amadey | 6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
22/06/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
Size 1.8MB
Sample240622-efrhzawhmf
SHA256 6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3
MD5 a7c185ca699ec75755a98c1b7d3ffb80
SHA1 d16cfd460243ae6ff7c292cb4697ce84ccb88136
SHA512 551285647d82643a50ed4c50852b0e3288a4bdc1a81a8f6edfb9c15144de35ac962ade47f0057f09525eb25ef71d02bb26f22c4b09359cb53f76fb229d320ad4
SSDEEP 24576:04Ii/8C4s0sk04I6G4+57ZvNdoDQG5LtibEWnmF3HXFjs/iT7qxf4TXShxqE4Zaf:7IiisY+5hgf4bnmFVe8+d7hxp42j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c368355cf5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	80c50f3988.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c368355cf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c368355cf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	80c50f3988.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	80c50f3988.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Executes dropped EXE 5 IoCs

pid	Process
3684	explortu.exe
3500	c368355cf5.exe
3412	80c50f3988.exe
2820	explortu.exe
4920	explortu.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	c368355cf5.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	80c50f3988.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\c368355cf5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\c368355cf5.exe"	explortu.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3412-116-0x00000000002D0000-0x000000000084D000-memory.dmp	autoit_exe
behavioral2/memory/3412-144-0x00000000002D0000-0x000000000084D000-memory.dmp	autoit_exe
behavioral2/memory/3412-152-0x00000000002D0000-0x000000000084D000-memory.dmp	autoit_exe
behavioral2/memory/3412-153-0x00000000002D0000-0x000000000084D000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
4088	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
3684	explortu.exe
3500	c368355cf5.exe
3412	80c50f3988.exe
2820	explortu.exe
4920	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133635020148978407"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4088	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
4088	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
3684	explortu.exe
3684	explortu.exe
3500	c368355cf5.exe
3500	c368355cf5.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
2676	chrome.exe
2676	chrome.exe
2820	explortu.exe
2820	explortu.exe
4920	explortu.exe
4920	explortu.exe
4668	chrome.exe
4668	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3412	80c50f3988.exe
3412	80c50f3988.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
3412	80c50f3988.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
2676	chrome.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3412	80c50f3988.exe
3412	80c50f3988.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
3412	80c50f3988.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe
3412	80c50f3988.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3684	4088	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe	80
PID 4088 wrote to memory of 3684	4088	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe	80
PID 4088 wrote to memory of 3684	4088	6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe	80
PID 3684 wrote to memory of 776	3684	explortu.exe	83
PID 3684 wrote to memory of 776	3684	explortu.exe	83
PID 3684 wrote to memory of 776	3684	explortu.exe	83
PID 3684 wrote to memory of 3500	3684	explortu.exe	84
PID 3684 wrote to memory of 3500	3684	explortu.exe	84
PID 3684 wrote to memory of 3500	3684	explortu.exe	84
PID 3684 wrote to memory of 3412	3684	explortu.exe	88
PID 3684 wrote to memory of 3412	3684	explortu.exe	88
PID 3684 wrote to memory of 3412	3684	explortu.exe	88
PID 3412 wrote to memory of 2676	3412	80c50f3988.exe	89
PID 3412 wrote to memory of 2676	3412	80c50f3988.exe	89
PID 2676 wrote to memory of 2484	2676	chrome.exe	92
PID 2676 wrote to memory of 2484	2676	chrome.exe	92
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 2360	2676	chrome.exe	93
PID 2676 wrote to memory of 3724	2676	chrome.exe	94
PID 2676 wrote to memory of 3724	2676	chrome.exe	94
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95
PID 2676 wrote to memory of 816	2676	chrome.exe	95

C:\Users\Admin\AppData\Local\Temp\6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe
"C:\Users\Admin\AppData\Local\Temp\6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\1000016001\c368355cf5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\c368355cf5.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\1000017001\80c50f3988.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\80c50f3988.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc885dab58,0x7ffc885dab68,0x7ffc885dab78
        5⤵
        
        PID:2484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:2
        5⤵
        
        PID:2360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:8
        5⤵
        
        PID:3724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:8
        5⤵
        
        PID:816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:1
        5⤵
        
        PID:4468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:1
        5⤵
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3472 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:1
        5⤵
        
