Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-07-2024 10:27
Static task
static1
Behavioral task
behavioral1
Sample
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe
Resource
win10v2004-20240611-en
General
-
Target
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe
-
Size
1.8MB
-
MD5
7b8c372faa91e9c2a360d344eb6a19f3
-
SHA1
0a6b77900620ce7d08e81ee7812e648b68667ec8
-
SHA256
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace
-
SHA512
b0d660a592c725e605a4d726b3b48cd06a129e911bdfd1c0a4f6db8d347f425b08abdb766a0da569a0dff98512a9f56536030061ce52714d1c127bac16b7af05
-
SSDEEP
49152:g+CilFb+53oDhsrQsiXCkr/Ir+r9dDRJmcq3G:19O3oDhPCkr/ISdbq3
Malware Config
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Extracted
stealc
jony
http://85.28.47.4
-
url_path
/920475a59bac849d.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
Processes:
AFBAFBKEGC.exeexplorti.exeexplorti.exeexplorti.exe6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exeexplorti.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AFBAFBKEGC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exe6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exeAFBAFBKEGC.exeexplorti.exeexplorti.exeexplorti.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AFBAFBKEGC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AFBAFBKEGC.exe -
Executes dropped EXE 7 IoCs
Processes:
explorti.exe40a34287e6.exe1fc74bcb74.exeAFBAFBKEGC.exeexplorti.exeexplorti.exeexplorti.exepid Process 3056 explorti.exe 1100 40a34287e6.exe 3696 1fc74bcb74.exe 4184 AFBAFBKEGC.exe 1792 explorti.exe 4544 explorti.exe 2908 explorti.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exeexplorti.exeAFBAFBKEGC.exeexplorti.exeexplorti.exeexplorti.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Wine 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe Key opened \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Wine AFBAFBKEGC.exe Key opened \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Wine explorti.exe -
Loads dropped DLL 2 IoCs
Processes:
40a34287e6.exepid Process 1100 40a34287e6.exe 1100 40a34287e6.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/files/0x0002000000025c78-42.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exeexplorti.exe40a34287e6.exeAFBAFBKEGC.exeexplorti.exeexplorti.exeexplorti.exepid Process 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 3056 explorti.exe 1100 40a34287e6.exe 1100 40a34287e6.exe 4184 AFBAFBKEGC.exe 1792 explorti.exe 4544 explorti.exe 2908 explorti.exe -
Drops file in Windows directory 1 IoCs
Processes:
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exedescription ioc Process File created C:\Windows\Tasks\explorti.job 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
40a34287e6.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 40a34287e6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 40a34287e6.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645624760364910" chrome.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exeexplorti.exe40a34287e6.exechrome.exeAFBAFBKEGC.exeexplorti.exeexplorti.exechrome.exeexplorti.exepid Process 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 3056 explorti.exe 3056 explorti.exe 1100 40a34287e6.exe 1100 40a34287e6.exe 3316 chrome.exe 3316 chrome.exe 1100 40a34287e6.exe 1100 40a34287e6.exe 4184 AFBAFBKEGC.exe 4184 AFBAFBKEGC.exe 1792 explorti.exe 1792 explorti.exe 4544 explorti.exe 4544 explorti.exe 4824 chrome.exe 4824 chrome.exe 2908 explorti.exe 2908 explorti.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid Process 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid Process Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe1fc74bcb74.exechrome.exepid Process 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3316 chrome.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
1fc74bcb74.exechrome.exepid Process 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe 3696 1fc74bcb74.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
40a34287e6.execmd.exepid Process 1100 40a34287e6.exe 4832 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exeexplorti.exe1fc74bcb74.exechrome.exedescription pid Process procid_target PID 1688 wrote to memory of 3056 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 79 PID 1688 wrote to memory of 3056 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 79 PID 1688 wrote to memory of 3056 1688 6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe 79 PID 3056 wrote to memory of 1100 3056 explorti.exe 80 PID 3056 wrote to memory of 1100 3056 explorti.exe 80 PID 3056 wrote to memory of 1100 3056 explorti.exe 80 PID 3056 wrote to memory of 3696 3056 explorti.exe 81 PID 3056 wrote to memory of 3696 3056 explorti.exe 81 PID 3056 wrote to memory of 3696 3056 explorti.exe 81 PID 3696 wrote to memory of 3316 3696 1fc74bcb74.exe 82 PID 3696 wrote to memory of 3316 3696 1fc74bcb74.exe 82 PID 3316 wrote to memory of 2896 3316 chrome.exe 85 PID 3316 wrote to memory of 2896 3316 chrome.exe 85 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 788 3316 chrome.exe 86 PID 3316 wrote to memory of 1836 3316 chrome.exe 87 PID 3316 wrote to memory of 1836 3316 chrome.exe 87 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88 PID 3316 wrote to memory of 3392 3316 chrome.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe"C:\Users\Admin\AppData\Local\Temp\6294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1000006001\40a34287e6.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\40a34287e6.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AFBAFBKEGC.exe"4⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\AFBAFBKEGC.exe"C:\Users\Admin\AppData\Local\Temp\AFBAFBKEGC.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4184
