amadey | 9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4

Analysis

max time kernel
208s
max time network
299s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
Size

1.8MB
MD5

c7f6fb7822a4e281ba6ad23313d79c92
SHA1

2a6a9e04a5f9419c3742cbe5f44cba2e02bbddec
SHA256

9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4
SHA512

57ebdf7507f18b5f9bf04248fad1397862d638f77152f683c941e71b7f6fad2116a48cffcf4a78793d8267b4113114934289111b2f846a3b2bea0e48bfb83790
SSDEEP

49152:MhmFyCGytJt9uczgZWzQdX1ASJ4YXs2JWaUuFS:MUNbucSoQx9PsatUu

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3bda60048d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	691b2137cb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	691b2137cb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3bda60048d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3bda60048d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	691b2137cb.exe

Executes dropped EXE 4 IoCs

pid	Process
2672	explortu.exe
1848	explortu.exe
2096	3bda60048d.exe
2584	691b2137cb.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	691b2137cb.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	3bda60048d.exe

Loads dropped DLL 4 IoCs

pid	Process
1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
2672	explortu.exe
2672	explortu.exe
2672	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\3bda60048d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\3bda60048d.exe"	explortu.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2584-190-0x0000000001120000-0x0000000001650000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
2672	explortu.exe
1848	explortu.exe
2096	3bda60048d.exe
2584	691b2137cb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 1848	2672	explortu.exe	30

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
2672	explortu.exe
1848	explortu.exe
2096	3bda60048d.exe
2584	691b2137cb.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2792	chrome.exe
2792	chrome.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2584	691b2137cb.exe
2584	691b2137cb.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe
2584	691b2137cb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2672	1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe	28
PID 1648 wrote to memory of 2672	1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe	28
PID 1648 wrote to memory of 2672	1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe	28
PID 1648 wrote to memory of 2672	1648	9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe	28
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 1848	2672	explortu.exe	30
PID 2672 wrote to memory of 2096	2672	explortu.exe	33
PID 2672 wrote to memory of 2096	2672	explortu.exe	33
PID 2672 wrote to memory of 2096	2672	explortu.exe	33
PID 2672 wrote to memory of 2096	2672	explortu.exe	33
PID 2672 wrote to memory of 2584	2672	explortu.exe	34
PID 2672 wrote to memory of 2584	2672	explortu.exe	34
PID 2672 wrote to memory of 2584	2672	explortu.exe	34
PID 2672 wrote to memory of 2584	2672	explortu.exe	34
PID 2584 wrote to memory of 2792	2584	691b2137cb.exe	35
PID 2584 wrote to memory of 2792	2584	691b2137cb.exe	35
PID 2584 wrote to memory of 2792	2584	691b2137cb.exe	35
PID 2584 wrote to memory of 2792	2584	691b2137cb.exe	35
PID 2792 wrote to memory of 2580	2792	chrome.exe	36
PID 2792 wrote to memory of 2580	2792	chrome.exe	36
PID 2792 wrote to memory of 2580	2792	chrome.exe	36
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38
PID 2792 wrote to memory of 2184	2792	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe
"C:\Users\Admin\AppData\Local\Temp\9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\1000016001\3bda60048d.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\3bda60048d.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\1000017001\691b2137cb.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\691b2137cb.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d39758,0x7fef6d39768,0x7fef6d39778
        5⤵
        
        PID:2580
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:2
        5⤵
        
        PID:2184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:8
        5⤵
        
        PID:1840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:8
        5⤵
        
        PID:1856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:1
        5⤵
        
        PID:2836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:1
        5⤵
        
        PID:1404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:2
        5⤵
        
        PID:288
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3140 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:1
        5⤵
        
        PID:1432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:8
        5⤵
        
        PID:2164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:8
        5⤵
        
        PID:1180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 --field-trial-handle=1360,i,5200108285739490786,9358161730493016483,131072 /prefetch:8
        5⤵
        
        PID:2196

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\776510fd-58a2-4606-a5f8-77abe64a1b81.tmp

