amadey | eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
22/06/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
Size 1.8MB
Sample240622-mf7tystflc
SHA256 eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4
MD5 51b516ec0389ed6cdaaab1239a63bad1
SHA1 d9b1b0d77b7b902ed86f7bfe7df481ecae6311cd
SHA512 92b037a47b1db0ab04041287698574060458d52e4662bf890ac5140b55884fe192b79fa570dca5fc9f7180708450e466a7445aa2351e347555a86ddc62930a42
SSDEEP 49152:1paK4LQta+yDtTWpU/2dLjHNrQto9uGKnLQ22Es76jNn56o:1paCdIt6Uo1rQg41rNhB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	28dbdfe372.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e73148b21d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	28dbdfe372.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e73148b21d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	28dbdfe372.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e73148b21d.exe

Executes dropped EXE 6 IoCs

pid	Process
1604	explortu.exe
4696	28dbdfe372.exe
2520	e73148b21d.exe
3108	explortu.exe
2064	explortu.exe
1892	explortu.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	e73148b21d.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Wine	28dbdfe372.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\28dbdfe372.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\28dbdfe372.exe"	explortu.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2520-114-0x0000000000510000-0x0000000000A6C000-memory.dmp	autoit_exe
behavioral2/memory/2520-152-0x0000000000510000-0x0000000000A6C000-memory.dmp	autoit_exe
behavioral2/memory/2520-160-0x0000000000510000-0x0000000000A6C000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
1604	explortu.exe
4696	28dbdfe372.exe
2520	e73148b21d.exe
3108	explortu.exe
2064	explortu.exe
1892	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133635255501433940"	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
1604	explortu.exe
1604	explortu.exe
4696	28dbdfe372.exe
4696	28dbdfe372.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
3984	chrome.exe
3984	chrome.exe
3108	explortu.exe
3108	explortu.exe
2064	explortu.exe
2064	explortu.exe
4284	chrome.exe
4284	chrome.exe
1892	explortu.exe
1892	explortu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe
Token: SeShutdownPrivilege	3984	chrome.exe
Token: SeCreatePagefilePrivilege	3984	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
2520	e73148b21d.exe
3984	chrome.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
3984	chrome.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe
2520	e73148b21d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1604	4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe	78
PID 4980 wrote to memory of 1604	4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe	78
PID 4980 wrote to memory of 1604	4980	eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe	78
PID 1604 wrote to memory of 1248	1604	explortu.exe	79
PID 1604 wrote to memory of 1248	1604	explortu.exe	79
PID 1604 wrote to memory of 1248	1604	explortu.exe	79
PID 1604 wrote to memory of 4696	1604	explortu.exe	80
PID 1604 wrote to memory of 4696	1604	explortu.exe	80
PID 1604 wrote to memory of 4696	1604	explortu.exe	80
PID 1604 wrote to memory of 2520	1604	explortu.exe	81
PID 1604 wrote to memory of 2520	1604	explortu.exe	81
PID 1604 wrote to memory of 2520	1604	explortu.exe	81
PID 2520 wrote to memory of 3984	2520	e73148b21d.exe	82
PID 2520 wrote to memory of 3984	2520	e73148b21d.exe	82
PID 3984 wrote to memory of 5088	3984	chrome.exe	85
PID 3984 wrote to memory of 5088	3984	chrome.exe	85
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 2316	3984	chrome.exe	86
PID 3984 wrote to memory of 3400	3984	chrome.exe	87
PID 3984 wrote to memory of 3400	3984	chrome.exe	87
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88
PID 3984 wrote to memory of 1768	3984	chrome.exe	88

C:\Users\Admin\AppData\Local\Temp\eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe
"C:\Users\Admin\AppData\Local\Temp\eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\1000016001\28dbdfe372.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\28dbdfe372.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\1000017001\e73148b21d.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\e73148b21d.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffb8d2dab58,0x7ffb8d2dab68,0x7ffb8d2dab78
        5⤵
        
        PID:5088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:2
        5⤵
        
        PID:2316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:8
        5⤵
        
        PID:3400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:8
        5⤵
        
        PID:1768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:1
        5⤵
        
        PID:1040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:1
        5⤵
        
        PID:656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4216 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:1
        5⤵
        
        PID:2308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:8
        5⤵
        
        PID:4656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:8
        5⤵
        
        PID:1212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:8
        5⤵
        
        PID:3696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 --field-trial-handle=1824,i,14985264319322866876,1248012380429969539,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4284

