amadey | f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23/06/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
Size 1.8MB
Sample240623-1c3mqawerr
SHA256 f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827
MD5 779c5de4c0168c6053d50132c438d484
SHA1 db661c2614d2ac1915f03df1fb3a85cad52746a6
SHA512 1c6affac24b43beb465eb38dcd6a773f449fd494d49586feb23c419e23dcc285a901a6945bba005e9c82c3b6b9854a37da137e057a2711cff9de4bd71070e513
SSDEEP 49152:A1ol2RoTCTtlc29kOipHZzqTlbKAwqJXmSwSi:wZTtd9kTpHcoAw/Swp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	35af2f548b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	06e9c8aced.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	06e9c8aced.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	35af2f548b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	35af2f548b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	06e9c8aced.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe

Executes dropped EXE 5 IoCs

pid	Process
4912	explortu.exe
3696	35af2f548b.exe
3392	06e9c8aced.exe
4980	explortu.exe
4928	explortu.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	35af2f548b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	06e9c8aced.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\35af2f548b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\35af2f548b.exe"	explortu.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3392-126-0x0000000000D20000-0x000000000128C000-memory.dmp	autoit_exe
behavioral2/memory/3392-153-0x0000000000D20000-0x000000000128C000-memory.dmp	autoit_exe
behavioral2/memory/3392-161-0x0000000000D20000-0x000000000128C000-memory.dmp	autoit_exe
behavioral2/memory/3392-162-0x0000000000D20000-0x000000000128C000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
4912	explortu.exe
3696	35af2f548b.exe
3392	06e9c8aced.exe
4980	explortu.exe
4928	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636518993583302"	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
4912	explortu.exe
4912	explortu.exe
3696	35af2f548b.exe
3696	35af2f548b.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
2560	chrome.exe
2560	chrome.exe
4980	explortu.exe
4980	explortu.exe
4928	explortu.exe
4928	explortu.exe
1948	chrome.exe
1948	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
3392	06e9c8aced.exe
2560	chrome.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe
3392	06e9c8aced.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4912	2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe	77
PID 2856 wrote to memory of 4912	2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe	77
PID 2856 wrote to memory of 4912	2856	f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe	77
PID 4912 wrote to memory of 4672	4912	explortu.exe	78
PID 4912 wrote to memory of 4672	4912	explortu.exe	78
PID 4912 wrote to memory of 4672	4912	explortu.exe	78
PID 4912 wrote to memory of 3696	4912	explortu.exe	79
PID 4912 wrote to memory of 3696	4912	explortu.exe	79
PID 4912 wrote to memory of 3696	4912	explortu.exe	79
PID 4912 wrote to memory of 3392	4912	explortu.exe	80
PID 4912 wrote to memory of 3392	4912	explortu.exe	80
PID 4912 wrote to memory of 3392	4912	explortu.exe	80
PID 3392 wrote to memory of 2560	3392	06e9c8aced.exe	81
PID 3392 wrote to memory of 2560	3392	06e9c8aced.exe	81
PID 2560 wrote to memory of 1612	2560	chrome.exe	84
PID 2560 wrote to memory of 1612	2560	chrome.exe	84
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 2484	2560	chrome.exe	85
PID 2560 wrote to memory of 3272	2560	chrome.exe	86
PID 2560 wrote to memory of 3272	2560	chrome.exe	86
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87
PID 2560 wrote to memory of 3832	2560	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe
"C:\Users\Admin\AppData\Local\Temp\f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\1000016001\35af2f548b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\35af2f548b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\1000017001\06e9c8aced.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\06e9c8aced.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff972f5ab58,0x7ff972f5ab68,0x7ff972f5ab78
        5⤵
        
        PID:1612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:2
        5⤵
        
        PID:2484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:8
        5⤵
        
        PID:3272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:8
        5⤵
        
        PID:3832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:1
        5⤵
        
        PID:2068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:1
        5⤵
        
        PID:1500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3792 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:1
        5⤵
        
