amadey | 5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	da_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	t_protected.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	t_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	t_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Executes dropped EXE 16 IoCs

pid	Process
2720	axplong.exe
2780	redline123123.exe
2140	upd.exe
1332	deep.exe
2256	da_protected.exe
1884	gold.exe
1412	lummac2.exe
1756	drivermanager.exe
3024	NewLatest.exe
2564	Hkbsse.exe
1568	1.exe
2288	monster.exe
3012	stub.exe
2044	sjgikr.exe
628	t_protected.exe
2052	legs.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe

Loads dropped DLL 35 IoCs

pid	Process
2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
2720	axplong.exe
2720	axplong.exe
2720	axplong.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2720	axplong.exe
1332	deep.exe
1332	deep.exe
1332	deep.exe
1332	deep.exe
2720	axplong.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
2720	axplong.exe
2720	axplong.exe
2720	axplong.exe
2720	axplong.exe
3024	NewLatest.exe
2564	Hkbsse.exe
2564	Hkbsse.exe
2720	axplong.exe
2288	monster.exe
3012	stub.exe
2256	da_protected.exe
2044	sjgikr.exe
2044	sjgikr.exe
2044	sjgikr.exe
2044	sjgikr.exe
2720	axplong.exe
2988	WerFault.exe
2988	WerFault.exe
2988	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000016c26-74.dat	themida
behavioral1/memory/2256-242-0x0000000000A20000-0x0000000001378000-memory.dmp	themida
behavioral1/memory/2256-243-0x0000000000A20000-0x0000000001378000-memory.dmp	themida
behavioral1/files/0x0008000000017474-614.dat	themida
behavioral1/memory/628-648-0x00000000003E0000-0x0000000000D3C000-memory.dmp	themida
behavioral1/memory/628-649-0x00000000003E0000-0x0000000000D3C000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da_protected.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	t_protected.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
2720	axplong.exe
2256	da_protected.exe
628	t_protected.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1056	1756	drivermanager.exe	40

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\%tepm%	sjgikr.exe
File created	C:\Program Files (x86)\%tepm%\__tmp_rar_sfx_access_check_259438773	sjgikr.exe
File created	C:\Program Files (x86)\%tepm%\t_protected.exe	sjgikr.exe
File opened for modification	C:\Program Files (x86)\%tepm%\t_protected.exe	sjgikr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2384	2140	WerFault.exe	30
560	1884	WerFault.exe	35
2988	2052	WerFault.exe	51

