amadey | 48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23/07/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
Size 1.8MB
Sample240723-d4jbtsvgld
SHA256 48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e
MD5 e0e2f68f326a6fff31957eb78a24533e
SHA1 54e89a7fbaa6c156a27ee66b0d80634d9e67809c
SHA512 8ba6961fabcf006e7618ea68e0db1e120b0b26b877e223b83809eb92dcc1ea536af3aa1d56c767676b16486109d245d20870e43cb49ed5ccc4a8baea90d0cadd
SSDEEP 49152:3pzmUs0yliNt8whKkvoLUPBa4DCN642ET7QsXO:Iw58w8kgL+a4elpQs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d sila evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

sila

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
4920	explorti.exe
5940	explorti.exe
784	5633803544.exe
3908	538ad4d92b.exe
5452	explorti.exe
5412	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Wine	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
Key opened	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Software\Microsoft\Windows\CurrentVersion\Run\5633803544.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021001\\5633803544.exe"	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa81-50.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
4920	explorti.exe
5940	explorti.exe
5452	explorti.exe
5412	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1000	784	WerFault.exe	86

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
4920	explorti.exe
4920	explorti.exe
5940	explorti.exe
5940	explorti.exe
5452	explorti.exe
5452	explorti.exe
5412	explorti.exe
5412	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe
3908	538ad4d92b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4920	4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe	83
PID 4740 wrote to memory of 4920	4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe	83
PID 4740 wrote to memory of 4920	4740	48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe	83
PID 4920 wrote to memory of 5448	4920	explorti.exe	85
PID 4920 wrote to memory of 5448	4920	explorti.exe	85
PID 4920 wrote to memory of 5448	4920	explorti.exe	85
PID 4920 wrote to memory of 784	4920	explorti.exe	86
PID 4920 wrote to memory of 784	4920	explorti.exe	86
PID 4920 wrote to memory of 784	4920	explorti.exe	86
PID 4920 wrote to memory of 3908	4920	explorti.exe	90
PID 4920 wrote to memory of 3908	4920	explorti.exe	90
PID 4920 wrote to memory of 3908	4920	explorti.exe	90
PID 3908 wrote to memory of 1576	3908	538ad4d92b.exe	91
PID 3908 wrote to memory of 1576	3908	538ad4d92b.exe	91
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 1576 wrote to memory of 4948	1576	firefox.exe	94
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95
PID 4948 wrote to memory of 4960	4948	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe
"C:\Users\Admin\AppData\Local\Temp\48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
    "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\1000021001\5633803544.exe
    "C:\Users\Admin\AppData\Local\Temp\1000021001\5633803544.exe"
    3⤵
    - Executes dropped EXE
    PID:784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 1340
      4⤵
      Program crash
      PID:1000
- - C:\Users\Admin\AppData\Local\Temp\1000022001\538ad4d92b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000022001\538ad4d92b.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1860 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8547b873-f466-46e3-a57a-d2545cb9d90f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" gpu
        6⤵
        
        PID:4960
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff404da4-8a03-43bb-b614-6d99108ea8f2} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" socket
        6⤵
        
        PID:888
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21036cdf-764e-4e31-9042-902263dcf348} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" tab
        6⤵
        
        PID:1304
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3140 -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18f73ea8-0026-4efa-b689-09bea8480ab9} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" tab
        6⤵
        
        PID:4532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3000 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4244 -prefMapHandle 4240 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f79f5359-2217-4c7d-9f0f-2a123ee9467b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" utility
        6⤵
        Checks processor information in registry
        
        PID:4584
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 3 -isForBrowser -prefsHandle 5668 -prefMapHandle 5664 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4af85487-1997-41da-bc2b-ca94db37307b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" tab
        6⤵
        
        PID:2248
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 4 -isForBrowser -prefsHandle 5820 -prefMapHandle 5828 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6407ac29-2127-4f66-98f0-0d3bd47f5414} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" tab
        6⤵
        
        PID:2212
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5984 -childID 5 -isForBrowser -prefsHandle 5992 -prefMapHandle 5996 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c21b9ed-2590-4693-a651-ebb485e7a630} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" tab
        6⤵
        
