amadey | 88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/07/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.1MB
Sample240717-ejg4psvdpk
SHA256 88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca
MD5 9ab68ef496dc8989b5cc7f5397298529
SHA1 410ba11d1025142dcd2238e7c4e905a543fafdd6
SHA512 dba4a4f1db9d9ac254e26d5729f0acc7ac6d5a4b2c1236bde52586f280877b50d153075c22ff41bc8e7cc016c73c577d8abc171a925b5918055d5abe7c69f95d
SSDEEP 24576:B3eWhI+8Km/oikwjmZM2wv3bHi2ZdiXxWTpvFInaqLMxx:B3eWCkHm2wv3bCSdiXUFvFIxAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	EBAKKFHJDB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	EBAKKFHJDB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	EBAKKFHJDB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 4 IoCs

pid	Process
616	EBAKKFHJDB.exe
1932	explorti.exe
2400	3918545757.exe
3064	1c9cde84f4.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Wine	EBAKKFHJDB.exe
Key opened	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Wine	explorti.exe

Loads dropped DLL 7 IoCs

pid	Process
2072	file.exe
2072	file.exe
2456	cmd.exe
616	EBAKKFHJDB.exe
1932	explorti.exe
1932	explorti.exe
1932	explorti.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0005000000019267-148.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2072	file.exe
2072	file.exe
2072	file.exe
616	EBAKKFHJDB.exe
1932	explorti.exe
2400	3918545757.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	EBAKKFHJDB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2072	file.exe
2072	file.exe
616	EBAKKFHJDB.exe
1932	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	firefox.exe
Token: SeDebugPrivilege	700	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
616	EBAKKFHJDB.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe
3064	1c9cde84f4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2072	file.exe
2400	3918545757.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2456	2072	file.exe	31
PID 2072 wrote to memory of 2456	2072	file.exe	31
PID 2072 wrote to memory of 2456	2072	file.exe	31
PID 2072 wrote to memory of 2456	2072	file.exe	31
PID 2072 wrote to memory of 2488	2072	file.exe	32
PID 2072 wrote to memory of 2488	2072	file.exe	32
PID 2072 wrote to memory of 2488	2072	file.exe	32
PID 2072 wrote to memory of 2488	2072	file.exe	32
PID 2456 wrote to memory of 616	2456	cmd.exe	35
PID 2456 wrote to memory of 616	2456	cmd.exe	35
PID 2456 wrote to memory of 616	2456	cmd.exe	35
PID 2456 wrote to memory of 616	2456	cmd.exe	35
PID 616 wrote to memory of 1932	616	EBAKKFHJDB.exe	36
PID 616 wrote to memory of 1932	616	EBAKKFHJDB.exe	36
PID 616 wrote to memory of 1932	616	EBAKKFHJDB.exe	36
PID 616 wrote to memory of 1932	616	EBAKKFHJDB.exe	36
PID 1932 wrote to memory of 2400	1932	explorti.exe	37
PID 1932 wrote to memory of 2400	1932	explorti.exe	37
PID 1932 wrote to memory of 2400	1932	explorti.exe	37
PID 1932 wrote to memory of 2400	1932	explorti.exe	37
PID 1932 wrote to memory of 3064	1932	explorti.exe	39
PID 1932 wrote to memory of 3064	1932	explorti.exe	39
PID 1932 wrote to memory of 3064	1932	explorti.exe	39
PID 1932 wrote to memory of 3064	1932	explorti.exe	39
PID 3064 wrote to memory of 3068	3064	1c9cde84f4.exe	40
PID 3064 wrote to memory of 3068	3064	1c9cde84f4.exe	40
PID 3064 wrote to memory of 3068	3064	1c9cde84f4.exe	40
PID 3064 wrote to memory of 3068	3064	1c9cde84f4.exe	40
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 3068 wrote to memory of 700	3068	firefox.exe	41
PID 700 wrote to memory of 2712	700	firefox.exe	42
PID 700 wrote to memory of 2712	700	firefox.exe	42
PID 700 wrote to memory of 2712	700	firefox.exe	42
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43
PID 700 wrote to memory of 2588	700	firefox.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EBAKKFHJDB.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\EBAKKFHJDB.exe
    "C:\Users\Admin\AppData\Local\Temp\EBAKKFHJDB.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\3918545757.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\3918545757.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\1c9cde84f4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\1c9cde84f4.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.0.1255829199\178247347" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c05a3b-e72a-4ba3-9e2f-6fd3ab3af623} 700 "\\.\pipe\gecko-crash-server-pipe.700" 1292 116d9e58 gpu
        8⤵
        
