amadey | 17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
Size

2.4MB
MD5

fcac53ade6abee5bd5c813c626a7dc2e
SHA1

49d2890836e8122188c20cfe0d4e412862e58c02
SHA256

17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a
SHA512

03689b9d80408e79a258f234daa782c7721f4c4f69349838e89e7e6056c28a1f492e1fee1f62f5cde23adaaea64086eb4a2684261afa0c57ceb21b3e5855491d
SSDEEP

49152:la3U2Quvnr17NUfsaGMXyKM7c7QabvKvfeuzfv3mGt2uUaSbK/NxHeFEKc8:gkgsxGjIkaZ4eY2um2eFEKL

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GDHIDHIEGI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GDHIDHIEGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GDHIDHIEGI.exe

Executes dropped EXE 4 IoCs

pid	Process
2928	GDHIDHIEGI.exe
2232	explorti.exe
2052	3fdb5a0714.exe
2452	529e91905d.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Wine	GDHIDHIEGI.exe
Key opened	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Wine	explorti.exe

Loads dropped DLL 7 IoCs

pid	Process
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
1020	cmd.exe
2928	GDHIDHIEGI.exe
2232	explorti.exe
2232	explorti.exe
2232	explorti.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001966c-146.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
2928	GDHIDHIEGI.exe
2232	explorti.exe
2052	3fdb5a0714.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	GDHIDHIEGI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
2928	GDHIDHIEGI.exe
2232	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	firefox.exe
Token: SeDebugPrivilege	1124	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2928	GDHIDHIEGI.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
1124	firefox.exe
1124	firefox.exe
1124	firefox.exe
1124	firefox.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
1124	firefox.exe
1124	firefox.exe
1124	firefox.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe
2452	529e91905d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
2052	3fdb5a0714.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1020	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	31
PID 1812 wrote to memory of 1020	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	31
PID 1812 wrote to memory of 1020	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	31
PID 1812 wrote to memory of 1020	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	31
PID 1812 wrote to memory of 2528	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	33
PID 1812 wrote to memory of 2528	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	33
PID 1812 wrote to memory of 2528	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	33
PID 1812 wrote to memory of 2528	1812	17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe	33
PID 1020 wrote to memory of 2928	1020	cmd.exe	35
PID 1020 wrote to memory of 2928	1020	cmd.exe	35
PID 1020 wrote to memory of 2928	1020	cmd.exe	35
PID 1020 wrote to memory of 2928	1020	cmd.exe	35
PID 2928 wrote to memory of 2232	2928	GDHIDHIEGI.exe	36
PID 2928 wrote to memory of 2232	2928	GDHIDHIEGI.exe	36
PID 2928 wrote to memory of 2232	2928	GDHIDHIEGI.exe	36
PID 2928 wrote to memory of 2232	2928	GDHIDHIEGI.exe	36
PID 2232 wrote to memory of 2052	2232	explorti.exe	38
PID 2232 wrote to memory of 2052	2232	explorti.exe	38
PID 2232 wrote to memory of 2052	2232	explorti.exe	38
PID 2232 wrote to memory of 2052	2232	explorti.exe	38
PID 2232 wrote to memory of 2452	2232	explorti.exe	39
PID 2232 wrote to memory of 2452	2232	explorti.exe	39
PID 2232 wrote to memory of 2452	2232	explorti.exe	39
PID 2232 wrote to memory of 2452	2232	explorti.exe	39
PID 2452 wrote to memory of 2272	2452	529e91905d.exe	40
PID 2452 wrote to memory of 2272	2452	529e91905d.exe	40
PID 2452 wrote to memory of 2272	2452	529e91905d.exe	40
PID 2452 wrote to memory of 2272	2452	529e91905d.exe	40
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 2272 wrote to memory of 1124	2272	firefox.exe	41
PID 1124 wrote to memory of 2200	1124	firefox.exe	42
PID 1124 wrote to memory of 2200	1124	firefox.exe	42
PID 1124 wrote to memory of 2200	1124	firefox.exe	42
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43
PID 1124 wrote to memory of 2868	1124	firefox.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe
"C:\Users\Admin\AppData\Local\Temp\17c2797cb63c1cc15869f36031c9dc2c7f63953ae08ee9f257faa3b7a916629a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GDHIDHIEGI.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Users\Admin\AppData\Local\Temp\GDHIDHIEGI.exe
    "C:\Users\Admin\AppData\Local\Temp\GDHIDHIEGI.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\3fdb5a0714.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\3fdb5a0714.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\529e91905d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\529e91905d.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.0.432443148\1700265647" -parentBuildID 20221007134813 -prefsHandle 1276 -prefMapHandle 1192 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a5f01a3-2b65-4b72-b42a-d31c8acc2b02} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 1348 110f0658 gpu
        8⤵
        
