0x0000000000290000-0x00000000007D2000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3884	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
2140	explortu.exe
3036	3b386b8159.exe
680	a558e99af7.exe
2408	explortu.exe
1488	explortu.exe
2720	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133634446195671916"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3107365284-1576850094-161165143-1000\{F50B5BDB-906F-44C9-9E9C-5301F68C887D}	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3884	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
3884	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
2140	explortu.exe
2140	explortu.exe
3036	3b386b8159.exe
3036	3b386b8159.exe
680	a558e99af7.exe
680	a558e99af7.exe
1056	chrome.exe
1056	chrome.exe
2408	explortu.exe
2408	explortu.exe
1488	explortu.exe
1488	explortu.exe
1092	chrome.exe
1092	chrome.exe
2720	explortu.exe
2720	explortu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
680	a558e99af7.exe
680	a558e99af7.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
680	a558e99af7.exe
1056	chrome.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
1056	chrome.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
680	a558e99af7.exe
680	a558e99af7.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe
680	a558e99af7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2140	3884	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe	77
PID 3884 wrote to memory of 2140	3884	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe	77
PID 3884 wrote to memory of 2140	3884	8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe	77
PID 2140 wrote to memory of 3096	2140	explortu.exe	78
PID 2140 wrote to memory of 3096	2140	explortu.exe	78
PID 2140 wrote to memory of 3096	2140	explortu.exe	78
PID 2140 wrote to memory of 3036	2140	explortu.exe	79
PID 2140 wrote to memory of 3036	2140	explortu.exe	79
PID 2140 wrote to memory of 3036	2140	explortu.exe	79
PID 2140 wrote to memory of 680	2140	explortu.exe	80
PID 2140 wrote to memory of 680	2140	explortu.exe	80
PID 2140 wrote to memory of 680	2140	explortu.exe	80
PID 680 wrote to memory of 1056	680	a558e99af7.exe	81
PID 680 wrote to memory of 1056	680	a558e99af7.exe	81
PID 1056 wrote to memory of 3560	1056	chrome.exe	84
PID 1056 wrote to memory of 3560	1056	chrome.exe	84
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 2816	1056	chrome.exe	85
PID 1056 wrote to memory of 428	1056	chrome.exe	86
PID 1056 wrote to memory of 428	1056	chrome.exe	86
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87
PID 1056 wrote to memory of 444	1056	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe
"C:\Users\Admin\AppData\Local\Temp\8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\1000016001\3b386b8159.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\3b386b8159.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\1000017001\a558e99af7.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\a558e99af7.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3dab58,0x7ffe1c3dab68,0x7ffe1c3dab78
        5⤵
        
        PID:3560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:2
        5⤵
        
        PID:2816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        
        PID:428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2124 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        
        PID:444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:1
        5⤵
        
        PID:2120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:1
        5⤵
        
        PID:940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4168 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:1
        5⤵
        
        PID:1828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3992 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:1
        5⤵
        
        PID:3292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4520 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        
        PID:4732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:4948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        
        PID:2532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4972 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        
        PID:3424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:8
        5⤵
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 --field-trial-handle=1804,i,370918739663753601,870185619798863799,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1092

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2408

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1488

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 99380ab9cd9f43a9fa1708427d33b5755b2d0fd326145a8a43cf9ca7192dd48c
MD5 646ffc01c8bf5998fc17cc2b686bbdbc
SHA1 b72ce9885302ddb501c364e4dd8e306dcb1944bd
SHA512 0e6690fbf7bcaf5c6cff42a5fec3a141f23b753cf77627f16cf40e7c863d5c189209651418f945333e2590e30ee0d8aa1cbb295bc56cad701c0d7386b0c86d29
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f350eeaf4296ce86657bbd762a954ef4482ee6ad33b15d0e05fec8726417865
MD5 d69cd15d3cdec5ae39c69602362235c6
SHA1 fb8d1727ff86ccc0b256af28117369037089c041
SHA512 d33222611916f7e2c2616a3cb06fac25f2476ebd7e6382213ff1486253ffa09fe8415bad2dbb08f1e87ae23619a48f98b47382857406f5ffdf0e658271423ab2
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 520B
SHA256 48a58d5f2448d70bef5393161e07511fd6651851fba815673b99ffc45f859d57
MD5 f3400eb27515dfca97e1879a53ebc39c
SHA1 b9cfe0701b2662ecbf36ae4cb75948397853ff39
SHA512 f21da0363a1b79281a7623c19fda695fbde9900fbc05b4774018872c1b030b42ba37e29d84449122dd1fbb96754dcfaba558f7d847b21e2411e52e1f7e438625
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 28e2e7694c529c5ea0af50c42f33ec260882af644643c663e95723b204103f3f
MD5 73ea9476c181630fcca2bcb8c85c0be9
SHA1 32485a68dab74152a2a67a7c9aeafe1f0f6757ae
SHA512 16cb11e425fd4be970a0404b1b6aeb6f0e4d29eb8eba0702c03a9ed83eae8a064e5b2958d1525f5f37c5aae70cd938d52dec305151abc3fe969807ec5140681a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 583719580cc384773fd9653587edf362f943ac1d030f08362f0f154ac6ffbcb1
MD5 6d9dfa404a9717ef732adb0e7d9af020
SHA1 d6cabb55f9e64f249ff58faf9860dc42afacccc0
SHA512 f11704b9349e8867955a2003fb87c20f28c2490441fbc54c246101561a42ce745ba198a5a754703f9139e771563e585f445459e9c7afcc270a01dc571ab6b9a3
SSDEEP 192:AfcXnjfaJn8Byh+FohT0+Uvf+P5tjEsXtScR:AUXnWKyquQHH6tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 e741ea6658fcb5899d4053f278f7e04a453e4995792fbac05dd7387d371a823b
MD5 defe89fba2a8ad0a45e244b6c0546c02
SHA1 2a47e38344be280f1161c7214790ed5d9356d1a7
SHA512 2e57f0033d363b8dc5ef50ea9c11534a0bf44a38b675cdccf2057ca13c9e6b96b621e0d04a2470548ac0098e37c57468397e89d66687f4b1e11e4c9e5ee435b7
SSDEEP 384:vr/3LPLe06XG21kXqKf/pUZNCgVLH2Hf93KrUxVHGRvAbJv:vb3LPLRoG21kXqKf/pUZNCgVLH2HflKC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 270KB
SHA256 f4ac7e2d630e6091e7d3f1f46f16e62d1e06ab81ef22d534fa271948587c841b
MD5 5d6fee1c5e8645d29fa8490ac127e9de
SHA1 5a7b15f66b81cbba26f3f27f75457c0af7ee554d
SHA512 6af599b8e4df57f669574b9423c904b58eeff32ccf0ca03e74162a74a74036f282eadc94d17da345fa5201fb9343eac1d87f75d56a28f9a913c682a495651a52
SSDEEP 6144:RpLw889mpBEjATQH6GALxJOsWcO8rI1Qo5yzkpeXjnJFzXsWd:RE476Ra2x8EjCkpeXtFbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