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KKEHDBAEGI.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:4832
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000007001\1fc74bcb74.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\1fc74bcb74.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff875f3ab58,0x7ff875f3ab68,0x7ff875f3ab785⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=584 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:25⤵PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:85⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:85⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:15⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:15⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3464 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:15⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:85⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4396 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:85⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:85⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1724,i,9561244905664497628,2505401384978326610,131072 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1792
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
216B
MD5ea9d35f2f8fff2e2ec6462f8b18f1ddb
SHA104da74c5a281c5c9a33b065984e5d19dcce57a04
SHA2565b1a6816f2d7efe0049ef7feff838e3e791aac75c7c2eb2c3058a3b88f6b27e1
SHA51209c02cd4b0bae9ebe69d2e7e708b9a45f4dfd6a51e4491ef676e7dc7db4f1e65dc4dad2bc0444d97b26443b899396dcb23d53fe6ca19193d4daefbe66baa802b
-
Filesize
2KB
MD5e184681ffa7159d799acbccc4cca3075
SHA1e58bd5e198c35fb72095bb2d989470cef35228b6
SHA256d7121a73e0a04601c11de510919fa4cf4b6d913d8f0ed23a8afc17ffb4a8cedb
SHA512421a409536c0e36a78c267c681f6b8d6104e0d0b07a04e3024dc6a78f1c3b22c6c0f538dc4471a3debb7f330d2a2bf950ce4333962587771022f16b2af695885
-
Filesize
2KB
MD57659e61d67e88348afc01d4813cdb723
SHA17ae5fbc4f5c08c084339d6b86745d1f6a0714801
SHA2567dc4fe062d6ef72393f5ea9099da6151b156ddbfe6916495483fc7a53b07a4d4
SHA512b875239792a4ac5dc2c1101aa7cef746b3b3bf84be293bdced9edcab4b41306515382c9ec3bb2ec04da341dfedb52fb05da728796858e66209fcc6543f28e6da
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
690B
MD555a6ead6563d3a02bd5459d887311f28
SHA1bd2e4c856ee0676180b3f2e2e3ca432f1ec9083d
SHA256a90a999a6356110d339479d168d22a306423d0170f61a5833898ba258fd1d465
SHA512383852af30e5e4da83d52cd2b3bdf136048181a54ff15c1b402228b92a8b23835c5e16e68628b5e8f9f42ee86486964041a4b9ca9b0da2fe20eba4a1f8a6a036
-
Filesize
7KB
MD5b09b494777a578820cef9be4a57cc3c8
SHA163186a9b2a159c9f7f52619703a317386e19412a
SHA256cd3575bfad4b167c5dbcda7aad3c0ab61bb2741e88ab737121a550de0e6f8575
SHA512b0c308fac8cd893fe6dd3e44d8561d8fcd1ec4ef68086bb6896168ec1b39f3d00736d1f29da28bb28592ac4a13ff3b63d967a84d7b717e1b169a6de074464655
-
Filesize
16KB
MD5b2bac2465ef59bdd433ffe49d443c7d9
SHA18c2a4dcee37f476d9104df3e6be424f1ce84aaf9
SHA256c2b9ea395d35de13fd8485a6d9e7b6e53a49a9ad0e0752b3ffb688f9fee33ce7
SHA512223e33a36627957a07d1ee707b84eaf8f39bb3c01d003fb5f9c9b2d8f2c8615ba0fb1311d7554af4c14352f7468f9acd729720763811054882aa1ea6f580df85
-
Filesize
270KB
MD5771ef045c3b11ce3e5d11a7d4c831469
SHA1b79f36e919d52f80714220af58d2627d8067c712
SHA256294823d610c9a0c169ebddd3fdd20c1c8e5acdc23e1f10687226c1a521c1342c
SHA512201a8176c7e44fb55d713c0bb191616358c8105fdb0083797dc8cd2358c0da8d7b76b655bf9385deefa671abcfca17989851d940c44e9283f806d5a19cb341f0
-
Filesize
2.4MB
MD5747f49b526a931e987825204c1473a27
SHA1d3c3b40dc5d8f3bfc71c7cd2be06e346ab694fdd
SHA2565e3cae26ee0d86cf2c2660baf9d0fc27227173cc8440a94abe5c85a698e0293f
SHA5122b62045a2e6c67916847f793562de04e51a4a9221304df322abd643e98cf0e45bfb4de090d701578cfe039e3a1d98bf2a957a54b74148b56ff0643fd31c1dab8
-
Filesize
1.1MB
MD5fa96bf6af3e182bfec30c757de22ac18
SHA158c94a9d2744f87c524fb0141722b8c4f6d35acf
SHA2562308dd1f426a877a66b8c1faeafb19ba8810a6d9b1c575dc2250ea53b72e4e2a
SHA51231d936954fbaf9ed5893b3698390196f650ea28dcfec3ca74b0669141940f531362be4c9577a0799776f72bb1b31e920c1b061a7f90c4b7413567a6254ff47ae
-
Filesize
1.8MB
MD57b8c372faa91e9c2a360d344eb6a19f3
SHA10a6b77900620ce7d08e81ee7812e648b68667ec8
SHA2566294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace
SHA512b0d660a592c725e605a4d726b3b48cd06a129e911bdfd1c0a4f6db8d347f425b08abdb766a0da569a0dff98512a9f56536030061ce52714d1c127bac16b7af05
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e