amadey | 36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
23/06/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
Size

1.8MB
MD5

a434d5c301551f28fd501c1a28bc4cc1
SHA1

26dc0809a985fe7e8d605a7fc34498967f3c5bdf
SHA256

36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3
SHA512

18b62e4171edf7c7590f237551c1d142321b1c99d0889c834cd396b79e3a225d89caeff7050b045296316297cb17e47ce454761e584bfb93d0b774524684a738
SSDEEP

49152:C1oNJ1L5HA09H7r7OHUgTN4StRv/QQZ0Ld6HMD:CO1dHA8jOHPvzrZyYs

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2f21b354a1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d13a3cf604.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2f21b354a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d13a3cf604.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d13a3cf604.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2f21b354a1.exe

Executes dropped EXE 6 IoCs

pid	Process
4868	explortu.exe
4148	2f21b354a1.exe
5056	d13a3cf604.exe
5112	explortu.exe
4324	explortu.exe
3736	explortu.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	2f21b354a1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	d13a3cf604.exe
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Wine	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f21b354a1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\2f21b354a1.exe"	explortu.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5056-116-0x00000000004B0000-0x0000000000A16000-memory.dmp	autoit_exe
behavioral2/memory/5056-147-0x00000000004B0000-0x0000000000A16000-memory.dmp	autoit_exe
behavioral2/memory/5056-155-0x00000000004B0000-0x0000000000A16000-memory.dmp	autoit_exe
behavioral2/memory/5056-156-0x00000000004B0000-0x0000000000A16000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
4868	explortu.exe
4148	2f21b354a1.exe
5056	d13a3cf604.exe
5112	explortu.exe
4324	explortu.exe
3736	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636191489544866"	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
4868	explortu.exe
4868	explortu.exe
4148	2f21b354a1.exe
4148	2f21b354a1.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
3764	chrome.exe
3764	chrome.exe
5112	explortu.exe
5112	explortu.exe
4324	explortu.exe
4324	explortu.exe
1224	chrome.exe
1224	chrome.exe
3736	explortu.exe
3736	explortu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
5056	d13a3cf604.exe
3764	chrome.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe
5056	d13a3cf604.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4868	4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe	80
PID 4072 wrote to memory of 4868	4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe	80
PID 4072 wrote to memory of 4868	4072	36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe	80
PID 4868 wrote to memory of 5008	4868	explortu.exe	81
PID 4868 wrote to memory of 5008	4868	explortu.exe	81
PID 4868 wrote to memory of 5008	4868	explortu.exe	81
PID 4868 wrote to memory of 4148	4868	explortu.exe	82
PID 4868 wrote to memory of 4148	4868	explortu.exe	82
PID 4868 wrote to memory of 4148	4868	explortu.exe	82
PID 4868 wrote to memory of 5056	4868	explortu.exe	83
PID 4868 wrote to memory of 5056	4868	explortu.exe	83
PID 4868 wrote to memory of 5056	4868	explortu.exe	83
PID 5056 wrote to memory of 3764	5056	d13a3cf604.exe	84
PID 5056 wrote to memory of 3764	5056	d13a3cf604.exe	84
PID 3764 wrote to memory of 2576	3764	chrome.exe	87
PID 3764 wrote to memory of 2576	3764	chrome.exe	87
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 4092	3764	chrome.exe	88
PID 3764 wrote to memory of 2072	3764	chrome.exe	89
PID 3764 wrote to memory of 2072	3764	chrome.exe	89
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90
PID 3764 wrote to memory of 964	3764	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe
"C:\Users\Admin\AppData\Local\Temp\36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\1000016001\2f21b354a1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\2f21b354a1.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\1000017001\d13a3cf604.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\d13a3cf604.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeefb9ab58,0x7ffeefb9ab68,0x7ffeefb9ab78
        5⤵
        
        PID:2576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:2
        5⤵
        
        PID:4092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:8
        5⤵
        
        PID:2072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:8
        5⤵
        
        PID:964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:1
        5⤵
        
        PID:720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:1
        5⤵
        
        PID:2056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4296 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:1
        5⤵
        
        PID:4720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:8
        5⤵
        
        PID:3380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4584 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:8
        5⤵
        
        PID:4308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:8
        5⤵
        
        PID:2804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 --field-trial-handle=1952,i,12590429170169712926,15717356222622984525,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3656

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5112

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4324

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ec9bd68709d5a1cb6225f2c55ba6151d

SHA1
b230e88e466d341ae135e14ef143c051d405f456

SHA256
c84ab92a516c4cbc7e4dec018500eb3d690beb7c2062d6d933390b3168191878

SHA512
4ad2a82087ed3a3bc2d070098b3b56638c0cfb8c04571df4598ff58b2d82e30c1597693f3b639c9a4ae6a40020e537edc1f41790a8fb8dd6b1bb3677323bd133

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7094c8cebeb6e05377f2f477f0aeea85

SHA1
54fc3417f40923610b1e1f6a26a875af04cbe6cb

SHA256
2137e3dd162126a83b6dc496149bfbbfbfd9f870b7059e06e08240745a42a200

SHA512
c64fda3760e48a38b35e93a0ecc90895008e8019a931b229012b48463daadd54680f56594daf8c036f196052e9e95d4f27daaffb9008d9d9c07db7d6e4045f0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6fa577b6421319d57c6ecafd2734b54e

SHA1
29bce0a847c7ada6ae6e88d08fca921543248ae4

SHA256
659cd691714751049bec34dc3f101eea9bb9292d7fcf40a0de45a69ae4d22d65

SHA512
4c3ed7fda30260a880b78735d5197f956ad087c3f3c2c85ca4bb7e164bac14e127d3acb481ab55d2265a8e5f18ae9ee66e37e99d3db39d90639077d456bf5eca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
1358a525c8c425c5f434816c7cea6be1