Filesize
294KB

MD5
3903b475c46e7800d6a5cf9111ead2d7

SHA1
831edcffd5ec278c59aed231550e60eae6cac0a0

SHA256
4d8edb1105b00e1bbd18c12e37a82eaab470320017e7dd97d1efe79829862715

SHA512
81619b4ece7629fa940e2cf512201435fe62c613de78a2cfa8bcb205864955183f4259af454643bb6d32309792265dad32742e5f074806283632ddc878d02b02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\603f756c-caaa-48f3-9967-2edd799bde8a.tmp

Filesize
6KB

MD5
b179704daaef5b6fd3ea291ec8ea5bed

SHA1
16b69848c767d656de76222c5b913f7f5f811ee0

SHA256
01df09d88dfcb168d171b6bfe13c4504ee32d25f3547f360ddcf330867d61edc

SHA512
cd2d66da32b63bf549084a6d0a56363ab87cd1c43168ea529a931b4732565b68c1feb4a5c606dcd387398aa890a57ecdf00404082741f4979972212703b1e85e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4d08b2755c2a73e7178d189dcc7315d3

SHA1
2b0438b1efa6a6014b14cdb4141c43dc70f66345

SHA256
6b71f5ae220c6c8b9fc44ca30f3da9e35c97234ccc19cefb0bfb1c6a208763bb

SHA512
2890066a1a57bff7721ec78d75f9973ab33b24dc2047c5bc0bf6ef7cb601a8d90cba0041bd47fbcc4db51962b7eeea5daa7d0b8b80d40d5f7cf2b74c410c4d75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
df9437f232a0288244305e2a7dfea036

SHA1
bd38a3013c7b2151e32fde14f482bfea4233b9ca

SHA256
49e453a211b2e68c25c42383ddb87515d05ea6ff2f09a1967d449bf936bd0d2f

SHA512
fb1f4ae79ee9113b9d46b8baabc76e8a0cfb9656ff6437666dbe1ef12a0ee65dc5edee7d85570d4269f1218db30bda10ed62d39b3f3b2add2a3da18a149564ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fb5abf5fad8929b7e11e86189597802e

SHA1
dc94447b5dfb2189c21e31880055fac8aa964abb

SHA256
151e8044804dda4d6c503b3213dcb946f626f9eafe7b1cc55cf577100fea7832

SHA512
7c6e56955b6395652e2cfa565a6a1056f19401765632f6ac198b4e3036044c5f8ab85044e20299f83c0045e49a4e91fd6fb050e7450735007788785d1dd6e1dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
140KB

MD5
5c6037c1d231675cd7c227cf51186d84

SHA1
95e930df5feba3710f2799e7eab0279a2da08789

SHA256
438b3b743398c953ff5bd139f9144a7ba87cf47fee45fe177d52561688800235

SHA512
07262b8d7d9c52c3b63dc5d0dc0ad58afb2066de87e825edefc832607b4f891610d82ff31a99e9cd7f08740a69232444592ebd3fc747d25f34b9199fbafec627

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
310KB

MD5
3ba624208ef25650f31c7dbc6ecfc53f

SHA1
9304e8197deb4cf362ea759e8190dbe45f1fb080

SHA256
f53ed74d10d60daa53c4e7356abf2bba38f52603fb4ecfa5e896998d40f2bc0b

SHA512
701811e01602bba1833b5b16ce5dcd6582d8d6baa215c65c4a6fa6a4897261d67efbc31b1a6c312464e1588f2c08a955d246c414ca6aa90376f79e9d728563d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\3bda60048d.exe

Filesize
2.3MB

MD5
7cfeaeccbe1e171218a5b4ea49bff0d6

SHA1
5f357caf7bffba938a455639915269b2ac05e395

SHA256
041c058f3cbacbf7627fed950268e8720b5e7e44ce1558bac2c2d6e0a117af9c

SHA512
eb3366bd543d956e6d71dc3f4590b017fbc7d5cb8a99973edbc3c4ecf0ada0ea3f26fb03a612c0e0a333468e5e504f9ba6063f849635d632040c04a975033ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\691b2137cb.exe