        PID:1816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:8
        5⤵
        
        PID:2976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:8
        5⤵
        
        PID:3460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:8
        5⤵
        
        PID:1968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 --field-trial-handle=1780,i,11573006097027817448,3536411638678489953,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1948

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:416

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4980

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 0233474c9335088d2a31a0441b2f0cb6b4a7cbfb0d5ecc8b01a8cb0e687388d5
MD5 b518625c7dd9fe6a10a2842ddd8d9b59
SHA1 dbc716d7ca03edc511e94c1eb04f526632a97ce5
SHA512 eadc0e47dee35ddc5681fd5bd4e87e37320faf7d568f34a6af56c998908b6738d67a33bf7dcdcecfeeb97e57fc9101f41cb3f56f1db17bd38a0b42ae20a2fd10
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ad52fe3a4bda9206d1982860f93f0851b7c8650121d2f3bc8138a30c7fbc358
MD5 2cf9a0f4ef321bc7a453abfbb88c204c
SHA1 09f852d54a2cf1a702ce26543cd1b59f13b8a87c
SHA512 5c16e62a8f6fea0431980fff3db4e3e1c0a1e4cc285cdbc2ea3018d19bf52a7272b76cbb6e0c827e577d1c945d914b3b1497fbe75dd6223efc1a73437ffae779
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 684B
SHA256 fedeac826659d4fc7d9a9719484d8739c14eeb770772af4ef7e2f8fb30b5a6d4
MD5 8dba798616b1f04b04dc045418b72827
SHA1 744b8164c60ac287b7a0bc25e85db111991b7dfc
SHA512 bb914466c0918b49cd663b1018428201ba808f6f458ce878cc832fcb8c3eefc7917e372bfa7cbb651b52c2153f1440b1ebf012801f8cd7f0290b394ff91161a3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 b9e65e1f746c6d7f95808a239d6abaf666e5a586fb4ad980db5d5453fd572918
MD5 523f243da73c82479435aa1a251b98e3
SHA1 77009ad6f73882a2b9e1107dcc09d46c2ea1d304
SHA512 175249f088d6d8d13bf4628ac9fddbed7057e18af79cef44c336dc743d4d22680f62429e0af99956a2b4a7c08c4b51fe4044a6e1c4f834ba27dc982a2ad60adb
SSDEEP 192:wscXQtnwQaJD8/yh+FTo1iTB5+ZUvvP5tjEsXtScR:wRXQmsyqHP+KRtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 cd3de4281709f89bb85dfd62d98cfbacbea2ee35393a83672a41aa62987ba098
MD5 b608b4f539af0250cbb45c9fa107a1e4
SHA1 f2881ba277c9e46bbeca0727ebfd44d11a68172d
SHA512 dd81f530186104fa6b716f6f922237db8b2126a8c69d369438a915c83da131123de1a78c89f87890e1169a8ca99dec28fc2be28675ec4d9667671f5713e079f0
SSDEEP 384:vr/MLPLe06XG21kXqKf/pUZNCgVLH2Hf93KrUxmHGRaXGSbJZ7:vbMLPLRoG21kXqKf/pUZNCgVLH2HflKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 271KB
SHA256 6526789c15bc2285ccefe16b29bd13786f04849c0ad1d314bc1f75d70e943497
MD5 0e46ce191470300b46660a9f5dfb1463
SHA1 4bd9c62af94658ca6beccb1116c4506611d5c707
SHA512 9f0361870c5759941db340bb0fd0815da7d7f0b93d71d5067be7a279cdb39506bf97306b12023d331e73064411adb3d4badb860b33724a869c542e015d7172f9
SSDEEP 6144:kKIEzE6YrpWu8lDtQ8bcyrEwaVrI1Qo5yzkpeXjnJFzXsWB:kKIdPOtQgcyw1VEjCkpeXtFb1
MD5 SHA1 SHA512 SSDEEP