SHA1
72e851065da7c24501fd29a7341b74ab02806e32

SHA256
660f8ac673a3a0780290e63b0fc59216db39446bb9425955239d3156053b1161

SHA512
64b97c127061a014509624cf491c52b229b4fa800cdd0a0cce9bc849aaed6790bf0ef673003e1c0dd2a64a8bd21cc12fbacaabfa9b725bfc2130f496cef25397

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
aec1e0638aa51c10801e1f16ca54acb6

SHA1
1a098bcc7c2bb20178d36296e2ff30f0d97fba78

SHA256
916b94582cceaed24993fd8858023b33fa0a8eb89457c366cbc85209d01df757

SHA512
928056847ee6418d2ac5e7749ad543e5c5ca4f51563680712f5b7dc363e66e669b4a3d3643a82018e53da7b5fc8cace5f68f6eb58d500b56935640ce0ce4ee2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
97091d9b9f0d19c5f0ab7a51e9a1f48d

SHA1
27e89bccc103f49e263288d4fae940438045b46b

SHA256
290f83fb307a4ce6966327579dd4fee85ac6d1f44001ab3edbe12d661ce0a9cd

SHA512
dfba4b2b431317d6b331ee1aaf42e13ae08424e29e8a73d940cefbc19b5a0b7facefd926640dba7a3ab22ffb306acc6d48ef85f913c286ff62e8a88b223e8b61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
279KB

MD5
e4ea9afc36d9e3ed3e6dfc616934f78b

SHA1
9bc91d9dd9f9951d45488ed2f56007bf038bb9ca

SHA256
196dd387fe184b160468636c3bbc651f119e392a08b9354f4c5b971229cb17d1

SHA512
ea022ebc0c736d5e66e6225d2c8e00d8194d103118b0e0f3c6c7e2bf0ee158881a1d073de014941adc1696f94cdba1a78a62d9ca845cbbd3e73ae61d7034efe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\2f21b354a1.exe

Filesize
2.3MB

MD5
60132cb27146af72ae6ebd7e2ba5f523

SHA1
9d04f2edae301a202a0d0221b3534edf6f3c715b

SHA256
1999b67fbbddf3311f72661444f6d79955396839495c97584675c61d04f7964a

SHA512
24eeae84d8d87caa87f0d78f76b2d54c9a1d40bb7e7168f7d806d6581c7ce42ed029f3f623659e13ca8bba6694c3cc94c753f90e4355d3aabfd22d484150f05d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\d13a3cf604.exe

Filesize
2.3MB

MD5
f2919adcf551238270aee051002030ee

SHA1
ed08d5f622548975869c8b5b6932d1b4f651564b

SHA256
44f043047a39e6c5c4d382a85dd6921d456ac18d89d1a4856c5e894e4d44173a

SHA512
437ed9206341a8eb1a755c0c2202b673cb59affafd20e380ffde2a0b21cb7b2236011d18a703dfe614fe3e0d6e68807d895c4916364f39699bd0c5a0ecb27178

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
a434d5c301551f28fd501c1a28bc4cc1

SHA1
26dc0809a985fe7e8d605a7fc34498967f3c5bdf

SHA256
36b9c3618903fa63a25084b60e268445a1c81d4fac8664ec5552c8b7f523fee3

SHA512
18b62e4171edf7c7590f237551c1d142321b1c99d0889c834cd396b79e3a225d89caeff7050b045296316297cb17e47ce454761e584bfb93d0b774524684a738

Download Submit
memory/3736-222-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4072-2-0x00000000007C1000-0x00000000007EF000-memory.dmp

Filesize
184KB

Download
memory/4072-17-0x00000000007C0000-0x0000000000C5C000-memory.dmp

Filesize
4.6MB

Download
memory/4072-1-0x0000000077E96000-0x0000000077E98000-memory.dmp

Filesize
8KB

Download
memory/4072-0-0x00000000007C0000-0x0000000000C5C000-memory.dmp

Filesize
4.6MB

Download
memory/4072-3-0x00000000007C0000-0x0000000000C5C000-memory.dmp

Filesize
4.6MB

Download
memory/4072-5-0x00000000007C0000-0x0000000000C5C000-memory.dmp

Filesize
4.6MB

Download
memory/4148-198-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-220-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-196-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-43-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-200-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-209-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-42-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-192-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-157-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-114-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-144-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-175-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-172-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-202-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-170-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-154-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4148-159-0x00000000006F0000-0x0000000000CE1000-memory.dmp

Filesize
5.9MB

Download
memory/4324-193-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4324-194-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-195-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-201-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-169-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-153-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-171-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-18-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-174-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-19-0x0000000000941000-0x000000000096F000-memory.dmp

Filesize
184KB

Download
memory/4868-20-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-190-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-133-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-21-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-208-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-219-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-132-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-197-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-115-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-199-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-104-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/4868-158-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/5056-61-0x00000000004B0000-0x0000000000A16000-memory.dmp

Filesize
5.4MB

Download
memory/5056-155-0x00000000004B0000-0x0000000000A16000-memory.dmp

Filesize
5.4MB

Download
memory/5056-116-0x00000000004B0000-0x0000000000A16000-memory.dmp

Filesize
5.4MB

Download
memory/5056-156-0x00000000004B0000-0x0000000000A16000-memory.dmp

Filesize
5.4MB

Download
memory/5056-147-0x00000000004B0000-0x0000000000A16000-memory.dmp

Filesize
5.4MB

Download
memory/5112-145-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download
memory/5112-146-0x0000000000940000-0x0000000000DDC000-memory.dmp

Filesize
4.6MB

Download