Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 11:12
Static task
static1
Behavioral task
behavioral1
Sample
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe
Resource
win10v2004-20240611-en
General
-
Target
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe
-
Size
2.4MB
-
MD5
fdaa4171e6b15af5628a055bc7a7bca1
-
SHA1
0f69f54846e26167777e3d56939adc72ddcb545c
-
SHA256
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16
-
SHA512
2ef1076ab306bbd90cc1011c60ae8aab8f626942e3ea2a53e755b60ce1f3865d88302d02395271ee184f3f787baa8b7febd3e9473351932c504f5c6f39185d7f
-
SSDEEP
49152:JWnoPATF3ed8uTO9u0boi9qD9Bt+wMw3tQKahDlZi5HMc:0o8U0bo80BtJQFNHWsc
Malware Config
Extracted
stealc
jony
http://85.28.47.4
-
url_path
/920475a59bac849d.php
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
BAKFCBFHJD.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BAKFCBFHJD.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
BAKFCBFHJD.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BAKFCBFHJD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BAKFCBFHJD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exeBAKFCBFHJD.exeexplorti.exe7e99f091b3.exe230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation BAKFCBFHJD.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 7e99f091b3.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe -
Executes dropped EXE 7 IoCs
Processes:
BAKFCBFHJD.exeexplorti.exeb8c8be67af.exe7e99f091b3.exeexplorti.exeexplorti.exeexplorti.exepid Process 916 BAKFCBFHJD.exe 4956 explorti.exe 1952 b8c8be67af.exe 3568 7e99f091b3.exe 3696 explorti.exe 3596 explorti.exe 688 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
BAKFCBFHJD.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine BAKFCBFHJD.exe Key opened \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Wine explorti.exe -
Loads dropped DLL 2 IoCs
Processes:
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exepid Process 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/files/0x0007000000023429-119.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exeBAKFCBFHJD.exeexplorti.exeb8c8be67af.exeexplorti.exeexplorti.exeexplorti.exepid Process 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 916 BAKFCBFHJD.exe 4956 explorti.exe 1952 b8c8be67af.exe 3696 explorti.exe 3596 explorti.exe 688 explorti.exe -
Drops file in Windows directory 1 IoCs
Processes:
BAKFCBFHJD.exedescription ioc Process File created C:\Windows\Tasks\explorti.job BAKFCBFHJD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645651748620295" chrome.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exeBAKFCBFHJD.exeexplorti.exechrome.exeexplorti.exeexplorti.exechrome.exeexplorti.exepid Process 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 916 BAKFCBFHJD.exe 916 BAKFCBFHJD.exe 4956 explorti.exe 4956 explorti.exe 636 chrome.exe 636 chrome.exe 3696 explorti.exe 3696 explorti.exe 3596 explorti.exe 3596 explorti.exe 536 chrome.exe 536 chrome.exe 688 explorti.exe 688 explorti.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid Process 636 chrome.exe 636 chrome.exe 636 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid Process Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
BAKFCBFHJD.exe7e99f091b3.exechrome.exepid Process 916 BAKFCBFHJD.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 636 chrome.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe -
Suspicious use of SendNotifyMessage 60 IoCs
Processes:
7e99f091b3.exechrome.exepid Process 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe 3568 7e99f091b3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.execmd.exeb8c8be67af.exepid Process 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 1176 cmd.exe 1952 b8c8be67af.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.execmd.exeBAKFCBFHJD.exeexplorti.exe7e99f091b3.exechrome.exedescription pid Process procid_target PID 2400 wrote to memory of 1556 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 90 PID 2400 wrote to memory of 1556 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 90 PID 2400 wrote to memory of 1556 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 90 PID 2400 wrote to memory of 1176 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 92 PID 2400 wrote to memory of 1176 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 92 PID 2400 wrote to memory of 1176 2400 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe 92 PID 1556 wrote to memory of 916 1556 cmd.exe 94 PID 1556 wrote to memory of 916 1556 cmd.exe 94 PID 1556 wrote to memory of 916 1556 cmd.exe 94 PID 916 wrote to memory of 4956 916 BAKFCBFHJD.exe 97 PID 916 wrote to memory of 4956 916 BAKFCBFHJD.exe 97 PID 916 wrote to memory of 4956 916 BAKFCBFHJD.exe 97 PID 4956 wrote to memory of 1952 4956 explorti.exe 98 PID 4956 wrote to memory of 1952 4956 explorti.exe 98 PID 4956 wrote to memory of 1952 4956 explorti.exe 98 PID 4956 wrote to memory of 3568 4956 explorti.exe 99 PID 4956 wrote to memory of 3568 4956 explorti.exe 99 PID 4956 wrote to memory of 3568 4956 explorti.exe 99 PID 3568 wrote to memory of 636 3568 7e99f091b3.exe 100 PID 3568 wrote to memory of 636 3568 7e99f091b3.exe 100 PID 636 wrote to memory of 2668 636 chrome.exe 102 PID 636 wrote to memory of 2668 636 chrome.exe 102 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 3360 636 chrome.exe 103 PID 636 wrote to memory of 1224 636 chrome.exe 104 PID 636 wrote to memory of 1224 636 chrome.exe 104 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105 PID 636 wrote to memory of 944 636 chrome.