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1868

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3108

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2064

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 9707bd7668670afb692f22a61e8f3e9b3b9e58feb76961fe12a6875d4a9b58ca
MD5 aac44a4cb29dea1ceb759d08c070c69e
SHA1 ae0ad1ae25ef6affbc23275a9bf97876f7b32f81
SHA512 4f5ce25cbfecb71d5567161bed3f5fc44917443249617f9bc6997b3e1a29f180c6d965ab6301dddae1d364b041704d10f17dd065034049b2638bb9f413d5aa29
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 078a3b0a6aa95d858c36ab3c81c9cb5a13f63cf86661fa1f9962e8534b8da743
MD5 16d16332e42746b449b5c3ad965a90c5
SHA1 1a473a00c74f62640c7a71c9839e119467809b4e
SHA512 d44a8820ef87ed68d5e2e5afe38a611be871679fc2eb5545415376c75e770ca01ef8a327c4970add6c6e40a6ba739acc6127abf9e8d932232e587c9843d48d03
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a23a2913d5a1acef5dde3cdc890a5c40ff30bcbe8c72f5d7e3cfbc0660801b2d
MD5 f5c2f90dd705995d7e600b1b1d12a00f
SHA1 f23977deac2aec6bd1d18506a39cdb8d93f218be
SHA512 704111686e8a9b6e871198a7fe5596bab2ab0baa3f33ca51ab77fd326a6fc4fbea69433e2a64349e6f0ea11017ffa757be9bf8d70745fb4cd26f1a6521f1624c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bfe2b564636ad766edcbe3dc33647e449f39b66e553c45cf4e6bb54bdb9af8cd
MD5 8d04505903c7d85aa3a1fef248afbc7d
SHA1 cac91109d54413d01e5c70027ecfcb454477ccbb
SHA512 3bd6d18dda0ae64ae2ad50ae39bf34f9d218f8cfef4c43bc630ae81a4b805b96e86356e12923635cce4884e2a32d922405e8c00c50309ef524c11c0a8b7514bb
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 692B
SHA256 3d134ca44f80a11259b6b4101dec63a0a0b93a19c490cd55d8e7a56580a1e8ea
MD5 b9b2e769f7bac38d4786526a9d31abda
SHA1 f81370f70e96eef562834fc4d52d689372222840
SHA512 c5f4522948b9a32b97e2d5d297afbc993e005f330c2baef2feadd37b74795ab79aa156483e8bb6b5c934399aa575338c9048473614194c5ffd4df86fa8f03958
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 7e5395c6acd7c952e8a0659753c328e0a7dbf4072b35fc711a82478b9f7eb510
MD5 9fb2bb3359b4bd227c83cf517392bd12
SHA1 00e87041ccd5b9179291f22ac01c4ae37a40d505
SHA512 20f6aaf1c601d5d1b704db5dda306a7b92c01e52f86c5698d9295089d047fd2662c251f5b47c43e8260f472e49549f408f9eae9fc3b32e86ea11d9ba54e6a8e4
SSDEEP 192:h2XdyGUGvaJ/A8Ayh+FzIECiB1P5tjEsXtScR:h2XdeOyqzNBjtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 c3665d93929f545ce83217c97420b09ac35025902294547c7ef1b30a1d6135c3
MD5 a24bc24be942a08d526107e7ebdd454d
SHA1 333509eb1ae8511e30fdfabaa3f9a8c9503ef34e
SHA512 61988120a841049e7737140b2b278a6f24533b72c1e991e8926f9ba2ccefdfe44fe53a33dd55ff81d84c7f945351799666aa9cbdf095572b8da04f0d38fc45f7
SSDEEP 384:LvB77pLhLcsB8WXiS1kXqKf/pUZNCgVLH2Hf9T+rUUsHGS8xlll5BW:Lp77pLhL9u8iS1kXqKf/pUZNCgVLH2Hv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 279KB
SHA256 8aa94edec81e1109650af81480ac5c7f875f177a8fafb7e7e231a61878276876
MD5 aab83a96a6b3ef838cdd9c327b33b597
SHA1 340962a3cb18232ca2dff6d19c709e9c6c0dc71a
SHA512 94e2cacdfe5ae9f843b64c89124ef0eedb80b6fdf67ab0065f404d1d79561418981c72e4e5b859552b6ec1f2b403b7052424135888cdc9360de38e176ad4d062
SSDEEP 6144:FIEzE6YrpWu8lDtQ8bcyrEwaJMw5Qf2RSTIadDpwU5CAy:FIdPOtQgcyw102gTIadDhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

