amadey | 6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Size

1.8MB
MD5

6f59ce88b52487bba7eb59e81525c4f5
SHA1

83bb1abc3bd3b56bec0a68d6cd0df63bcf975ad6
SHA256

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191
SHA512

985853c822cd92ee4a1f2a04eb63ee4e6692f23144683cf40e5a402e7a81b951acb1d489c0e5292c0b78aab99787f89dabcaec5b25975f706f52c01601293860
SSDEEP

49152:k7FXgGgW5JEKR/99GAdrdKZWILQ5qDjVN:kXQWkK9HFYpQ5qD/

Score

10^/10

amadey stealc 0657d1 sila discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

sila

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 3 IoCs

Processes:

explorti.execf8555c939.exe5480b8354d.exe

pid process

2772 explorti.exe
576 cf8555c939.exe
1316 5480b8354d.exe

pid	process
2772	explorti.exe
576	cf8555c939.exe
1316	5480b8354d.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Wine	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Wine	explorti.exe

Loads dropped DLL 4 IoCs

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe

pid process

2468 6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
2772 explorti.exe
2772 explorti.exe
2772 explorti.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorti.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf8555c939.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\cf8555c939.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\5480b8354d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000017001\\5480b8354d.exe"	explorti.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1316-185-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-192-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-202-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-214-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-293-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-296-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-298-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-310-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-312-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-314-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-316-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-318-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-320-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe
behavioral1/memory/1316-327-0x0000000000D40000-0x0000000001837000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe5480b8354d.exe

pid	process
2468	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
2772	explorti.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe

Drops file in Windows directory 1 IoCs

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe

description ioc process

File created C:\Windows\Tasks\explorti.job 6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explorti.job	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5480b8354d.exe6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.execf8555c939.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5480b8354d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf8555c939.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings firefox.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe

pid process

2468 6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
2772 explorti.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 1560 firefox.exe
Token: SeDebugPrivilege 1560 firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	firefox.exe

description	pid	process
Token: SeDebugPrivilege	1560	firefox.exe
Token: SeDebugPrivilege	1560	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe5480b8354d.exefirefox.exe

pid	process
2468	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

5480b8354d.exefirefox.exe

pid	process
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1560	firefox.exe
1560	firefox.exe
1560	firefox.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe
1316	5480b8354d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5480b8354d.exe

pid process

1316 5480b8354d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exeexplorti.exe5480b8354d.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2468 wrote to memory of 2772	2468	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe	explorti.exe
PID 2468 wrote to memory of 2772	2468	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe	explorti.exe
PID 2468 wrote to memory of 2772	2468	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe	explorti.exe
PID 2468 wrote to memory of 2772	2468	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe	explorti.exe
PID 2772 wrote to memory of 576	2772	explorti.exe	cf8555c939.exe
PID 2772 wrote to memory of 576	2772	explorti.exe	cf8555c939.exe
PID 2772 wrote to memory of 576	2772	explorti.exe	cf8555c939.exe
PID 2772 wrote to memory of 576	2772	explorti.exe	cf8555c939.exe
PID 2772 wrote to memory of 1316	2772	explorti.exe	5480b8354d.exe
PID 2772 wrote to memory of 1316	2772	explorti.exe	5480b8354d.exe
PID 2772 wrote to memory of 1316	2772	explorti.exe	5480b8354d.exe
PID 2772 wrote to memory of 1316	2772	explorti.exe	5480b8354d.exe
PID 1316 wrote to memory of 2636	1316	5480b8354d.exe	firefox.exe
PID 1316 wrote to memory of 2636	1316	5480b8354d.exe	firefox.exe
PID 1316 wrote to memory of 2636	1316	5480b8354d.exe	firefox.exe
PID 1316 wrote to memory of 2636	1316	5480b8354d.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 1560	2636	firefox.exe	firefox.exe
PID 1560 wrote to memory of 1488	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 1488	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 1488	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe
PID 1560 wrote to memory of 2904	1560	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe
"C:\Users\Admin\AppData\Local\Temp\6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2468

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\1000016001\cf8555c939.exe
"C:\Users\Admin\AppData\Local\Temp\1000016001\cf8555c939.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:576