        PID:2712
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.1.1048736593\145613958" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f270bb0-389a-44d4-ac4b-fcfe70112588} 700 "\\.\pipe\gecko-crash-server-pipe.700" 1496 d71658 socket
        8⤵
        
        PID:2588
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.2.1456596158\1447662737" -childID 1 -isForBrowser -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27aeedb6-ab4f-4388-91c5-af1ed29a9aae} 700 "\\.\pipe\gecko-crash-server-pipe.700" 2120 1a2af958 tab
        8⤵
        
        PID:284
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.3.1547593327\1097678950" -childID 2 -isForBrowser -prefsHandle 2940 -prefMapHandle 2936 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cc8928f-f3ff-457e-b5b8-42e06100f16d} 700 "\\.\pipe\gecko-crash-server-pipe.700" 2952 d62558 tab
        8⤵
        
        PID:2360
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.4.22968711\589069355" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 1068 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f908ac58-2f81-4c10-93ec-2b3115ca3fe6} 700 "\\.\pipe\gecko-crash-server-pipe.700" 3776 20062b58 tab
        8⤵
        
        PID:2528
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.5.1225087724\1928544476" -childID 4 -isForBrowser -prefsHandle 3892 -prefMapHandle 3896 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98111d0e-3e1f-4f81-871e-848de609cbab} 700 "\\.\pipe\gecko-crash-server-pipe.700" 3880 20063458 tab
        8⤵
        
        PID:2896
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="700.6.659795158\897799474" -childID 5 -isForBrowser -prefsHandle 4056 -prefMapHandle 4060 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e469b7cb-5f78-446d-becc-254931bf70e8} 700 "\\.\pipe\gecko-crash-server-pipe.700" 4044 20065558 tab
        8⤵
        
        PID:2948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BFIJKEBFBF.exe"
  2⤵
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp
Size 27KB
SHA256 3256d76f1ef9d6abbf75d00ea3f04cbdbdfde14b5a7d9fa9c9adf9392ec8fc73
MD5 e984306b57258e858118970332ba31d9
SHA1 b9f383e3fbc3f3526734b6adc102a13efdea2285
SHA512 8f8761e24faa8f4cb36e0522cd62051ef7f0a5c7face87ae11e0e0a9fa96c90be03bdbf01b5edbeb6dba7d3e91aeee4469efde574828af4af9555ac03eb132fe
SSDEEP 768:rNmUAEPKV3fZnP1/AGpgAFY8NydNCG05l:5mUZKV3xP1/LgBWVz
MD5 SHA1 SHA512 SSDEEP

Submit Download

3918545757.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\3918545757.exe
Size 1.1MB
SHA256 88a73f617072b319fd87cbce1a0874c705ef077fcc0bb09a7037f9762368a0ca
MD5 9ab68ef496dc8989b5cc7f5397298529
SHA1 410ba11d1025142dcd2238e7c4e905a543fafdd6
SHA512 dba4a4f1db9d9ac254e26d5729f0acc7ac6d5a4b2c1236bde52586f280877b50d153075c22ff41bc8e7cc016c73c577d8abc171a925b5918055d5abe7c69f95d
SSDEEP 24576:B3eWhI+8Km/oikwjmZM2wv3bHi2ZdiXxWTpvFInaqLMxx:B3eWCkHm2wv3bCSdiXUFvFIxAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