        PID:2200
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.1.961771800\2067318255" -parentBuildID 20221007134813 -prefsHandle 1536 -prefMapHandle 1532 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bd54ae6-0d42-45c2-a86e-11d48d2b89d5} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 1564 ecfa258 socket
        8⤵
        
        PID:2868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.2.711090340\1639910570" -childID 1 -isForBrowser -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a9cbd95-408e-492a-b32c-5acda477f475} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 2312 18fd8a58 tab
        8⤵
        
        PID:3004
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.3.572554854\590122852" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e2f3950-3e64-4a4e-957e-696c95b014e5} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 2908 d2ed58 tab
        8⤵
        
        PID:2140
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.4.1468547275\538620084" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3768 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c1959ce-7415-42ac-b7ed-c128a2da7020} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 3780 204c3c58 tab
        8⤵
        
        PID:2668
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.5.235996599\325663803" -childID 4 -isForBrowser -prefsHandle 3932 -prefMapHandle 3936 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9db66aa-592a-4700-a36a-96c78dbf8572} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 3924 204c2d58 tab
        8⤵
        
        PID:1996
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1124.6.916536937\577228020" -childID 5 -isForBrowser -prefsHandle 4120 -prefMapHandle 4124 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc2de6e-310c-4e49-b024-320ebf6eb31b} 1124 "\\.\pipe\gecko-crash-server-pipe.1124" 4112 1ed4b758 tab
        8⤵
        
        PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FBKECFIIEH.exe"
  2⤵
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\62jv3uqp.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
ec36dc78860c6e58a2061f1826bfafc2

SHA1
e8f02619d3ce6dc7b3093e9c31b25d53659af1b4

SHA256
2796c89453f199c7145b6c480f7bb067227e9b666cd3847678fc3e44bb9d3bad

SHA512
f071fb9224cef3fa094fab389ce2eba3e42c7f6d8c5cdc11a502143390e4d3c24f48ba5c447f93d3f9da9301d8e86c4ceb3fb5117b7afd65d40d06e67ec3873a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\3fdb5a0714.exe

Filesize
2.4MB

MD5
28cfdb6a1cf09c137b79d901c97594eb

SHA1
726675c26cc279b6d5235e50e8ffefcf034cc4cf

SHA256
891fd320efe54191f38a67bb1ddfc8c05073b4d1cfcb4aa55bbce02d02904a05

SHA512
f7be1449bde261d1424ca9fb17ce246cad63af12653561bba6a4c4d417c81245651adbf114068dae48b9dc102b0834054f93ebc240a56a3cacc15bff612de768

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000011001\529e91905d.exe

Filesize
1.2MB

MD5
79505c49279783effb3d57a4ffa5773a

SHA1
41d8444f6d378facb27dc2cd8cf115a04f0ea623

SHA256
db781d846cc58faa360bdc2aa2fc2c926341b11356536e82488cb59f61087bb9

SHA512
8c59fa5d583abc3b4dcffc209b2722857eebadd4d339b8f3ee6530108b28924f9ceb952114d5109046d7a02d241a415a31bfbc974526ebe35e1bbb4eff8a6bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\GDHIDHIEGI.exe

Filesize
1.8MB

MD5
41fa2170dd510e4aed6937b9b23a8a4f

SHA1
60084635c8a62c233b1ba076a76634787858f90f

SHA256
3512709136149844d1ddbf098359b61a6b758d7f093187b480e21342102af65f

SHA512
f5a62bbad485845e86a7ca33d5d1856e6169fa5d13cc2f6af0b616e73468faaed45c04f30c805a8c42a56d8d4f0cc7f59eb92fc9d44f1b2c12b3fb6f896ae931

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
ed8b9c3f2d5ef71c35bae125987a9323

SHA1
b721ff1eaf68cea9cc2e09191106d4c2211ba510

SHA256
5e248748316581a77142d911bf1ea6831018e2e76fc15ce0cda5d527519407e5

SHA512
598b802cbd65bf130957b86de15b76d67c7e11d661fe33dfac5e22bb9071ee76a833698867567cc0057c25d57644781d35c4ead2d8a6fa6a9097d1c0af0ec083

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\datareporting\glean\pending_pings\5096dd33-06d0-4286-a8f6-6fa911515977

Filesize
13KB

MD5
ac8bd3e573b052aae54e8b9eefd97e3d

SHA1
9543e67dcd983d4f8345c9146cd58dcf4274680b

SHA256
de70122db8d1468854dcb9f4c51cbc5bf2f8e6d4ac178257cc590651b73a4bbc

SHA512
537511f24b80a3be3a78eb9fe5961868119c0dfc79412ef2d56745ecc4675bc577a6aa0bfa7c5dee2babd4ee80d9aaed54c11b019579c4f17c2b9d7b9b2cb1f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\datareporting\glean\pending_pings\bdcb9d2e-f85d-45a3-be06-2b2f2de3d8bd