C:\Users\Admin\AppData\Local\Temp\1000017001\5480b8354d.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\5480b8354d.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
4⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.0.458029033\1934487100" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5ff6a35-b838-420e-b237-ebd7b00d25a8} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 1352 e9faf58 gpu
6⤵
PID:1488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.1.689339601\1256593721" -parentBuildID 20221007134813 -prefsHandle 1516 -prefMapHandle 1512 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55718422-f403-4966-9a5e-96f0f363eaaf} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 1528 d6fb58 socket
6⤵
PID:2904

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.2.1306189854\1211908187" -childID 1 -isForBrowser -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 756 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3504eb27-c753-40f5-b7af-92887622b5b4} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 2088 1a797658 tab
6⤵
PID:1512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.3.1844754492\1215028530" -childID 2 -isForBrowser -prefsHandle 2792 -prefMapHandle 2788 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 756 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc7cdb72-cd3d-41d9-a9d5-9221370a9819} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 2804 1c8c3b58 tab
6⤵
PID:2632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.4.1508400976\1741693444" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 3796 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 756 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7008b21-2a60-40e7-bbf2-0156b65a9388} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 3816 1ef55458 tab
6⤵
PID:2964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.5.64792631\487581047" -childID 4 -isForBrowser -prefsHandle 3908 -prefMapHandle 3912 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 756 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e1861cf-8721-4a69-9e80-591b8eb6fa7f} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 3816 1ef57258 tab
6⤵
PID:1628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.6.457879835\279346920" -childID 5 -isForBrowser -prefsHandle 4044 -prefMapHandle 4048 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 756 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6acaf698-73a0-4b5f-91be-8f558c40c88e} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 4032 1e6fba58 tab
6⤵
PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Filesize
1.8MB

MD5
6f59ce88b52487bba7eb59e81525c4f5

SHA1
83bb1abc3bd3b56bec0a68d6cd0df63bcf975ad6

SHA256
6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191

SHA512
985853c822cd92ee4a1f2a04eb63ee4e6692f23144683cf40e5a402e7a81b951acb1d489c0e5292c0b78aab99787f89dabcaec5b25975f706f52c01601293860

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\cf8555c939.exe

Filesize
244KB

MD5
0ef35662abbe44cf6e064cb524b10742

SHA1
e022ebfc8011cdda89bd682001807e87f29de564

SHA256
5adcb9c55cb600170c65b603951ef9b4a9a6e6dd95a7eed765a371bf51d2719e

SHA512
86362e5cfd03a9adfc030bdf3df34d11a8f0a9799615f0204b96167cd1f81986de62f2533800d6d590041bcce7793c62d022e2d623532ad995d582d2ee7b3afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\5480b8354d.exe

Filesize
3.1MB

MD5
3fb40eae7c0427693cbda49e44991c48

SHA1
3edadce6470b902e3f23fc8b8c8ad60fdc7c1cab

SHA256
c9083c30c53f1888e25470abd1bb2de0ce279ba089b2adf275ccde8c28b48020

SHA512
95447b94f120a03c128bb759a39767d40f523d742c9d72bbd9bc3de3aa79f284494102a7c82da7cde0d5e04747badb9f78c1952a6d7012382adb889945a22c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
ab410b7ef58d5edd83d16b6355a48da3

SHA1
6ad422916fa9ae2a3a0c67f71bd41b397a2a70bc

SHA256
0531550762c959e6b1593c335c444deafa4460508a7c9ae8a279ab8bb53420dc

SHA512
e967d002ec3325ffd4c76b045b2c65080abcad37216a95baa869202a9cbe823d5a48ae533939b8ea5739c607c8dfcea9e69217e99c67d6fdcc7a968213205435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\pending_pings\abae38af-3a31-415c-a01d-e9f5a4276680

Filesize
733B

MD5
e8ffcbd41d9eb5981a94b8e02a299e81

SHA1
4ff02bdfa2e57b3fb27167c028e0e9d7525161b5

SHA256
f01d12bbb3de6822a97c00103a29ea076666deded65bee590bb8956b8ce05c6b

SHA512
2f5648ad0fe4dcce8909f9803128f51da16741e63509947ff029adb9c3228d258893ef48e320de2deef2de3570504bd454dc499039685572477e7f83a789b1ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs-1.js

Filesize
6KB

MD5
98bc420b4fd45760b923673c667cc51b

SHA1
8185b123e4380de89f6d1f691d2fabc284966b8c

SHA256
2f592166121f520e2e5cabaf3158e0ea33ade511383b2c72b91a833468eec765

SHA512
10174f9cebae6465aae9f84d94ae35a2b517e3ae7270db9ca0ff3c8a4fb2f5581def442784d01c7b511649e282e23d4425b1715dc67f8056de4fde1d0d973513