28dbdfe372.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\28dbdfe372.exe
Size 2.3MB
SHA256 d1a27ccd432eb7d3ca4f0b9bf5717b033b1ae4aea5358a51f81736c727304c64
MD5 3fe14eb59f35942a385425df7972943f
SHA1 09fc9661bef690313fdf3e43d25291b07aff66ba
SHA512 37a0e1dab7e855bfc05f068a59f8e6473f91ab3a6d37739d3728b920f41eccacd336552da1a47cce497e49a939f99df2c0b625004e922db74816aaabf6230e2f
SSDEEP 24576:otzlR7yQ5cJ8v8PR4JcmJpxWndDao/l7/quDuVL4v5UwI/Ma4VP53FPurnKwBWV6:opJfimHUndmCTVFIkauwe7Pfa0v0dA1
MD5 SHA1 SHA512 SSDEEP

Submit Download

e73148b21d.exe

Path C:\Users\Admin\AppData\Local\Temp\1000017001\e73148b21d.exe
Size 2.3MB
SHA256 6882aa3e58a80441dfa8cd3a5291088dc724feb8766afe9549f0bb3ed9434e53
MD5 a7ff03d0d96c7b560728d121370dba4b
SHA1 4171f4d771eacd32562f2ed9f7908425c098eb06
SHA512 a090b6e969b5ed5d587b5f36efb09055281cb93104cf06760646fc9371172c18da2583d7492154d42fae2619fe19d34a1fd87de51843c20e7ee78ead0fb7c783
SSDEEP 49152:ZIv69CaSWrjrONBNWPW5c2wTZH+NLJZy1xk5ndWR5Igb6K4z3+:uvR+XOLUPWfKULJZR5nd+b+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 eb4b3e24ac5a3885297829fb14de9a9883f959f8d4a4890123c4e09197f58ec4
MD5 51b516ec0389ed6cdaaab1239a63bad1
SHA1 d9b1b0d77b7b902ed86f7bfe7df481ecae6311cd
SHA512 92b037a47b1db0ab04041287698574060458d52e4662bf890ac5140b55884fe192b79fa570dca5fc9f7180708450e466a7445aa2351e347555a86ddc62930a42
SSDEEP 49152:1paK4LQta+yDtTWpU/2dLjHNrQto9uGKnLQ22Es76jNn56o:1paCdIt6Uo1rQg41rNhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1604-19-0x0000000000F31000-0x0000000000F5F000-memory.dmp

Download

memory/1604-135-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-209-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-21-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-112-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-205-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-203-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-20-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-162-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-18-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-216-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-207-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-227-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-145-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-146-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-198-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-158-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-178-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-175-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1604-173-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1892-230-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/1892-229-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/2064-201-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/2064-200-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/2520-160-0x0000000000510000-0x0000000000A6C000-memory.dmp

Download

memory/2520-60-0x0000000000510000-0x0000000000A6C000-memory.dmp

Download

memory/2520-152-0x0000000000510000-0x0000000000A6C000-memory.dmp

Download

memory/2520-114-0x0000000000510000-0x0000000000A6C000-memory.dmp

Download

memory/3108-149-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/3108-148-0x0000000000F30000-0x00000000013F2000-memory.dmp

Download

memory/4696-150-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-163-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-161-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-176-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-151-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-231-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-202-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-174-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-204-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-113-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-206-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-179-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-208-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-42-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-210-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4696-217-0x00000000005B0000-0x0000000000B9E000-memory.dmp

Download

memory/4980-17-0x0000000000A00000-0x0000000000EC2000-memory.dmp

Download

memory/4980-5-0x0000000000A00000-0x0000000000EC2000-memory.dmp

Download

memory/4980-3-0x0000000000A00000-0x0000000000EC2000-memory.dmp

Download

memory/4980-2-0x0000000000A01000-0x0000000000A2F000-memory.dmp

Download

memory/4980-1-0x0000000077DB6000-0x0000000077DB8000-memory.dmp

Download

memory/4980-0-0x0000000000A00000-0x0000000000EC2000-memory.dmp

Download