amadey | aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c

Analysis

max time kernel
181s
max time network
296s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
Size

1.8MB
MD5

4621751c3f6eefa29e8d24d472b7fd5c
SHA1

1ef528e0517c76e2d57740ad070965e982528924
SHA256

aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c
SHA512

8fa13bc0e78e81e915930bcccf8a5c9a2fe3ff31f931d9424ca24348b8b3d003ee65a3fe7bebcae1ac984cb5c5db57795739204d37b59486b7285f6872ab21a6
SSDEEP

49152:hoQhmzwEzS0f8dhhZmhxk4Epba/iv7MRYldlJ2gm2BZC:h//EzS5hGhGbtK+5c

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	19b0a3d3e3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	af88862a35.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	19b0a3d3e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	19b0a3d3e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	af88862a35.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	af88862a35.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe

Executes dropped EXE 4 IoCs

pid	Process
2864	explortu.exe
1584	explortu.exe
1544	19b0a3d3e3.exe
1852	af88862a35.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	19b0a3d3e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	af88862a35.exe

Loads dropped DLL 4 IoCs

pid	Process
3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
2864	explortu.exe
2864	explortu.exe
2864	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\19b0a3d3e3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\19b0a3d3e3.exe"	explortu.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1852-211-0x0000000000150000-0x0000000000680000-memory.dmp	autoit_exe
behavioral1/memory/1852-218-0x0000000000150000-0x0000000000680000-memory.dmp	autoit_exe
behavioral1/memory/1852-224-0x0000000000150000-0x0000000000680000-memory.dmp	autoit_exe
behavioral1/memory/1852-226-0x0000000000150000-0x0000000000680000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
2864	explortu.exe
1584	explortu.exe
1544	19b0a3d3e3.exe
1852	af88862a35.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 1584	2864	explortu.exe	30

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
2864	explortu.exe
1584	explortu.exe
1544	19b0a3d3e3.exe
1852	af88862a35.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
1852	af88862a35.exe
1852	af88862a35.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
1852	af88862a35.exe
1852	af88862a35.exe
2628	chrome.exe
2628	chrome.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1852	af88862a35.exe
1852	af88862a35.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe
1852	af88862a35.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2864	3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe	28
PID 3008 wrote to memory of 2864	3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe	28
PID 3008 wrote to memory of 2864	3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe	28
PID 3008 wrote to memory of 2864	3008	aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe	28
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1584	2864	explortu.exe	30
PID 2864 wrote to memory of 1544	2864	explortu.exe	33
PID 2864 wrote to memory of 1544	2864	explortu.exe	33
PID 2864 wrote to memory of 1544	2864	explortu.exe	33
PID 2864 wrote to memory of 1544	2864	explortu.exe	33
PID 2864 wrote to memory of 1852	2864	explortu.exe	34
PID 2864 wrote to memory of 1852	2864	explortu.exe	34
PID 2864 wrote to memory of 1852	2864	explortu.exe	34
PID 2864 wrote to memory of 1852	2864	explortu.exe	34
PID 1852 wrote to memory of 2628	1852	af88862a35.exe	35
PID 1852 wrote to memory of 2628	1852	af88862a35.exe	35
PID 1852 wrote to memory of 2628	1852	af88862a35.exe	35
PID 1852 wrote to memory of 2628	1852	af88862a35.exe	35
PID 2628 wrote to memory of 2844	2628	chrome.exe	36
PID 2628 wrote to memory of 2844	2628	chrome.exe	36
PID 2628 wrote to memory of 2844	2628	chrome.exe	36
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38
PID 2628 wrote to memory of 2804	2628	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe
"C:\Users\Admin\AppData\Local\Temp\aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\1000016001\19b0a3d3e3.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\19b0a3d3e3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\1000017001\af88862a35.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\af88862a35.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7039758,0x7fef7039768,0x7fef7039778
        5⤵
        
        PID:2844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:2
        5⤵
        
        PID:2804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:8
        5⤵
        
        PID:2840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:8
        5⤵
        
        PID:2848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:1
        5⤵
        
        PID:1124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:1
        5⤵
        
        PID:900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3040 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:2
        5⤵
        
        PID:2912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1456 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:1
        5⤵
        
        PID:1704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 --field-trial-handle=1300,i,15745826175854307029,2386331545984080667,131072 /prefetch:8
        5⤵
        
        PID:1780

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
9167c72ee3da1f8ed0dd8b55bfb8f59e

SHA1
1f196dccfd477671a901a469e565ae87f361143f

SHA256
029a850bb3d6fed56b223711db57ea26f452dbf5dc259bac8e1fe786efaec26a

SHA512
c507a359ef0fc2941516996db9dd379b6ff75c16c282dcca177ff772f64982f949745ad8fb8d0f060f20b5e8ede946d891f3313cfb3f40f4d6bb37d3ff901bc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b6bf134abe03967377b11d7042f63c59

SHA1
073e3ff06c91415463102cac6b8f1f9a898f42fe

SHA256
9cdcdb60156016fc5e43804a9bbc3eba0920c74186d8078a3a95ff863dd8fde7

SHA512
431bd7343f7d352392cc3033eceb892e2c6d4cde12f01899214dd662765575501c6a897dd3e79a7a24e03bc943318f537107c3848e8f59b761572e5f32ef64a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5da2639eed64254466184a774f7b59a1