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs-1.js

Filesize
7KB

MD5
b01f29dfa28e5cc18a7a5ddf2871847e

SHA1
bc5ea90044dcafc7464bf71ef0718fc1449088d5

SHA256
00a94044200e7dd98577cde7d46378ffbe6eab0b2262484c2748af2db9d771e4

SHA512
c4e51c44cef35c2a95c0b3abd0727ce55c546781bd798eac002a78d55fbd872288f6c62101539d340cbebae20c4a94fae8cb7f63776835d6ef59bbb2078d2742

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs-1.js

Filesize
7KB

MD5
8df24be9088882e6835b0a88b0905215

SHA1
91b988cb4a2d8c087fcc932d70733d5025b2bf27

SHA256
6d109fc485cf8cc91e2af9fe8017a51ed2272b6664347778e9b1b398aac742d2

SHA512
b2fc7b8302d4121faa369f7c4d52c4060c53a68d2bc0274f2fdb56d27e000a3e66c16f0dce9471a6f000aab718a948d31c6bb4a02194c387de5e00cee5fb652f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs.js

Filesize
6KB

MD5
ce05e7a364d01a84144aab4d3a26c4d8

SHA1
234c46423abc92a97926ae852ee90ad59d28c1f7

SHA256
aab59980d07deebc3c6e3900bad856a1ba21cc028087c6a7626cd19ca5120dfd

SHA512
967d6b7cb5b2ba85ce48a188c2745b5fbf9b0ceffab787342752bef4bc416917680066103a999b5d19a56e9bdb40b5cb4c7306af1c285047aa8deda4e3ca1ebe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6c3d64e1668a9e919c943947d5f23a98

SHA1
ae8344fadb56ce9b65aafec61740d63bc02c7b34

SHA256
aba0e5fc26cb90d2dfb4abd909f0af3c3afef58ef98a4f787d9c163022fbd54f

SHA512
9d75341e3d52881690bdf4ce96b430a59a6142956d3c0bb24e2be304321d9bad6fb699602a1eafc8832cbf95553aa2e9d1946afae4e6d021d5717eedb4b4bf6b

Download Submit
memory/576-55-0x0000000000400000-0x0000000002456000-memory.dmp

Filesize
32.3MB

Download
memory/1316-56-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-293-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-327-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-320-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-318-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-185-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-316-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-314-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-192-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-202-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-312-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-310-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-214-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-298-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/1316-296-0x0000000000D40000-0x0000000001837000-memory.dmp

Filesize
11.0MB

Download
memory/2468-2-0x00000000001E1000-0x000000000020F000-memory.dmp

Filesize
184KB

Download
memory/2468-1-0x0000000077D00000-0x0000000077D02000-memory.dmp

Filesize
8KB

Download
memory/2468-0-0x00000000001E0000-0x0000000000688000-memory.dmp

Filesize
4.7MB

Download
memory/2468-17-0x0000000006C00000-0x00000000070A8000-memory.dmp

Filesize
4.7MB

Download
memory/2468-15-0x00000000001E0000-0x0000000000688000-memory.dmp

Filesize
4.7MB

Download
memory/2468-9-0x00000000001E0000-0x0000000000688000-memory.dmp

Filesize
4.7MB

Download
memory/2468-5-0x00000000001E0000-0x0000000000688000-memory.dmp

Filesize
4.7MB

Download
memory/2468-3-0x00000000001E0000-0x0000000000688000-memory.dmp

Filesize
4.7MB

Download
memory/2772-303-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-313-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-19-0x0000000000DD1000-0x0000000000DFF000-memory.dmp

Filesize
184KB

Download
memory/2772-294-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-20-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-297-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-22-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-18-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-54-0x0000000006A80000-0x0000000007577000-memory.dmp

Filesize
11.0MB

Download
memory/2772-311-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-203-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-57-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-191-0x0000000006A80000-0x0000000007577000-memory.dmp

Filesize
11.0MB

Download
memory/2772-315-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-188-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-317-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-184-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-319-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-183-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-321-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-246-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download
memory/2772-328-0x0000000000DD0000-0x0000000001278000-memory.dmp

Filesize
4.7MB

Download