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
2720	axplong.exe
2780	redline123123.exe
2780	redline123123.exe
2780	redline123123.exe
1568	1.exe
1568	1.exe
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1568	1.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	redline123123.exe
Token: SeDebugPrivilege	1756	drivermanager.exe
Token: SeDebugPrivilege	2256	da_protected.exe
Token: SeShutdownPrivilege	1088	Process not Found
Token: SeShutdownPrivilege	1088	Process not Found
Token: SeShutdownPrivilege	1088	Process not Found
Token: SeShutdownPrivilege	1088	Process not Found
Token: SeShutdownPrivilege	1088	Process not Found
Token: SeDebugPrivilege	628	t_protected.exe
Token: SeShutdownPrivilege	1088	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
3024	NewLatest.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	t_protected.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2720	2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe	28
PID 2992 wrote to memory of 2720	2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe	28
PID 2992 wrote to memory of 2720	2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe	28
PID 2992 wrote to memory of 2720	2992	5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe	28
PID 2720 wrote to memory of 2780	2720	axplong.exe	29
PID 2720 wrote to memory of 2780	2720	axplong.exe	29
PID 2720 wrote to memory of 2780	2720	axplong.exe	29
PID 2720 wrote to memory of 2780	2720	axplong.exe	29
PID 2720 wrote to memory of 2140	2720	axplong.exe	30
PID 2720 wrote to memory of 2140	2720	axplong.exe	30
PID 2720 wrote to memory of 2140	2720	axplong.exe	30
PID 2720 wrote to memory of 2140	2720	axplong.exe	30
PID 2140 wrote to memory of 2384	2140	upd.exe	31
PID 2140 wrote to memory of 2384	2140	upd.exe	31
PID 2140 wrote to memory of 2384	2140	upd.exe	31
PID 2140 wrote to memory of 2384	2140	upd.exe	31
PID 2720 wrote to memory of 1332	2720	axplong.exe	33
PID 2720 wrote to memory of 1332	2720	axplong.exe	33
PID 2720 wrote to memory of 1332	2720	axplong.exe	33
PID 2720 wrote to memory of 1332	2720	axplong.exe	33
PID 1332 wrote to memory of 2256	1332	deep.exe	34
PID 1332 wrote to memory of 2256	1332	deep.exe	34
PID 1332 wrote to memory of 2256	1332	deep.exe	34
PID 1332 wrote to memory of 2256	1332	deep.exe	34
PID 2720 wrote to memory of 1884	2720	axplong.exe	35
PID 2720 wrote to memory of 1884	2720	axplong.exe	35
PID 2720 wrote to memory of 1884	2720	axplong.exe	35
PID 2720 wrote to memory of 1884	2720	axplong.exe	35
PID 1884 wrote to memory of 560	1884	gold.exe	36
PID 1884 wrote to memory of 560	1884	gold.exe	36
PID 1884 wrote to memory of 560	1884	gold.exe	36
PID 1884 wrote to memory of 560	1884	gold.exe	36
PID 2720 wrote to memory of 1412	2720	axplong.exe	37
PID 2720 wrote to memory of 1412	2720	axplong.exe	37
PID 2720 wrote to memory of 1412	2720	axplong.exe	37
PID 2720 wrote to memory of 1412	2720	axplong.exe	37
PID 2720 wrote to memory of 1756	2720	axplong.exe	39
PID 2720 wrote to memory of 1756	2720	axplong.exe	39
PID 2720 wrote to memory of 1756	2720	axplong.exe	39
PID 2720 wrote to memory of 1756	2720	axplong.exe	39
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 1756 wrote to memory of 1056	1756	drivermanager.exe	40
PID 2720 wrote to memory of 3024	2720	axplong.exe	41
PID 2720 wrote to memory of 3024	2720	axplong.exe	41
PID 2720 wrote to memory of 3024	2720	axplong.exe	41
PID 2720 wrote to memory of 3024	2720	axplong.exe	41
PID 3024 wrote to memory of 2564	3024	NewLatest.exe	42
PID 3024 wrote to memory of 2564	3024	NewLatest.exe	42
PID 3024 wrote to memory of 2564	3024	NewLatest.exe	42
PID 3024 wrote to memory of 2564	3024	NewLatest.exe	42
PID 2564 wrote to memory of 1568	2564	Hkbsse.exe	43
PID 2564 wrote to memory of 1568	2564	Hkbsse.exe	43
PID 2564 wrote to memory of 1568	2564	Hkbsse.exe	43
PID 2564 wrote to memory of 1568	2564	Hkbsse.exe	43
PID 2720 wrote to memory of 2288	2720	axplong.exe	45
PID 2720 wrote to memory of 2288	2720	axplong.exe	45

C:\Users\Admin\AppData\Local\Temp\5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe
"C:\Users\Admin\AppData\Local\Temp\5b225235d021e0bd9075a79ed7eeaa67e3a360ba9de6c4d2db3ee23026a26a2d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
    "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:2384
- - C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\da_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\sjgikr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sjgikr.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:2044
      - C:\Program Files (x86)\%tepm%\t_protected.exe
        
        "C:\Program Files (x86)\%tepm%\t_protected.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:628
- - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 84
      4⤵
      Loads dropped DLL
      Program crash
      PID:560
- - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
    3⤵
    - Executes dropped EXE
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
    "C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1056
- - C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
    "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\1000012001\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000012001\1.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1568
- - C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
    "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\onefile_2288_133634924358766000\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3012
- - C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
    "C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"
    3⤵
    - Executes dropped EXE
    PID:2052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 64
      4⤵
      Loads dropped DLL
      Program crash
      PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion