amadey | c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
24/06/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
Size 1.8MB
Sample240624-jp628svdrl
SHA256 c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a
MD5 4ebfaedee9d060c8dee8b66e071235ff
SHA1 236239748f931f694ec5cbbf01dbb504ec0af0b1
SHA512 579c8ef091682bab3e2ca6d0e316ecbf285cace50333f039f9a1e2d253119e97ede69e4ee2d3257fa63d2f0a8c06be03f7c169ee90a2d9781a74d9ebaa73695e
SSDEEP 49152:8xgFCT9D3Fz9SV+yKWth0eXhwtkm3oOIlDXt:8+8TbpNIXhwtk6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	55ce6658df.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	73c1479d7c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	73c1479d7c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	55ce6658df.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	73c1479d7c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	55ce6658df.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe

Executes dropped EXE 6 IoCs

pid	Process
4748	explortu.exe
3716	55ce6658df.exe
2316	73c1479d7c.exe
1528	explortu.exe
2388	explortu.exe
4732	explortu.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	55ce6658df.exe
Key opened	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Wine	73c1479d7c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Microsoft\Windows\CurrentVersion\Run\55ce6658df.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\55ce6658df.exe"	explortu.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2316-118-0x00000000008E0000-0x0000000000E44000-memory.dmp	autoit_exe
behavioral2/memory/2316-148-0x00000000008E0000-0x0000000000E44000-memory.dmp	autoit_exe
behavioral2/memory/2316-149-0x00000000008E0000-0x0000000000E44000-memory.dmp	autoit_exe
behavioral2/memory/2316-156-0x00000000008E0000-0x0000000000E44000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1512	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
4748	explortu.exe
3716	55ce6658df.exe
2316	73c1479d7c.exe
1528	explortu.exe
2388	explortu.exe
4732	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636891176453870"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1512	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
1512	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
4748	explortu.exe
4748	explortu.exe
3716	55ce6658df.exe
3716	55ce6658df.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
4012	chrome.exe
4012	chrome.exe
1528	explortu.exe
1528	explortu.exe
2388	explortu.exe
2388	explortu.exe
4028	chrome.exe
4028	chrome.exe
4732	explortu.exe
4732	explortu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2316	73c1479d7c.exe
2316	73c1479d7c.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
2316	73c1479d7c.exe
4012	chrome.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
4012	chrome.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2316	73c1479d7c.exe
2316	73c1479d7c.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe
2316	73c1479d7c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 4748	1512	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe	77
PID 1512 wrote to memory of 4748	1512	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe	77
PID 1512 wrote to memory of 4748	1512	c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe	77
PID 4748 wrote to memory of 1924	4748	explortu.exe	78
PID 4748 wrote to memory of 1924	4748	explortu.exe	78
PID 4748 wrote to memory of 1924	4748	explortu.exe	78
PID 4748 wrote to memory of 3716	4748	explortu.exe	79
PID 4748 wrote to memory of 3716	4748	explortu.exe	79
PID 4748 wrote to memory of 3716	4748	explortu.exe	79
PID 4748 wrote to memory of 2316	4748	explortu.exe	80
PID 4748 wrote to memory of 2316	4748	explortu.exe	80
PID 4748 wrote to memory of 2316	4748	explortu.exe	80
PID 2316 wrote to memory of 4012	2316	73c1479d7c.exe	81
PID 2316 wrote to memory of 4012	2316	73c1479d7c.exe	81
PID 4012 wrote to memory of 2396	4012	chrome.exe	84
PID 4012 wrote to memory of 2396	4012	chrome.exe	84
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4784	4012	chrome.exe	85
PID 4012 wrote to memory of 4716	4012	chrome.exe	86
PID 4012 wrote to memory of 4716	4012	chrome.exe	86
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87
PID 4012 wrote to memory of 2448	4012	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe
"C:\Users\Admin\AppData\Local\Temp\c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\1000016001\55ce6658df.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\55ce6658df.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\1000017001\73c1479d7c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\73c1479d7c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa47e6ab58,0x7ffa47e6ab68,0x7ffa47e6ab78
        5⤵
        
        PID:2396
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:2
        5⤵
        
        PID:4784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:8
        5⤵
        
        PID:4716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:8
        5⤵
        
        PID:2448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:1
        5⤵
        
        PID:4868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:1
        5⤵
        
        PID:1196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4204 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:1
        5⤵
        
        PID:2940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:8
        5⤵
        
        PID:5108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:8
        5⤵
        
        PID:540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:8
        5⤵
        
        PID:2212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2364 --field-trial-handle=1832,i,6838403268941715627,5127510110895872671,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4028

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1528

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2388

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 5bb424e549f6b56cb93339da42ff57326e26e0048413b08a373dddab7c566be4
MD5 b2bc6c0f42d2ee04da456d3096ac22c1
SHA1 99fab56b2eb2772adfb09667714816981b562393
SHA512 a77ab11e89a5284081225da8966f34fbb1b9dc822ff4c6536282d905fe8dcd5debcd3ea6ad1e01c5edb2a63c4d739e5e967ddfb0c532031c741c0d29e5c61d8b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 57c0a37fec43b740e4244ef687ba224434b2335f59c8d68426908cf36155c5c6
MD5 fd54205040889cbf5748b4cd2c7f5dbd
SHA1 094f6a2bb7eda70675226b12ca04d388eae52178
SHA512 4ce503bafb48c4d7dce5d4f78ec0428e8eacc20d8c17fa7fbde1ae390bcb9c50aaba29694cd6c5d5276464f625861885b0a1335c4891dc91a77998e7724ce922
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e90ca5e72d2be69c81ebbc9c689d521ad7960bf8e484cd9adccfd92eff377883
MD5 a5c73c3f1ee692d781567ff1c2c7cb9e
SHA1 d8a64595c62f069e58bf9f65e8ec6927777368ae
SHA512 bdf7a1bd94f4048cfc02e4fc73ab427be88fe960f072f18f41eb538e910d0c13a9ce27833c2a119d150b2f8bc5554e3468434422f92accb7c3f5483daf545c87
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 692B
SHA256 47aa5708ff83c41e25edace038c22b1723ce21cdeada18d05c129f387c6c0527
MD5 79a22398abca4bee30deef8c21d37409
SHA1 1d0267690525b11cd278b56777b54cb7d55d0b06
SHA512 b2ddfc809f5b0beec2493ace6f54f3e2943c3f860c86361e10d946aa65e3a5d3c1a496ec0692faafd1e9a4a9b65f4054071943e5bd54c2717183aa17cd6caaac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 78dd193171f07843447e9e83024e8ba1b7fb5101372abe2f02141263653eb8dc
MD5 38a134c82342f92781e6a0b19a1521ab
SHA1 c97bf88d2e9aea31f90f0b956c198e8955521ea4
SHA512 15ecd5f94285efd1f22815932464fd6860dfefa1dcceeb706595fb9c1e8f2f9187b85c333a3c3dcb9e2b347641c1d7125b06f64540a33977674575ac0e7536ed
SSDEEP 192:WXX8EFs0aHUGIaJs8syh+FRcl5rcP5tjEsXtScR:WXX8LHUGpyyqGlpUtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 4f35013f386938374e300660ccd326318853d715eb5efd1f09ad8216c756c751
MD5 94c3d59c111ed08b260de661c3753f44
SHA1 5fda60eb1c1fc5634ff7c3b4f18118de11115369
SHA512 43200e04a19d77656043faa82f1061495bce079c92ff5a6fd345fb0c29bea92a2dc0bfd45cc39955979a4a9ae33446305cdfee5a845d4ddb1773c865f4d4b914
SSDEEP 384:RlvQQ7pLhLcsB6MXso1kXqKf/pUZNCgVLH2Hf9ZcrUXj3HGahf77YppLx:RNZ7pLhL9Aeso1kXqKf/pUZNCgVLH2H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 280KB
SHA256 a3762c0941b1ceab9d9e86f7f85b19b7586e1c851f1fb3a6919256297e7892ea
MD5 c5dba67886d5cf276ccfffe6d94a6631
SHA1 2892a864f22f3b6ed4d2df12796f19a8ac0c44f1
SHA512 dc59af39ee619baf0000d2459d13a79fc6d42d9710634ef662f36ac1164b7af3ed1096a418465fb060bef4addcdae4dcbb468135eaa21dcd276f58fa34f67cc8
SSDEEP 6144:4MX26RiqUAEGbdYTa0Mw5Qf2RSTIadDpwU5CAE:0VTK2gTIadDhE
MD5 SHA1 SHA512 SSDEEP

Submit Download

55ce6658df.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\55ce6658df.exe
Size 2.3MB
SHA256 997d363c2a300e2904ac1bf6bceabffd0933c125b1fe97eb669d205cc75c0af8
MD5 70319b60b924cb47cb7be8bef265d212
SHA1 069b1a35b0ce2b8081b9c8c7dd6eb291e230f968
SHA512 29f2a6d065adcf02d206e9033e4d45df1c34b1632b85cd1e40396b3c2770073e0bba1f8f393ca9c83cb27d101f505df9c745f8267fc8efea33e1e0fde701caf4
SSDEEP 49152:hOyKSjm1vfUeP+oDgQsTTvmkbz74eoUZ5LL7n5:hOynNUFsHm4z74eZ5LPn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

73c1479d7c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000017001\73c1479d7c.exe
Size 2.3MB
SHA256 7efa281d46cb5914fa23dbd6754092eeced1407213c9bdf8b7cadce0c216b36d
MD5 402f3151a5a461a33cf70c90fdfa806f
SHA1 da9abba0349e2b2214de5410f6a9734a7aa3c053
SHA512 54d1bab785ebd0d620e53fb973ebf783a71f5de9d70c8bd1bac95d986b33743dd1870e0b777a2b54650cd18dc098c12a08dfe3fda1e380e685c6be9b1384ff1d
SSDEEP 49152:Z+KIUGEKHHQOIrIImEtQzxBPaXsxo/MwwchLQLzQ0PM1beIbgrH0z:9GEeHQOIfcxB7x6pVhLSn4m0
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 c187fd367854caa490479be61ba9e6713057afda9f9f1d143fc95ea21b30888a
MD5 4ebfaedee9d060c8dee8b66e071235ff
SHA1 236239748f931f694ec5cbbf01dbb504ec0af0b1
SHA512 579c8ef091682bab3e2ca6d0e316ecbf285cace50333f039f9a1e2d253119e97ede69e4ee2d3257fa63d2f0a8c06be03f7c169ee90a2d9781a74d9ebaa73695e
SSDEEP 49152:8xgFCT9D3Fz9SV+yKWth0eXhwtkm3oOIlDXt:8+8TbpNIXhwtk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-0-0x0000000000AC0000-0x0000000000F84000-memory.dmp

Download

memory/1512-17-0x0000000000AC0000-0x0000000000F84000-memory.dmp

Download

memory/1512-5-0x0000000000AC0000-0x0000000000F84000-memory.dmp

Download

memory/1512-3-0x0000000000AC0000-0x0000000000F84000-memory.dmp

Download

memory/1512-2-0x0000000000AC1000-0x0000000000AEF000-memory.dmp

Download

memory/1512-1-0x0000000077736000-0x0000000077738000-memory.dmp

Download

memory/1528-114-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/1528-116-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/2316-148-0x00000000008E0000-0x0000000000E44000-memory.dmp

Download

memory/2316-149-0x00000000008E0000-0x0000000000E44000-memory.dmp

Download

memory/2316-118-0x00000000008E0000-0x0000000000E44000-memory.dmp

Download

memory/2316-60-0x00000000008E0000-0x0000000000E44000-memory.dmp

Download

memory/2316-156-0x00000000008E0000-0x0000000000E44000-memory.dmp

Download

memory/2388-177-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/2388-178-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/3716-200-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-157-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-146-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-147-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-202-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-42-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-176-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-198-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-210-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-117-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-196-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-159-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-194-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-170-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-223-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/3716-172-0x00000000006C0000-0x0000000000CB3000-memory.dmp

Download

memory/4732-212-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4732-211-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-174-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-171-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-19-0x0000000000061000-0x000000000008F000-memory.dmp

Download

memory/4748-193-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-169-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-195-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-158-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-197-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-155-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-199-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-20-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-201-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-21-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-208-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-145-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-137-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-112-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-18-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-222-0x0000000000060000-0x0000000000524000-memory.dmp

Download

memory/4748-119-0x0000000000060000-0x0000000000524000-memory.dmp

Download