amadey | de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20/07/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
Size 1.8MB
Sample240720-c443vswdrc
SHA256 de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e
MD5 c296c9ee0ac3fb1984cc7e9dcd53a016
SHA1 fe6dbe4a61eafb2fd16f3e3c4a018681668c54cb
SHA512 2b9ceb57873676944607fdf39d0b5c6451f510ff09fb9095e7f330a09d250d5240b4f8663faa0a72c52c581bd01478a1bc52d8d0b48079f72b5f7158c5e06d6e
SSDEEP 49152:2ENlirkwanBYzsrbx4MCpW+CekC5rJASINQEh:JrigfBQsiMyRCekGAJN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d default evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
2772	explorti.exe
3420	cdb6d60c20.exe
1432	808b66f68e.exe
2996	explorti.exe
3204	explorti.exe
4028	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdb6d60c20.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000015001\\cdb6d60c20.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Windows\CurrentVersion\Run\808b66f68e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\808b66f68e.exe"	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa2f-44.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
2772	explorti.exe
2996	explorti.exe
3204	explorti.exe
4028	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
2772	explorti.exe
2772	explorti.exe
2996	explorti.exe
2996	explorti.exe
3204	explorti.exe
3204	explorti.exe
4028	explorti.exe
4028	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	firefox.exe
Token: SeDebugPrivilege	3224	firefox.exe
Token: SeDebugPrivilege	3224	firefox.exe
Token: SeDebugPrivilege	3224	firefox.exe
Token: SeDebugPrivilege	3224	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
1432	808b66f68e.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
3224	firefox.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe
1432	808b66f68e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3420	cdb6d60c20.exe
3224	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2772	4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe	82
PID 4048 wrote to memory of 2772	4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe	82
PID 4048 wrote to memory of 2772	4048	de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe	82
PID 2772 wrote to memory of 3420	2772	explorti.exe	83
PID 2772 wrote to memory of 3420	2772	explorti.exe	83
PID 2772 wrote to memory of 3420	2772	explorti.exe	83
PID 2772 wrote to memory of 1432	2772	explorti.exe	84
PID 2772 wrote to memory of 1432	2772	explorti.exe	84
PID 2772 wrote to memory of 1432	2772	explorti.exe	84
PID 1432 wrote to memory of 1924	1432	808b66f68e.exe	86
PID 1432 wrote to memory of 1924	1432	808b66f68e.exe	86
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 1924 wrote to memory of 3224	1924	firefox.exe	89
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90
PID 3224 wrote to memory of 2952	3224	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe
"C:\Users\Admin\AppData\Local\Temp\de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\1000015001\cdb6d60c20.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\cdb6d60c20.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\1000016001\808b66f68e.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\808b66f68e.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3224
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dc4df72-36b9-4676-85a4-951fd2d50327} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" gpu
        6⤵
        
        PID:2952
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc7dc23d-fc03-4309-98d0-873f10a0186f} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" socket
        6⤵
        
        PID:4456
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1704 -childID 1 -isForBrowser -prefsHandle 1524 -prefMapHandle 2928 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99000720-f317-41a7-8bcd-4aac39cd9dee} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" tab
        6⤵
        
        PID:1088
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3544 -childID 2 -isForBrowser -prefsHandle 3536 -prefMapHandle 3532 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83ef58e0-864e-4328-a63d-2ed90136b825} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" tab
        6⤵
        
        PID:1404
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4804 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0b15de3-e52d-4184-a396-6f3c264306eb} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" utility
        6⤵
        Checks processor information in registry
        
        PID:1052
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3352 -childID 3 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d00440a-89e9-4704-a62a-6b9c099ac2f2} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" tab
        6⤵
        
        PID:3084
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 4 -isForBrowser -prefsHandle 5708 -prefMapHandle 5712 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {510ae66b-5dab-4f63-97f5-d082d859a18d} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" tab
        6⤵
        
        PID:1224
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5988 -childID 5 -isForBrowser -prefsHandle 5908 -prefMapHandle 5916 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e357ccc0-4266-4fe3-8a2b-0d9154aa7474} 3224 "\\.\pipe\gecko-crash-server-pipe.3224" tab
        6⤵
        