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe"C:\Users\Admin\AppData\Local\Temp\230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BAKFCBFHJD.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\BAKFCBFHJD.exe"C:\Users\Admin\AppData\Local\Temp\BAKFCBFHJD.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\1000006001\b8c8be67af.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\b8c8be67af.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\1000007001\7e99f091b3.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\7e99f091b3.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account6⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5639ab58,0x7ffd5639ab68,0x7ffd5639ab787⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:27⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:87⤵PID:1224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:87⤵PID:944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:17⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:17⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:17⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:87⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:87⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4848 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:87⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 --field-trial-handle=1908,i,9600464137636326202,8009049802316074410,131072 /prefetch:27⤵
- Suspicious behavior: EnumeratesProcesses
PID:536
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FBFHJJJDAF.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
216B
MD5ee64f8b151a2b5425bc3ed75d4ef0cb8
SHA1e3e41feda87f8ff7e36f2bd7fc48c811835cb2e0
SHA256805c1ba373040c6eaf00decbf74a8fd00984a2f4cce6744baf137f5a5db7b708
SHA51240e3c1e922bb882f48adf590c992c4b9f6d6ccf62cb830d03992e25666de60a26d1ce15709474c1e7958daa1793ae2b68c5c5a212dd570137688057a86625b66
-
Filesize
2KB
MD522738956f4ebdf6cf527184b5f4c5b22
SHA151d3dbf98632fed743fc5910bd800976c548541d
SHA256a3ea1e9c1a8dcbe37c3f74d455516f306e09e5f92fda037671340751cb747194
SHA512011d30f109ed7405dd21b99e4af243406bb398d11ed0f543ecdf813347883b2de382acb99d6ab2fec55158485dd6e6172947937f2628b90b3f5523693e071b78
-
Filesize
3KB
MD580a0f108603c4607aeecf280d754e4a3
SHA1ace3470d52fe7d83335845f4d3f427a36b03a45f
SHA25669f364e0a9d961ac3002faa2474acc35ef7eada344ce0f29a19281389cb5cbe4
SHA51246a4570e903224313ded23ad497813b8b229ff04968e45ecf0efbfdd7f9bd0bd1fb1f6add623d3f68d290d26aac0312ba285bb945b365b860328f89a95a2ad42
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD50d14af4c70d81ac69ab5f6c734eb11dd
SHA1d32848bb9a98c3c92fd2b4824025dd8b9f9623ae
SHA25697f0c083c917cf2213cd1404eed21b014a23cdffeee7d964b13fa1ce48a3e51d
SHA512f4fa3652a32b2407332fafebb600c375ba4b44eb8d18b451167191478118f3cf3a7a0bba7168e32e0f563e87bff6d299dc2376492c256820d3cc45bd1a65b42a
-
Filesize
7KB
MD55ee39b8b739ade588326768bacf70345
SHA135bd5a5c8fa8ece7744a3d26f8cfc6fddb81547a
SHA256a483733edda28aeebdabe59a6a134afd13057eb210f364f35363a4c8e8e014d6
SHA512f634e95e760b44d48dda77ac466d3852bafdd895c16a6a247b98e879267b3fa0437b77fbdfa8cfecbc6832a35de42fcbb09a89fd052153504f171f388c12ef6c
-
Filesize
16KB
MD58c4a4993ea370d201156ae0f903fd97e
SHA121390bb3d9146ec8fb3aa823328cf8a04c38a190
SHA256fa697035c3dcf21b41acfb920fb7ca49a4303b14d27428861cc69763ed54b2d1
SHA5128a3f7b8ab488e46609a830b6072e91cbd16fcfe280b470711d15ff380e8f21d4b1cf40b34c7cb008d133e50cbf8c0045ba3a321cce4061373a2093732e0b21d9
-
Filesize
279KB
MD5d23185188236823e664bdb0ae8e83a15
SHA1fef7910b6fcd4e4be0c552e0995f38056d328f77
SHA256e879cea168f1fab3ac52d6da9f23825bb78d91e8cf700a8a60f4b3f188c0cbb3
SHA51270012bd2a91b4006047c63dcbf760e17b0417b88c7ce26934b6b363fb5d5d57c9d8e71dff83a8e3484708df50bb9227941ae9a944ce90f7dc990b8ad0082ad75
-
Filesize
2.4MB
MD5747f49b526a931e987825204c1473a27
SHA1d3c3b40dc5d8f3bfc71c7cd2be06e346ab694fdd
SHA2565e3cae26ee0d86cf2c2660baf9d0fc27227173cc8440a94abe5c85a698e0293f
SHA5122b62045a2e6c67916847f793562de04e51a4a9221304df322abd643e98cf0e45bfb4de090d701578cfe039e3a1d98bf2a957a54b74148b56ff0643fd31c1dab8
-
Filesize
1.1MB
MD5fa96bf6af3e182bfec30c757de22ac18
SHA158c94a9d2744f87c524fb0141722b8c4f6d35acf
SHA2562308dd1f426a877a66b8c1faeafb19ba8810a6d9b1c575dc2250ea53b72e4e2a
SHA51231d936954fbaf9ed5893b3698390196f650ea28dcfec3ca74b0669141940f531362be4c9577a0799776f72bb1b31e920c1b061a7f90c4b7413567a6254ff47ae
-
Filesize
1.8MB
MD57b8c372faa91e9c2a360d344eb6a19f3
SHA10a6b77900620ce7d08e81ee7812e648b68667ec8
SHA2566294ab0c9c38f852221d0977bcd9b6fd8884eed85427a19dfc7ac0ab0bcd0ace
SHA512b0d660a592c725e605a4d726b3b48cd06a129e911bdfd1c0a4f6db8d347f425b08abdb766a0da569a0dff98512a9f56536030061ce52714d1c127bac16b7af05
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e