        PID:1344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:8
        5⤵
        
        PID:4260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:8
        5⤵
        
        PID:3852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3200 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:8
        5⤵
        
        PID:4572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1076 --field-trial-handle=1816,i,12151038099384796037,17340734714664512343,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4668

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1356

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2820

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 8698c010a4fcd7e9e6e856b581592eec1d9337570ea4ab022f80c0612fcc0e74
MD5 5b2d18e6cd8e894c7aace493eb3b79c9
SHA1 15f35c3f0c9d1c5abd327ad4ce9d7a10f2032dc8
SHA512 cceec2a765438d5667c96cd292ffcc4d73e71ea4d5acdb31a5b2e8c6902a455ec0b1d1f69580393fa413102ff9b5cdc450c4ed5da252af4179194aebcec1b4b3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2c8117ec4f22a2e89b89ae101b2f4a212662d07d39a1e1c438b787daf7891ff1
MD5 282723444b93408282185344ef95eef2
SHA1 181f622009270e21a1b6b2d975700fe1ed259a1f
SHA512 65cb9d2e4df58ed911c1a1d59803286ac15cd7d56ceb4947bb284fb5042e7613a3ab86a421c21e7542f7883bdda08678f5525d797a0fd247ab0619079fa77e7b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1d7800aa8d908660b6780a94a13f51c1e141cdbd6fdbd0b4d7aff2c5070b9ec3
MD5 5b93f33ab201f1ab1d97b2018b3f3ccc
SHA1 994a4871284958e0c83d2fd7f2a8dc00c82bfce7
SHA512 25b149b88ddb833fa40c392e6586e271c5dc64022f4a2e82028be7d2b655e15e209c1473a2bd4dac630d94cd14fdf9f64e505a6d033df47e9169b70d4cc2c8c3
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 692B
SHA256 0331587e801d1b7b5127fddedfd48481f65d3970f406ff3521b772278f54017c
MD5 8aff55ff68f114072d672d858b144191
SHA1 15546610c24a19d0c70f0712894ef9d529d1d173
SHA512 48c2e0b911af20b5298874025e8e652c67cfd208e8fb58928ca34dcf1d772ffd5dcf8934828d4c793795b980c94d68ebc581e2f47eb0116ee2952687cd853332
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 b5c9a049a5cfef26e00bb5f90a29c916300579d9c79164579fdf7cbccbf9df53
MD5 d562aac65d8e2cc06d1e5537a8b9de4e
SHA1 a4c69c129b7222b73dd24c5a3207f9e4dde4a448
SHA512 2bb9533ee83a3ed9988ea17291cf95f35f99e8ff0753a822f659432c9bcb621df4f2911d80a1f6d554773df5f279853cac6587d461172b6f921a1542f5ab63d9
SSDEEP 192:mCXkjHD7aJBA8Hyh+FRrESFP5tjEsXtScR:mCXkjaPyq9EqtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 38f70f3339def30581532238e49c75735db734b077a371036e5a84d7e09356cb
MD5 dfa6a23638ae7613c903851044c1db7a
SHA1 a8455018d1b79e067c6c5d8ccc2448817216d913
SHA512 8667124f0372642f05dab40117eba99b134ef8c0e64be1d456b3c562e03c9b2f7aff9c36bf1479a75e9466c6fe28dceb300d58c71a3138be4edb7172bbd1d613
SSDEEP 384:LvBh7pLhLcsB8WXiS1kXqKf/pUZNCgVLH2Hf9T+rUUKHG58Zlll5B82:Lph7pLhL9u8iS1kXqKf/pUZNCgVLH2HN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 279KB
SHA256 24f0474f65a64be896d732d0c5172bb8ab69ae9fde2708fd86c181300a729c11
MD5 7b3da65d0a8226231ace724e5666e6eb
SHA1 a5607a907df606ba40c53036ca5187d1d65396ff
SHA512 59785bf39fc0281eb761959ff7ff295c9997ceb2e5c9eba246aa3f8b36cc3d6e50a246ce303dedc187b24d136c38984fbdddb3f5156ad86a88ef1fd2b59bf397
SSDEEP 6144:XIEzE6YrpWu8lDtQ8bcyrEwaMMw5Qf2RSTIadDpwU5CA6:XIdPOtQgcyw172gTIadDh6
MD5 SHA1 SHA512 SSDEEP