        PID:4492

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2996

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 72e2aa02a3f7ded0dc9414f25efabdcae0ab09f5052f623cd76424dec236f3f0
MD5 4829f8fe0f568684fcfde8002c5dbda9
SHA1 9543a4d77f1968ffec065f69598ff4f1bb3a79b4
SHA512 16bedcdf4c50dd1c3b622626bf069caf3141e16f40849c8d42d018510bc29dc8826a5be7910440f26afd911b0243c5c359ec4439ddbbb1e46b58e513f30422ee
SSDEEP 384:9J/ZCk0JJteLtrfGxA5oZv0gYhBqGRZpxZ5Cmk30VUyaE:TBCLXeN8NNE3gCqyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 106384c65b08e5a8db9ed9d32329fa08368f62cc3521472ca89bc8d9a520f754
MD5 860480151e2a7b44ca0f6396ffda0077
SHA1 c5b7b5240202b950e4b2695af17fe001af9f48d2
SHA512 5927871358c17938d17814c646cbb33545703704f805a844403f4010e8cfca032b24a5d760c5ea146568a6889fe9fb4087526197d97b0a2eb5c5d7efef150f77
SSDEEP 384:H485u9fiGLm4pUNft2WlOX8lPLZZB7t0lpDIIHPI:nUBi8mCUNft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

cdb6d60c20.exe

Path C:\Users\Admin\AppData\Local\Temp\1000015001\cdb6d60c20.exe
Size 679KB
SHA256 a04eed72375bdd8a6ce118e30e79cf6dc4618e4c748873c0da29cf0e9f9f031c
MD5 6ab4c3608fa8ddc687eab56f7eb527a8
SHA1 4e416fa39b139eaf9cdc29e2d7346541561aa11b
SHA512 05b9ede5f71fbb5d1ccf319c804fa63965bb98c13273b51928e0295ec4746d879a3d6e7657a0bfe8f79a1503dd01400e23265092b81474462fcc47c094f591ed
SSDEEP 12288:+3XWClo7YNQSTLLxez8dFlZqBjEG6umSyY6+FD7cb48A2cDwZpC:+WCmwQLz+8ziY9Fsb48A2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

808b66f68e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\808b66f68e.exe
Size 1.2MB
SHA256 9d3f70e99c2b3ac6ab8600c6abf759403beb272815e60a08967f122b350184b5
MD5 ed3d5563743c75395816d88984e32311
SHA1 0e7af686a5b3ea8611d6389d1d14f29ed63a00fb
SHA512 c45b9c5b6b81ca6c12ad236b07f5bbb21314de7ce4b479d9544dd6060639e942d990a6b49cf98a9bef5912844b641ff23c3854a9ba7983c0b31da26e99ab2f57
SSDEEP 24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aLk2Sbly7TWEPje:VTvC/MTQYxsWR7aLk2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 de2f3b21830228e66a0d8f3d345985bcb3282255c221cf7a47cafb7ff5b9472e
MD5 c296c9ee0ac3fb1984cc7e9dcd53a016
SHA1 fe6dbe4a61eafb2fd16f3e3c4a018681668c54cb
SHA512 2b9ceb57873676944607fdf39d0b5c6451f510ff09fb9095e7f330a09d250d5240b4f8663faa0a72c52c581bd01478a1bc52d8d0b48079f72b5f7158c5e06d6e
SSDEEP 49152:2ENlirkwanBYzsrbx4MCpW+CekC5rJASINQEh:JrigfBQsiMyRCekGAJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin
Size 12KB
SHA256 3a7369ba01bb685f6193f33b40b7c025efecd6244b362b44a010d2f21a7ec80a
MD5 c96b9a7b4e69361a71d1d2e5881bf4f9
SHA1 7bc8287c22e3bc062330d89ba47398f23242cf15
SHA512 7494e50c9704e3d26629271cf3c5407569514038ad2b3c1381e8bcc918324bb63bff14d36bd1d6de9e7fc058f89011cc5ac3a844c034f9a9faab1be1f32c6012
SSDEEP 96:y5o7ebOJ+bmpebvpf++bLb7b+gbgzgbAbQb:y5wu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 148444cbce078f368d3210e6ff945d96fac4489e3009cd641ce8e717088e165e
MD5 7ab8ac7be0ecf6a3af1ba0beed3379de
SHA1 feca74d31036c7c1fb4499723b2a60b6cc473915
SHA512 615192cd1428f9ea70ca8e018d00aa9da0c40c7210ecd6e5a2ba80b198c09043840fe59283e818ba797b92c6552b7f8aea573f694fa29ab62fe3a4fc0b009504
SSDEEP 384:U/66JozQzgC1bgboKUPd1JuxKzhyDbg0P60+iep3EmCtblbRbvbLbObtbGbobAJs:xmC6DJuxWhyHNP60+iep3EmCtblbRbvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 d6136d170e05a0300ee7d2e1565ac78e93863c3a382d003e10a15ca81c3d2ea7
MD5 8ec1fd426be0df2e0abe7a95dd5af91a
SHA1 7d68aeaa6efebcd80accdd0c24ecbb04c6af5bbf
SHA512 7715054fc0af30afe30dce0644202a3e22e5a9708f411d9ac9f3dd355797e12c510e43db01badd3261b5d92bd3fdca223fe6e09d9bd25647904f76d83c723e48
SSDEEP 384:q1JuxKzhyDbg0P60+iep3EmCtblbRbvbLbObtbGbobAJCD3IHL05boKUPZ/66Jo5:6JuxWhyHNP60+iep3EmCtblbRbvbLbOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 cf91f5f5724d31baeb212b85b7cf9862479e47bddefcb6d2d93783762f18cfa9
MD5 a1fefdadbd04ee8bb33942bdfcc24310
SHA1 47b9ce5f837cd047b914cd451267e07c011f697e
SHA512 88aba8b8168518fb7be3201888bd4f1daac32496a54f52f636199ddc1ad8d52df6e96b7beb6a4e31cd2faa1f6dcd5732201a6765b0e237d88ad7da182772c635
SSDEEP 768:OY0H0NU7+kMD603wep3Em1AblbRbKbObObtbGbobGrzlLoE7mm:cH0Q+kfrzlLoEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