3b386b8159.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\3b386b8159.exe
Size 2.3MB
SHA256 9abe53201332020477780d447e698367bf97120b72a83e71bb7731706586a058
MD5 237048667c00184b70768fbc24bceaab
SHA1 abc034d383c741533127b1af676bb5d5a013898b
SHA512 bba0a1e7e4e7fafc7bf163aa78ff1090aee27301e61c2b2b3b987fa45f849330f0c5aba969377b59bffede0dbcf4f5d5c008758a15a76683e98cfac21462dab0
SSDEEP 49152:t+r1SO66EyMY1MU/wS5O2RZM8To/J4qelVXU:tv6RIYrO2Ri8GJ4fl
MD5 SHA1 SHA512 SSDEEP

Submit Download

a558e99af7.exe

Path C:\Users\Admin\AppData\Local\Temp\1000017001\a558e99af7.exe
Size 2.2MB
SHA256 2e62106e811a689329decbbe1c4d3c68b9ec37ccc79573a13952ac4d865eaa24
MD5 cce661e94be229ed8d5ed529b6596e25
SHA1 c2ab1dd300b8e7344968745c429a2861417743f5
SHA512 02d4e11ebe04a486b92d8a487779562c74cd46455d02206ba92ed1cd785681d7e2c98cd4a42b7471d57121aeed344c928a22e207d627fab998781a0fdabea640
SSDEEP 49152:IIuw23BzSe/Bl2W4cnntJ0TUerZDrqZtNJJkXGVbepqPm:xuLPf2vcnT0TXZCZPJuwCpwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 8be7326355059574b62c63cdb654e80c631a8fa6d0cb20fe94676e20da33dc09
MD5 0f234a1bdec0749d3c76fdab81149351
SHA1 e4f464a1ff073c699085f273bcd5112479602d6c
SHA512 e21cccb4c31052ad5306632266e0eff3f6d73a32a35f4daa5bfe32aa93c67f11e6d3bd060760130ccd5bf1bb16403eb484f3bfad796a3f2b49b9ab0ec3fd5040
SSDEEP 49152:4P3rMgJGuJXlzoHahX5dKDWb9heJPY4elr:arlJGUGkX5IDWxwMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/680-140-0x0000000000290000-0x00000000007D2000-memory.dmp

Download

memory/680-160-0x0000000000290000-0x00000000007D2000-memory.dmp

Download

memory/680-62-0x0000000000290000-0x00000000007D2000-memory.dmp

Download

memory/680-153-0x0000000000290000-0x00000000007D2000-memory.dmp

Download

memory/1488-182-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/1488-181-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-208-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-214-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-112-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-111-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-175-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-110-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-173-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-19-0x00000000002F1000-0x000000000031F000-memory.dmp

Download

memory/2140-18-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-44-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-20-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-143-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-221-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-178-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-212-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-210-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-22-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-159-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-21-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-206-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2140-162-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2408-123-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2408-119-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2720-224-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/2720-226-0x00000000002F0000-0x00000000007B8000-memory.dmp

Download

memory/3036-174-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-161-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-163-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-180-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-43-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-124-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-176-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-151-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-207-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-223-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-209-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-215-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-211-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-152-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3036-213-0x0000000000350000-0x0000000000947000-memory.dmp

Download

memory/3884-1-0x00000000770E6000-0x00000000770E8000-memory.dmp

Download

memory/3884-0-0x0000000000ED0000-0x0000000001398000-memory.dmp

Download

memory/3884-5-0x0000000000ED0000-0x0000000001398000-memory.dmp

Download

memory/3884-3-0x0000000000ED0000-0x0000000001398000-memory.dmp

Download

memory/3884-17-0x0000000000ED0000-0x0000000001398000-memory.dmp

Download

memory/3884-2-0x0000000000ED1000-0x0000000000EFF000-memory.dmp

Download