SHA1
fe9b811220302b637a4c68324b08f6a2c54f6b8a

SHA256
79934cf714484876e54cfec1c01afd6a856b941df2643e21076d4617e0e818d5

SHA512
14a03c844c7ce0349edbb76c342ed3f449763b75c5b45abde906d648c6fd71900abb873a284fce0c30bbeeda10419c100a1d34071af9a7b67eb75b201b010d62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\19b0a3d3e3.exe

Filesize
2.3MB

MD5
7cfeaeccbe1e171218a5b4ea49bff0d6

SHA1
5f357caf7bffba938a455639915269b2ac05e395

SHA256
041c058f3cbacbf7627fed950268e8720b5e7e44ce1558bac2c2d6e0a117af9c

SHA512
eb3366bd543d956e6d71dc3f4590b017fbc7d5cb8a99973edbc3c4ecf0ada0ea3f26fb03a612c0e0a333468e5e504f9ba6063f849635d632040c04a975033ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\af88862a35.exe

Filesize
2.2MB

MD5
e844c4e82035bdbf7775d8abdf115cf8

SHA1
455c505e32b8760a26ef52deaf747aef6d3816a9

SHA256
238a720bf3008aeee09aa5297a8fd9ee71cd055467dca36f6bc41cb204282e15

SHA512
441407d304fe29198e0cb6f411c732dee890f56bf051483797f40339f7d3f7b12b8d753667e89c01e3de890005a270c3b72ca3721362e0b2bd9e0b8fc241f889

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
4621751c3f6eefa29e8d24d472b7fd5c

SHA1
1ef528e0517c76e2d57740ad070965e982528924

SHA256
aa7dbc55de09cbe91dbae7496e2c237194ff6d827fd4af2af4ea56efb526c34c

SHA512
8fa13bc0e78e81e915930bcccf8a5c9a2fe3ff31f931d9424ca24348b8b3d003ee65a3fe7bebcae1ac984cb5c5db57795739204d37b59486b7285f6872ab21a6

Download Submit
memory/1544-210-0x0000000000F50000-0x0000000001542000-memory.dmp

Filesize
5.9MB

Download
memory/1544-189-0x0000000000F50000-0x0000000001542000-memory.dmp

Filesize
5.9MB

Download
memory/1544-223-0x0000000000F50000-0x0000000001542000-memory.dmp

Filesize
5.9MB

Download
memory/1544-116-0x0000000000F50000-0x0000000001542000-memory.dmp

Filesize
5.9MB

Download
memory/1544-101-0x0000000000F50000-0x0000000001542000-memory.dmp

Filesize
5.9MB

Download
memory/1584-41-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-54-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-31-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-32-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-33-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-34-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-35-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-37-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-26-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-44-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-52-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-47-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/1584-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1584-38-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-48-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-49-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-59-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-61-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-71-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-74-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-77-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-78-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-76-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-75-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-73-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-72-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-69-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-68-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-67-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-66-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-64-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-63-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-60-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-70-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-65-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-62-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-58-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-57-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-55-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-56-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-53-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-51-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1584-50-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1852-118-0x0000000000150000-0x0000000000680000-memory.dmp

Filesize
5.2MB

Download
memory/1852-226-0x0000000000150000-0x0000000000680000-memory.dmp

Filesize
5.2MB

Download
memory/1852-224-0x0000000000150000-0x0000000000680000-memory.dmp

Filesize
5.2MB

Download
memory/1852-218-0x0000000000150000-0x0000000000680000-memory.dmp

Filesize
5.2MB

Download
memory/1852-211-0x0000000000150000-0x0000000000680000-memory.dmp

Filesize
5.2MB

Download
memory/2864-21-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-19-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-84-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-85-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-86-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-29-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-46-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-100-0x0000000006770000-0x0000000006D62000-memory.dmp

Filesize
5.9MB

Download
memory/2864-102-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-28-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-22-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-117-0x0000000006770000-0x0000000006CA0000-memory.dmp

Filesize
5.2MB

Download
memory/2864-82-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-30-0x000000000A090000-0x000000000A540000-memory.dmp

Filesize
4.7MB

Download
memory/2864-18-0x00000000013D1000-0x00000000013FF000-memory.dmp

Filesize
184KB

Download
memory/2864-83-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-183-0x0000000006770000-0x0000000006D62000-memory.dmp

Filesize
5.9MB

Download
memory/2864-188-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-17-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-79-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-81-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-217-0x0000000006770000-0x0000000006CA0000-memory.dmp

Filesize
5.2MB

Download
memory/2864-216-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/2864-80-0x00000000013D0000-0x0000000001880000-memory.dmp

Filesize
4.7MB

Download
memory/3008-9-0x0000000000E50000-0x0000000001300000-memory.dmp

Filesize
4.7MB

Download
memory/3008-5-0x0000000000E50000-0x0000000001300000-memory.dmp

Filesize
4.7MB

Download
memory/3008-16-0x0000000000E50000-0x0000000001300000-memory.dmp

Filesize
4.7MB

Download
memory/3008-0-0x0000000000E50000-0x0000000001300000-memory.dmp

Filesize
4.7MB

Download
memory/3008-3-0x0000000000E50000-0x0000000001300000-memory.dmp

Filesize
4.7MB

Download
memory/3008-1-0x00000000772F0000-0x00000000772F2000-memory.dmp

Filesize
8KB

Download
memory/3008-2-0x0000000000E51000-0x0000000000E7F000-memory.dmp

Filesize
184KB

Download