123e60be-83e1-41dd-907a-e5bd9e031a40

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\123e60be-83e1-41dd-907a-e5bd9e031a40
Size 659B
SHA256 30aafb3f83ce79398f76dc00bdf4cb3e207d3123eba98ba9d55e635dd97cfa10
MD5 dd293fe89d31e21851bca68df939a2c4
SHA1 6b42142e77aa909fc4616eece3674d36e68187c2
SHA512 3820d2861bbd008dca37d406984a0811fcb6bbae617c03f26c948e176841fe10232513fed5a8e135abb22c7094541f0546395c7a99100dca8a07ecf81ba06c06
MD5 SHA1 SHA512

Submit Download

6f2ab6fa-6d01-4f83-8afc-ee0114820648

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\6f2ab6fa-6d01-4f83-8afc-ee0114820648
Size 982B
SHA256 e5b3e8746696eb3d7c9166a8a85363d20c699c2756841cb07fcdbcbea1f8e824
MD5 5079cf1e5cbe822fb7e808ed57e90459
SHA1 75aebe9059442380d7cbc4c8bddba707ca80428c
SHA512 05d288dcc2addc382d66d174c0a74965a3f3599b655037c38dd0c3ef62657eed89c8206a440ccbefc6cba816ecf242cc4241ac03b6fddbc61566e6c40dbcf390
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 12KB
SHA256 1990287841b42387acba9a55e98f49b5752df926f45e34c4471ecaa589fc72ac
MD5 ccfa201c72a659f7fa99eb92fc51ce05
SHA1 a698b9f5c871a5f1e9aa8f10ffa612e622bd9de9
SHA512 a62435839577e85e55f085f22bffd243ce0168de5ea0d71c23831ab69d0581c328c969c1ec624c3b944ea5025804ee74e4fc6792515a5fe356affbb2e94e14ae
SSDEEP 192:G5nu2RUfpl3ZUXzQ8D4cd9ztQQHrP60VZaX8d4uIx7Bw8HSz:VZqzQ8x/z+QLC+dV+w5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js
Size 16KB
SHA256 f33db3f04f356a53a2da68d10ee420a9467bcac7f863a7f065788410ec79a84e
MD5 5e8badf3dee5c0a8dbe1f8529caedbcf
SHA1 b2b61c13a119b6514210b04be7690bb03ee9fa02
SHA512 f0d2fbdb8c22a6b02882a59a6e64179b2073441e1d144146f2cf86cd907bc73e3ced09f971dde992afb88532c7871286a4182737c966424dcf1b6b6a14535c69
SSDEEP 192:G2nu2RUfpl3ZUXzQ8D4cd9ztQQHrP60VZaXA+d4uIxriBw8HsZFA33:2ZqzQ8x/z+QLCjdVtwJm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2772-2583-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-20-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2586-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2611-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-358-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-385-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-394-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-395-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-400-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2597-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-21-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2595-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-19-0x00000000007A1000-0x00000000007CF000-memory.dmp

Download

memory/2772-2605-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-17-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2601-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2600-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2599-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-2598-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2772-1335-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2996-60-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/2996-59-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/3204-2590-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/3204-2591-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/3420-37-0x00000000009F0000-0x0000000000FC8000-memory.dmp

Download

memory/3420-39-0x00000000009F0000-0x0000000000FC8000-memory.dmp

Download

memory/4028-2603-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/4028-2604-0x00000000007A0000-0x0000000000C65000-memory.dmp

Download

memory/4048-0-0x0000000000530000-0x00000000009F5000-memory.dmp

Download

memory/4048-1-0x0000000077056000-0x0000000077058000-memory.dmp

Download

memory/4048-2-0x0000000000531000-0x000000000055F000-memory.dmp

Download

memory/4048-3-0x0000000000530000-0x00000000009F5000-memory.dmp

Download

memory/4048-4-0x0000000000530000-0x00000000009F5000-memory.dmp

Download

memory/4048-18-0x0000000000530000-0x00000000009F5000-memory.dmp

Download