1c9cde84f4.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\1c9cde84f4.exe
Size 1.2MB
SHA256 fbdd974a0c3fd11ac9428cc2c063b87d91b8e94dc4982e8c1a34b038c4cce60d
MD5 f4fd8ba47af2817710e14132081f2ecd
SHA1 f9b3fbcca8fea4d052e8e0c94faa1485d240e99a
SHA512 dd1d9beb8190dcc45c0ed09fb91ace02a9f131067e5e185d7a737f65aca5ab7343e20c337cf4331c102cf3cc4f66d87d7a287e5482ec0099023a3de9d32e1c6d
SSDEEP 24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aLE2Sbly7TWEPje:UTvC/MTQYxsWR7aLE2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 9b5f4bdd8d4eeec850efe23e09d3a2a2a4b6b29cb760bd844fffc934e124a46a
MD5 3376ccd7e0c83bbffd0289f6af2785f8
SHA1 187a4e7b096f0a8021e09b8d1f53c0ff062440e9
SHA512 a6ccee7833b31f5072d751511494ea254831051a665571a7a4a7952fd23e83caa6153e45c72841e9722cfb6cef7246a0fe5c0f2daadc8ae5578122c97da55e85
SSDEEP 192:A2vTbtgJWcOmQPsSe4EaGTJSZbPbsbqb6CbrbPbubQ6Zxg4SMYgB:FbtgJPOmQPsSe4EaGTJYbPbsbqb5brbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

873e6b73-f9c8-43ed-a34c-eb501910da7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\873e6b73-f9c8-43ed-a34c-eb501910da7a
Size 733B
SHA256 1a00e07033134676103ccf4474730a859a8d029b30edb9810e93ddc8c5f841e1
MD5 bfdebcfd7e13bb5f286a60a5824a5108
SHA1 ec404cb93e912c6e08ed5e518f5a07444e2155b1
SHA512 011532bf2746856bb81fe24cd7be74d03c0c90ecb0eadcbbcc480f5e93fefba01af414c8f8c20772264019ab6ba8a662e55c413c95b24006ae2dfb8607afa490
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js
Size 6KB
SHA256 c123a15bb192844787a081f6ab8c148934bca06c9404ff5079897b0e932271d0
MD5 0e116488666e703cee724188075f73e6
SHA1 d1dce0f4143e4baa57d9b7613b806b30056ce615
SHA512 d39493c1907fba60aebd3cb678fadf1e8138e0537a370e134944256388185326cb8001984ec3beb7ea57ce0c6907c9255f7af709a3b9c6010ab83865b179e683
SSDEEP 96:xHZc5nUTeqGqsd3zteOTzSyPXAnpjsWIH9OQ6kKGDBw8HCj:Hc5nIRsd3ztekPXT9ZHKGDBw8Hs
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js
Size 7KB
SHA256 e4da47418a55fe236c7964eb13befa5307665b4eb0b565b6054d1c6f1af40f40
MD5 0e7f4f90595feb8c4db44665e55b589c
SHA1 3fc779d8baab3e8e7b7d62dd15e2c4e982f6a3be
SHA512 fa118e7088a6ea5a7d702174ede11f5d7e7fe24f0b62e33485149d10886b08d4968860238e18e3a123febb0da75512b36671202e00721b4c18714662ee5becd0
SSDEEP 96:xHAc5nUTeqGqsd3zteOTzSyPXAnpjsWIH9OQ6kKGnBw8HCj:Oc5nIRsd3ztekPXT9ZHKGnBw8Hs
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js
Size 7KB
SHA256 f54386ecaa42c3618069fe870e98c25b19961f41a9053d62735cd5decdf0c406
MD5 175415b04e97e3150434d35651b4eb9d
SHA1 b16cc064b996530078269f946eb25414c33c7b4d
SHA512 672100a2256249c6fe44c62c5d5ce75849519f461b0b7e087677a7fccaf8ab704d15a2d26d23535c156480d3217dc7d32a3d5e99712ffd74647c4dee35aa777a
SSDEEP 96:xHAc3nUTeqGqsd3zteOTzSyPXAnpjsWIH9OQ6kKGiRBw8HCE:Oc3nIRsd3ztekPXT9ZHKGiRBw8Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs.js
Size 6KB
SHA256 de9bfc53eca1a7716547f8db0ec17e6e89e593c7878f128b4d3d98753926f622
MD5 4b1ca0c0c092bd61b027d0528e33f1cd
SHA1 8432b14f79fe296f713026344bbd55ecefd85cec
SHA512 abd2d5940c1ecd81a658eacf75f18779f76a80592ed064f93340e5346680922a01a3ee9b39629c7f9a155d83e5ffd7cbb42597be38faab1bd27bd895ab543b4f
SSDEEP 96:xHZc5nUTeqGqsd3mHeOTzSwPXAnpjHH9OQ6kKGdBw8VCj:Hc5nIRsd3mHemPX29ZHKGdBw8Vs
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 702daa217f2c80d713583f7ad9b6ac6419e11f56ef534c2db4acb5a135af194b
MD5 19e442eedf5a0c843f33661e9d3aa19a
SHA1 b433900694a9a25dca65e7d192ec20911f82c4d2
SHA512 7edbc070105710c55217704ce3382ca7e3cc88bbf57ff4d2eae63403fbaacc3a575f1b4ca057c4033872d59390c89b1e3894d89ae6337b7fc36e7a5a399ed579
SSDEEP 96:6zQF0fInxRelEGJF7GtFM7k0zf8W8Qge3ZwS20X86HK3p:WQiczeCiFAFM7kcuemgXPq3p
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBAKKFHJDB.exe