Filesize
745B

MD5
c0a1affe39a5485d569ad9b6c99c8c86

SHA1
51c71f6ea0b74b9fd6f48ed84f9d1d9a299ccfca

SHA256
be723341a55efa74db74983f2e785d16158b17b43ff63997cfa12d627d597286

SHA512
ce62538ee013bc5e5461b1aa433f0a21edcf6d1d30368895dbab266152f17eec25130598bf041a0835088490a4b48964505abf6914c348d1f387eed51e28ae13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\prefs-1.js

Filesize
7KB

MD5
1821962287a6a09c37f63949094e9939

SHA1
aea8cdb0ea93bb5e7edf88a0dccfa5f74ff28f76

SHA256
a04e3dc4b997a9c5494d66194660778b4925cd26a2517a2f69bb2c166bd63c43

SHA512
1f1bfb8d6a26a882a373c1f2a637555761c18b2d204412631a9399aeaa2e8569a94aeba17811a8230c46aa9605259b5612da9e6552fa3054ff13703502eb701a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\prefs-1.js

Filesize
7KB

MD5
7c4592b1040f29d1ed580715cc28323c

SHA1
b7674b693ac50c1b4dfcc3921f71f7538efa3fcf

SHA256
558aad72ee2b03b8537787b60dbc721cd3ec26acf11c5bdccf6147df7e13052d

SHA512
909bbed8179717ed2dc062bf50ed4b96f6332c4217e0d90f99c2628c5afc7383807ca46b2d7862e135258084f4ae7b69635d293b49a5385018d534f7b4a574ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\prefs-1.js

Filesize
6KB

MD5
cd40a59e7314ead5e290c622b03eb757

SHA1
eacd1c70a0dbda9496fb1b62ca94d5ebfd557db3

SHA256
aad33ebb48fe75de1c4ce574061d725ae194c3f21bdbd37c4b4eea85c086a09b

SHA512
dc47905e3f86cd1741e7c1cd96b9bc2bbd5d5878389f023cd4f280fb79088ec1b543f9ae076f70c9adb47909edbb2fbe07066d8fe5d117d6d2a332c4a3852ba9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\prefs.js

Filesize
6KB

MD5
6bff76f741f2aca8cbce12667f8df876

SHA1
e6bb9040516da9aaa78132a0521adbda3c2bf0b5

SHA256
2c5a2ab3d806adeb27948a0bcc48ecc491b1c101ad5d46cacbaa799a4c869cd7

SHA512
fcc70d456dd13eeaaa24ac9f39062be01829ac5066d21de3a613d9a517bf7c5f4d911c6b9669adb185e2a0277f75093c2cfa84ff8fe09ee2c10093ca23c1d0c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\62jv3uqp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c9d015c661faba343f8612bd330a33cc

SHA1
608a95a89d0aa083fdf5785aca0bd91cc0401843

SHA256
17b90ecedad4e48b5e90069a633523478c67b4812e347b133c0e90a73ef59625

SHA512
e232840ddb737fa724462b3de3fba88564d5cad9c725d2b401274e2b45c978c270124e27824c848fea7a245272da284809de38ccfa1b9a585e01b464eec910a8

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/1812-0-0x0000000000A70000-0x000000000164F000-memory.dmp

Filesize
11.9MB

Download
memory/1812-66-0x0000000000A70000-0x000000000164F000-memory.dmp

Filesize
11.9MB

Download
memory/1812-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1812-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2052-141-0x0000000000210000-0x0000000000E09000-memory.dmp

Filesize
12.0MB

Download
memory/2052-139-0x0000000000210000-0x0000000000E09000-memory.dmp

Filesize
12.0MB

Download
memory/2232-138-0x0000000006BC0000-0x00000000077B9000-memory.dmp

Filesize
12.0MB

Download
memory/2232-421-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-304-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-303-0x0000000006BC0000-0x00000000077B9000-memory.dmp

Filesize
12.0MB

Download
memory/2232-298-0x0000000006BC0000-0x00000000077B9000-memory.dmp

Filesize
12.0MB

Download
memory/2232-297-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-426-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-156-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-136-0x0000000006BC0000-0x00000000077B9000-memory.dmp

Filesize
12.0MB

Download
memory/2232-116-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-425-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-394-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-424-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-406-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-409-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-414-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-322-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-422-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2232-423-0x0000000001200000-0x00000000016CE000-memory.dmp

Filesize
4.8MB

Download
memory/2928-81-0x0000000001350000-0x000000000181E000-memory.dmp

Filesize
4.8MB

Download
memory/2928-114-0x0000000001350000-0x000000000181E000-memory.dmp

Filesize
4.8MB

Download
memory/2928-230-0x0000000001350000-0x000000000181E000-memory.dmp

Filesize
4.8MB

Download