Submit Download

c368355cf5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\c368355cf5.exe
Size 2.4MB
SHA256 1c00b1b0437e537733dcc3c048a59ba3a373f4ab30a97fab21e20501fd081d15
MD5 1d0710fba5166efb658d3d3907176d8b
SHA1 ab4a279bdbd13e7ca844463b360cc5ca37ebb522
SHA512 6ceadca1f68b3ee4871e920a9389a43ec133935337e87a60f57a0726fcccf6ce33a31554714fa93f86005042f2b22a493bcd54646eb5923bd8b4034649ff05ae
SSDEEP 49152:P7uCtkIH2S+UsCCrSRvDJTVG/bYX2LCNuZoDvZ85MG28Vn:PSIuUsCC2FDJTiq2NZqz8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

80c50f3988.exe

Path C:\Users\Admin\AppData\Local\Temp\1000017001\80c50f3988.exe
Size 2.3MB
SHA256 adf5b15e64d9139858f67da93364b444ef4cf0a603aae1b1616b925d04045dd8
MD5 420efba99739c37bf0c373551aab5901
SHA1 d0499777d01e5e98b33a55bfac573086946a1481
SHA512 cee99d8c9c51e09b4164dd6e1adf1cee2a41cca79cf7f06ec135d68d1ec316bb8e284e0b707092216c6be980e5b5f3868415f94ad6b5a05ec9cdb8577d4e26e5
SSDEEP 49152:THUOUAIlxyVTZVoon5bG1Odv5IVTTgd8Iagp+dLF:TScV3oon5bBKTgigod
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 6a1bfd58efe68f261124127bd748e9ee7c2632b5ad0f8f76b07dbe3bd7c110e3
MD5 a7c185ca699ec75755a98c1b7d3ffb80
SHA1 d16cfd460243ae6ff7c292cb4697ce84ccb88136
SHA512 551285647d82643a50ed4c50852b0e3288a4bdc1a81a8f6edfb9c15144de35ac962ade47f0057f09525eb25ef71d02bb26f22c4b09359cb53f76fb229d320ad4
SSDEEP 24576:04Ii/8C4s0sk04I6G4+57ZvNdoDQG5LtibEWnmF3HXFjs/iT7qxf4TXShxqE4Zaf:7IiisY+5hgf4bnmFVe8+d7hxp42j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2820-156-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/2820-157-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3412-152-0x00000000002D0000-0x000000000084D000-memory.dmp

Download

memory/3412-116-0x00000000002D0000-0x000000000084D000-memory.dmp

Download

memory/3412-153-0x00000000002D0000-0x000000000084D000-memory.dmp

Download

memory/3412-144-0x00000000002D0000-0x000000000084D000-memory.dmp

Download

memory/3412-61-0x00000000002D0000-0x000000000084D000-memory.dmp

Download

memory/3500-175-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-114-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-198-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-202-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-193-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-159-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-191-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-200-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-172-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-143-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-42-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-145-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-170-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-209-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-220-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-43-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3500-154-0x0000000000E00000-0x000000000140C000-memory.dmp

Download

memory/3684-158-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-135-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-151-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-19-0x0000000000E71000-0x0000000000E9F000-memory.dmp

Download

memory/3684-169-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-18-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-171-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-108-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-174-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-219-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-208-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-190-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-134-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-192-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-20-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-21-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-201-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-197-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-115-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/3684-199-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/4088-17-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Download

memory/4088-2-0x0000000000A51000-0x0000000000A7F000-memory.dmp

Download

memory/4088-3-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Download

memory/4088-1-0x0000000077CD6000-0x0000000077CD8000-memory.dmp

Download

memory/4088-5-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Download

memory/4088-0-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Download

memory/4920-196-0x0000000000E70000-0x000000000132C000-memory.dmp

Download

memory/4920-195-0x0000000000E70000-0x000000000132C000-memory.dmp

Download