        PID:5668

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 784 -ip 784
1⤵
PID:5784

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5452

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 8e6d624ed65663e2badb5bfeac1a9de0850e540c2dd7ba3c06c28544b08c4ffb
MD5 41d11f52c0445689bc5b7b9f9aa3a543
SHA1 4807a38502ae9581395383eafa7a49f0743c69b7
SHA512 64f5f43d4691748054dc553346b47fedca2bdbb846a111ecbdcb9d8026f8d7c216cca5479217d41fc38d1f4fcdd0a9ae02a025050ef0dbf34002008decb30466
SSDEEP 384:iRja+q0qmj5Jc6+lyrXVnS/DLjhTcz2SKmyaE:iYJI8QDVCbh62SKmyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 986fefdb986826848cb6ad08899f63db3975469ec2a53604c6ec21ef50f59ba6
MD5 9e426c46db22fdbdc47f4ed029d5b7c9
SHA1 4b319623b5ffc032d6b4977fa2b3aed32c52653c
SHA512 ecf9ed5e264d71e8715aa2dffab145a59603de577bd77ba3023e46f9b8fc8ab02bdc40ea2a8e5486392c38015a5aa4c049e868b06f41eb155fc5226877cd725e
SSDEEP 384:H485u9fiGLm4pUKft2WlOX8lPLZZB7t0lpDIIfTc:nUBi8mCUKft2WAX8tzB7eD8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

5633803544.exe

Path C:\Users\Admin\AppData\Local\Temp\1000021001\5633803544.exe
Size 199KB
SHA256 18b8662e5d0b1f00302bbe26ddb5fa099da34a0d3255180d2358d6066bb42348
MD5 4ee0b6214eb06ae32de0773dc4e5e30a
SHA1 4c1bcf6f93fd67a82d1bac890df32ee82027af32
SHA512 5f2e2cea8ab75c0b2d79b0466531787beb2ca234e7e1b32d505fb61aa5a5843226847874e7ae890cce061b5de40b24567bd9d00a8eec08c827209e375f50aed9
SSDEEP 3072:EeL8OLdNnLtzJm+YVH7o6Y68I4/qW2Hh2GV1Rae5AB6OQQX0I85lT6OcW:vL8+nBuVH7jyIfVvPbJTIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

538ad4d92b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000022001\538ad4d92b.exe
Size 1.2MB
SHA256 560fb71feb7abad3bec0b88e3ff170f1ea0dad82f717b2c5f2739553973682f5
MD5 88ea6cd6c7c2f278a05067d3727250e8
SHA1 a9a9147048637cbc4ab69ed9f91162f5cb8c6b70
SHA512 1829a1e985469acc06d2ab24c62ef5f4a6774563978c84a4a9acaa72b8aeb66d28ada338ec9168efe92e438d9179c114c9256019557d957d88bf59249c3ecda6
SSDEEP 24576:33qDEvCTbMWu7rQYlBQcBiT6rprG8aLs2Sbly7TWEPje:HTvC/MTQYxsWR7aLs2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 48c452384ef38cf45d25a69ff42712a7236f523b6f2f5715988c325c0e177d0e
MD5 e0e2f68f326a6fff31957eb78a24533e
SHA1 54e89a7fbaa6c156a27ee66b0d80634d9e67809c
SHA512 8ba6961fabcf006e7618ea68e0db1e120b0b26b877e223b83809eb92dcc1ea536af3aa1d56c767676b16486109d245d20870e43cb49ed5ccc4a8baea90d0cadd
SSDEEP 49152:3pzmUs0yliNt8whKkvoLUPBa4DCN642ET7QsXO:Iw58w8kgL+a4elpQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\AlternateServices.bin
Size 12KB
SHA256 fc65020b9f72ba2fea12b0c762c37d56523e7ce920b5272535789a618a53e72e
MD5 a12ad153cf29432ddb14b58921ed7df5
SHA1 df99e64c1bd8245cd94955e0d3cd02b97a442cc2
SHA512 a14f8a4293fd06fbc327c172db3aba7bfbdea0ef062e27250626a8bd4ccbab195e83b6e037fd9ac7187b11ceb6890c77b81ce1b14bd7a3b2272d7af0d146b8d3
SSDEEP 96:335oJebOJ33blpebvpf+33b2bq3bvgbgzV3bMkbN3b:335CRuyf7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 4baa78f8246f38743644c61e350f639748b3ef7e756b06c9d25febed8fdc4328
MD5 13cf0485cdd1e270afa5de8bcd387749
SHA1 dcd0606b0bd7e7868824e4e056b0914404c6d710
SHA512 b5b94178e366f814f598c1745dc31856e906a6a1af733d86fb633cfc3236a0d53746551eea76ba9e642ece561818485b29d4fb1e8dab4f67d5cc7f89a9f106ed
SSDEEP 384:F0jow2/95XM+l886PXKP3yYCM/pDECbLcb1wb6bRb9b7babsbYbzX3wlg/66Jozz:Ccw2/nc+lr6PaP3yYCM/pDECbIbSb6bF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 acc2b6da86b13455cf91581938417bd60a1758e71caf7ddbab6e52227f5d989f
MD5 d4b6437bcc0a131f1d0f560ac5dd47a8
SHA1 71ea6afe8275e4133a9b0e893622f4a91d810048
SHA512 eba719f8253dc6f2654391ed996e989319d03c218b4baaa34f8a6891010b11398a95002f4f0c8e5d84439aaf75cd07f5fb0b5e4fcea4c845e0960e95a5fba660
SSDEEP 768:a0XsMaa2iHRDaPSWYCM/pDtvbIbSb1bOb9b7babsbYbqjNcVmm:DsMN2iH2jNcV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 14f440f9dae1092cd4924d51ebdd23f9f2d5cac62d7955fde535c7b0790f7e76
MD5 9c4b8739dc2db295a4c30be1861c25b6
SHA1 c2861e0427116833ff9c58bb14251b71dfcc5d94
SHA512 b12aad1c84248024a7ea1d13f013bd92c8a3b2bc679cd2763ffab0d84037182401ea4f36e318b75c5734d80eb2bdf8eededc6d60a89b0621983f3a08db090d1f
SSDEEP 384:qboqSPS0jow2/95XM+l886PXKP3yYCM/pDECbLcb1wb6bRb9b7babsbYbzX3wlgU:+glcw2/nc+lr6PaP3yYCM/pDECbIbSbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