Submit Download

35af2f548b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\35af2f548b.exe
Size 2.4MB
SHA256 10339c7234636b4834db055a2c53634b77a93782ad813ecb17a0e3192b32ff5f
MD5 75d185ed32855701252f888813a567c7
SHA1 9ebb22ce0d324d93b54c9cf906ae1acbff104b89
SHA512 26d66b7d2851c6b35061f838d8e702ced8f78fc76f6c87cd0507d98433bb00c7626fff1f9a69804cbf66f9b8661aa533157f3018391f713f98bca919ac809efa
SSDEEP 49152:+42dlfzMSwZl2X3FeuN3b1K3kN1GNh8u2:+dTwnZl2X3hN3Gech8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

06e9c8aced.exe

Path C:\Users\Admin\AppData\Local\Temp\1000017001\06e9c8aced.exe
Size 2.3MB
SHA256 5a7d2cb279e81a01d3c50882119e7962871cbfa8e8409ec2490cd2b5d50de8c0
MD5 a1da60cdcf7ded3824514297f6a0286a
SHA1 a10b6a574d4fdbfcf9470c2204163d18fd9307ff
SHA512 34aba9a893b2374a4eaebae44812d14d846c0e0f2b7c10fbcd3cf038908ba70d73fbc623e25aa363d4793c33c6a2618948155320b0f4b93e044b6b835f15fecb
SSDEEP 49152:V643jGo410iVpL+oLV5o0srVmKt1qNGWn4e2yzTTMBT+mSuzt:V61OiVpHVe0ocNtD2yQIOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 f2264a530ae4db2d61f52fae6512adc3a4945592f120685f1286005e306b0827
MD5 779c5de4c0168c6053d50132c438d484
SHA1 db661c2614d2ac1915f03df1fb3a85cad52746a6
SHA512 1c6affac24b43beb465eb38dcd6a773f449fd494d49586feb23c419e23dcc285a901a6945bba005e9c82c3b6b9854a37da137e057a2711cff9de4bd71070e513
SSDEEP 49152:A1ol2RoTCTtlc29kOipHZzqTlbKAwqJXmSwSi:wZTtd9kTpHcoAw/Swp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2856-0-0x0000000000260000-0x0000000000722000-memory.dmp

Download

memory/2856-17-0x0000000000260000-0x0000000000722000-memory.dmp

Download

memory/2856-5-0x0000000000260000-0x0000000000722000-memory.dmp

Download

memory/2856-3-0x0000000000260000-0x0000000000722000-memory.dmp

Download

memory/2856-2-0x0000000000261000-0x000000000028F000-memory.dmp

Download

memory/2856-1-0x0000000077676000-0x0000000077678000-memory.dmp

Download

memory/3392-161-0x0000000000D20000-0x000000000128C000-memory.dmp

Download

memory/3392-162-0x0000000000D20000-0x000000000128C000-memory.dmp

Download

memory/3392-153-0x0000000000D20000-0x000000000128C000-memory.dmp

Download

memory/3392-126-0x0000000000D20000-0x000000000128C000-memory.dmp

Download

memory/3392-71-0x0000000000D20000-0x000000000128C000-memory.dmp

Download

memory/3696-183-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-160-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-217-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-210-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-50-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-49-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-124-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-208-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-206-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-201-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-199-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-180-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-178-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-151-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-167-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/3696-154-0x0000000000720000-0x0000000000D2B000-memory.dmp

Download

memory/4912-166-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-184-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-23-0x0000000005470000-0x0000000005471000-memory.dmp

Download

memory/4912-20-0x00000000054A0000-0x00000000054A1000-memory.dmp

Download

memory/4912-22-0x00000000054C0000-0x00000000054C1000-memory.dmp

Download

memory/4912-69-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-211-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-70-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-152-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-168-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-24-0x00000000009F1000-0x0000000000A1F000-memory.dmp

Download

memory/4912-179-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-25-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-181-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-21-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/4912-19-0x0000000005490000-0x0000000005491000-memory.dmp

Download

memory/4912-18-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-26-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-200-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-29-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-51-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-209-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-205-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-48-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-207-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4912-125-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4928-204-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4928-203-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4980-165-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download

memory/4980-164-0x00000000009F0000-0x0000000000EB2000-memory.dmp

Download