Path \Users\Admin\AppData\Local\Temp\EBAKKFHJDB.exe
Size 1.8MB
SHA256 5f604c9dee557d923eb3154fa0e6a2265f9ba440fd7e4a2ca1d58559516d5667
MD5 df7944e35afb3a8f0c3ac3846fba8b4a
SHA1 4cdeaa78a2e8a2d077ff1ad879a523ea9c651ba9
SHA512 2fa602d8d618d8c36fe3680645e085877041a77f43560b10f76b044ea64ccffd50bba7861a394f0d2a2f67bae4b64e1d42b6bf4408ade63f84f442be3ec2b4af
SSDEEP 49152:Sof4h1zzMyC2Nz2hJLLpg5B4MdUGqQdts+:dfazwyjqhp2fSy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/616-115-0x0000000000A60000-0x0000000000F13000-memory.dmp

Download

memory/616-116-0x0000000006AD0000-0x0000000006F83000-memory.dmp

Download

memory/616-281-0x0000000006AD0000-0x0000000006F83000-memory.dmp

Download

memory/616-95-0x0000000000A60000-0x0000000000F13000-memory.dmp

Download

memory/1932-138-0x0000000006DA0000-0x0000000007331000-memory.dmp

Download

memory/1932-117-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-425-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-307-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-233-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-139-0x0000000006DA0000-0x0000000007331000-memory.dmp

Download

memory/1932-419-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-291-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-288-0x0000000006DA0000-0x0000000007331000-memory.dmp

Download

memory/1932-402-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-418-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-282-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-417-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-407-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-381-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-406-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-392-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/1932-394-0x0000000000340000-0x00000000007F3000-memory.dmp

Download

memory/2072-0-0x0000000000960000-0x0000000000EF1000-memory.dmp

Download

memory/2072-1-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2072-61-0x0000000000960000-0x0000000000EF1000-memory.dmp

Download

memory/2072-64-0x0000000000960000-0x0000000000EF1000-memory.dmp

Download

memory/2400-140-0x0000000001130000-0x00000000016C1000-memory.dmp

Download

memory/2400-143-0x0000000001130000-0x00000000016C1000-memory.dmp

Download

memory/2456-94-0x00000000020B0000-0x0000000002563000-memory.dmp

Download