746a4ff9-f34a-419b-8140-3564f605987c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\746a4ff9-f34a-419b-8140-3564f605987c
Size 659B
SHA256 2f3f28a29234a5a50ef45eb61e248b277b1034219f0f12a6f09c7ac468993e1c
MD5 07f0c4516f358c7ed7b07053d88a858a
SHA1 f2adc5834353e1d38b0b3bf312d173803d9bc68a
SHA512 236e50048048f2c42740a1be004bfbca723664e4863b9455b0b2e72c68cc23f42584111572ff0b0d40be416f79b9b733ce26ad872ecc17278807ccf6440e718a
MD5 SHA1 SHA512

Submit Download

d640fd2d-de09-4892-b454-beeca5b32ae4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\d640fd2d-de09-4892-b454-beeca5b32ae4
Size 982B
SHA256 049faa83a04f03041a283f21cba46a844b01858b4f771549b0017d5ec5bc138c
MD5 9d5b593a3ad12c521fbc4496cd1ad8c9
SHA1 6b65ae63f060c077e36420371453c13871ebb6b6
SHA512 f256a0a17c9ccade50dd6414a0fd704f6f80580665734905b6aca2334134e910c2f9331e8f80e00da23db620d10954d9c72b99e7d42232d2947f8f20c6d898b1
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs-1.js
Size 13KB
SHA256 a36acf8227f8f2fb3247ba8708b622888f5ad60006c5c8a1c3699c5756b601d4
MD5 d3a34f265a0866607ee53d367534efd4
SHA1 0d80b39d2d3e30f35cd76812fdc588a1c795e072
SHA512 5b2ebf524b4d24ff6ef29bd8ab8c984acc1e7cff4255c6fa88c028ef3e0d51814583f73d05c32356d4fe241df8a0deec3ab6ef623684c26f0f2d86214f85c182
SSDEEP 192:z5nNqRDfo/KcNBIWTjVcd8IWTbQHrV607aX32+DHBw8Ht+:OoBFfyyF3QLcBvVwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/784-45-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4740-0-0x0000000000320000-0x00000000007DE000-memory.dmp

Download

memory/4740-16-0x0000000000320000-0x00000000007DE000-memory.dmp

Download

memory/4740-4-0x0000000000320000-0x00000000007DE000-memory.dmp

Download

memory/4740-3-0x0000000000320000-0x00000000007DE000-memory.dmp

Download

memory/4740-2-0x0000000000321000-0x000000000034F000-memory.dmp

Download

memory/4740-1-0x0000000077776000-0x0000000077778000-memory.dmp

Download

memory/4920-2540-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-913-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-392-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-397-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-390-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-373-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2575-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-24-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2569-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2566-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-21-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-20-0x0000000000441000-0x000000000046F000-memory.dmp

Download

memory/4920-2564-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-391-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-17-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2549-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2563-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2562-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2559-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/4920-2561-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5412-2567-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5412-2568-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5452-2553-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5452-2551-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5940-19-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5940-22-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5940-23-0x0000000000440000-0x00000000008FE000-memory.dmp

Download

memory/5940-26-0x0000000000440000-0x00000000008FE000-memory.dmp

Download