Filesize
2.2MB

MD5
e844c4e82035bdbf7775d8abdf115cf8

SHA1
455c505e32b8760a26ef52deaf747aef6d3816a9

SHA256
238a720bf3008aeee09aa5297a8fd9ee71cd055467dca36f6bc41cb204282e15

SHA512
441407d304fe29198e0cb6f411c732dee890f56bf051483797f40339f7d3f7b12b8d753667e89c01e3de890005a270c3b72ca3721362e0b2bd9e0b8fc241f889

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
c7f6fb7822a4e281ba6ad23313d79c92

SHA1
2a6a9e04a5f9419c3742cbe5f44cba2e02bbddec

SHA256
9b8e08ea2aec28b88beb62643cdc73c1178033173690935d4fe63fd8dc22d2c4

SHA512
57ebdf7507f18b5f9bf04248fad1397862d638f77152f683c941e71b7f6fad2116a48cffcf4a78793d8267b4113114934289111b2f846a3b2bea0e48bfb83790

Download Submit
memory/1648-17-0x0000000007180000-0x0000000007649000-memory.dmp

Filesize
4.8MB

Download
memory/1648-16-0x00000000009F0000-0x0000000000EB9000-memory.dmp

Filesize
4.8MB

Download
memory/1648-9-0x00000000009F0000-0x0000000000EB9000-memory.dmp

Filesize
4.8MB

Download
memory/1648-5-0x00000000009F0000-0x0000000000EB9000-memory.dmp

Filesize
4.8MB

Download
memory/1648-3-0x00000000009F0000-0x0000000000EB9000-memory.dmp

Filesize
4.8MB

Download
memory/1648-1-0x0000000076F70000-0x0000000076F72000-memory.dmp

Filesize
8KB

Download
memory/1648-2-0x00000000009F1000-0x0000000000A1F000-memory.dmp

Filesize
184KB

Download
memory/1648-0-0x00000000009F0000-0x0000000000EB9000-memory.dmp

Filesize
4.8MB

Download
memory/1848-57-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-62-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-47-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-48-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/1848-44-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1848-49-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-61-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-70-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-67-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-69-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-74-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-75-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-78-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-77-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-76-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-73-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-72-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-71-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-68-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-66-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-39-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-65-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-64-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-63-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-59-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-40-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-56-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-54-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-52-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-50-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-60-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-58-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-55-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-53-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-51-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-32-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-35-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-36-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-37-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-38-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1848-41-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2096-107-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2096-103-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2096-96-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2096-98-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2096-109-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2096-100-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2096-105-0x00000000012B0000-0x00000000018A2000-memory.dmp

Filesize
5.9MB

Download
memory/2584-190-0x0000000001120000-0x0000000001650000-memory.dmp

Filesize
5.2MB

Download
memory/2584-128-0x0000000001120000-0x0000000001650000-memory.dmp

Filesize
5.2MB

Download
memory/2672-110-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-24-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-104-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-101-0x00000000067F0000-0x0000000006DE2000-memory.dmp

Filesize
5.9MB

Download
memory/2672-106-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-80-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-108-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-99-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-81-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-79-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-127-0x00000000067F0000-0x0000000006D20000-memory.dmp

Filesize
5.2MB

Download
memory/2672-97-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-25-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-102-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-23-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-94-0x00000000067F0000-0x0000000006DE2000-memory.dmp

Filesize
5.9MB

Download
memory/2672-207-0x00000000067F0000-0x0000000006D20000-memory.dmp

Filesize
5.2MB

Download
memory/2672-22-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-20-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-19-0x0000000000CF1000-0x0000000000D1F000-memory.dmp

Filesize
184KB

Download
memory/2672-18-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-34-0x000000000A450000-0x000000000A919000-memory.dmp

Filesize
4.8MB

Download
memory/2672-33-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-27-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download
memory/2672-26-0x0000000000CF0000-0x00000000011B9000-memory.dmp

Filesize
4.8MB

Download