amadey | 454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FILE2233.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1728	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation	5555.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tAd2Pict3t7Qd0iSCOzIUvf1.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jxLP3VuA12vAGCLu0DiQOG1V.bat	regsvcs.exe

Executes dropped EXE 23 IoCs

pid	Process
508	axplong.exe
588	GOLD.exe
3008	crypteda.exe
4336	newalp.exe
1256	Hkbsse.exe
4764	TBWNoH8Ixj.exe
2520	ANnPtpr69I.exe
3400	06082025.exe
4452	stealc_default.exe
4208	FILE2233.exe
3944	MYNEWRDX.exe
1668	HBp7JQplVAnzdzDK11rS07tc.exe
4688	5555.exe
4360	axplong.exe
4356	Hkbsse.exe
3068	Hkbsse.exe
4828	axplong.exe
356	Hkbsse.exe
2524	axplong.exe
2772	axplong.exe
200	Hkbsse.exe
3404	axplong.exe
4584	Hkbsse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	axplong.exe

Loads dropped DLL 2 IoCs

pid	Process
4452	stealc_default.exe
4452	stealc_default.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\My Program = "C:\\Users\\Admin\\AppData\\Local\\MyHiddenFolder\\5555.exe"	5555.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FILE2233.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FILE2233.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
69	iplogger.com
29	raw.githubusercontent.com
45	pastebin.com
59	raw.githubusercontent.com
61	bitbucket.org
70	iplogger.com
28	raw.githubusercontent.com
44	pastebin.com
60	bitbucket.org

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
204	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
508	axplong.exe
4360	axplong.exe
4828	axplong.exe
2524	axplong.exe
2772	axplong.exe
3404	axplong.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 588 set thread context of 2144	588	GOLD.exe	78
PID 3008 set thread context of 3696	3008	crypteda.exe	82
PID 4208 set thread context of 4624	4208	FILE2233.exe	96

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
File created	C:\Windows\Tasks\Hkbsse.job	newalp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06082025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TBWNoH8Ixj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ANnPtpr69I.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newalp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MYNEWRDX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HBp7JQplVAnzdzDK11rS07tc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HBp7JQplVAnzdzDK11rS07tc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HBp7JQplVAnzdzDK11rS07tc.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
204	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
204	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
508	axplong.exe
508	axplong.exe
2144	RegAsm.exe
4452	stealc_default.exe
4452	stealc_default.exe
2520	ANnPtpr69I.exe
4764	TBWNoH8Ixj.exe
2144	RegAsm.exe
2144	RegAsm.exe
4452	stealc_default.exe
4452	stealc_default.exe
3400	06082025.exe
3400	06082025.exe
3400	06082025.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
3944	MYNEWRDX.exe
3944	MYNEWRDX.exe
3944	MYNEWRDX.exe
4360	axplong.exe
4360	axplong.exe
4828	axplong.exe
4828	axplong.exe
2524	axplong.exe
2524	axplong.exe
2772	axplong.exe
2772	axplong.exe
3404	axplong.exe
3404	axplong.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	TBWNoH8Ixj.exe
Token: SeDebugPrivilege	2520	ANnPtpr69I.exe
Token: SeBackupPrivilege	2520	ANnPtpr69I.exe
Token: SeSecurityPrivilege	2520	ANnPtpr69I.exe
Token: SeSecurityPrivilege	2520	ANnPtpr69I.exe
Token: SeSecurityPrivilege	2520	ANnPtpr69I.exe
Token: SeSecurityPrivilege	2520	ANnPtpr69I.exe
Token: SeBackupPrivilege	4764	TBWNoH8Ixj.exe
Token: SeSecurityPrivilege	4764	TBWNoH8Ixj.exe
Token: SeSecurityPrivilege	4764	TBWNoH8Ixj.exe
Token: SeSecurityPrivilege	4764	TBWNoH8Ixj.exe
Token: SeSecurityPrivilege	4764	TBWNoH8Ixj.exe
Token: SeDebugPrivilege	2144	RegAsm.exe
Token: SeDebugPrivilege	3400	06082025.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	4624	regsvcs.exe
Token: SeIncreaseQuotaPrivilege	1728	powershell.exe
Token: SeSecurityPrivilege	1728	powershell.exe
Token: SeTakeOwnershipPrivilege	1728	powershell.exe
Token: SeLoadDriverPrivilege	1728	powershell.exe
Token: SeSystemProfilePrivilege	1728	powershell.exe
Token: SeSystemtimePrivilege	1728	powershell.exe
Token: SeProfSingleProcessPrivilege	1728	powershell.exe
Token: SeIncBasePriorityPrivilege	1728	powershell.exe
Token: SeCreatePagefilePrivilege	1728	powershell.exe
Token: SeBackupPrivilege	1728	powershell.exe
Token: SeRestorePrivilege	1728	powershell.exe
Token: SeShutdownPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeSystemEnvironmentPrivilege	1728	powershell.exe
Token: SeRemoteShutdownPrivilege	1728	powershell.exe
Token: SeUndockPrivilege	1728	powershell.exe
Token: SeManageVolumePrivilege	1728	powershell.exe
Token: 33	1728	powershell.exe
Token: 34	1728	powershell.exe
Token: 35	1728	powershell.exe
Token: 36	1728	powershell.exe
Token: SeDebugPrivilege	3944	MYNEWRDX.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 508	204	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe	74
PID 204 wrote to memory of 508	204	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe	74
PID 204 wrote to memory of 508	204	454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe	74
PID 508 wrote to memory of 588	508	axplong.exe	75
PID 508 wrote to memory of 588	508	axplong.exe	75
PID 508 wrote to memory of 588	508	axplong.exe	75
PID 588 wrote to memory of 2068	588	GOLD.exe	77
PID 588 wrote to memory of 2068	588	GOLD.exe	77
PID 588 wrote to memory of 2068	588	GOLD.exe	77
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 588 wrote to memory of 2144	588	GOLD.exe	78
PID 508 wrote to memory of 3008	508	axplong.exe	79
PID 508 wrote to memory of 3008	508	axplong.exe	79
PID 508 wrote to memory of 3008	508	axplong.exe	79
PID 508 wrote to memory of 4336	508	axplong.exe	81
PID 508 wrote to memory of 4336	508	axplong.exe	81
PID 508 wrote to memory of 4336	508	axplong.exe	81
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 3008 wrote to memory of 3696	3008	crypteda.exe	82
PID 4336 wrote to memory of 1256	4336	newalp.exe	83
PID 4336 wrote to memory of 1256	4336	newalp.exe	83
PID 4336 wrote to memory of 1256	4336	newalp.exe	83
PID 3696 wrote to memory of 4764	3696	RegAsm.exe	84
PID 3696 wrote to memory of 4764	3696	RegAsm.exe	84
PID 3696 wrote to memory of 4764	3696	RegAsm.exe	84
PID 3696 wrote to memory of 2520	3696	RegAsm.exe	85
PID 3696 wrote to memory of 2520	3696	RegAsm.exe	85
PID 3696 wrote to memory of 2520	3696	RegAsm.exe	85
PID 508 wrote to memory of 3400	508	axplong.exe	88
PID 508 wrote to memory of 3400	508	axplong.exe	88
PID 508 wrote to memory of 3400	508	axplong.exe	88
PID 508 wrote to memory of 4452	508	axplong.exe	90
PID 508 wrote to memory of 4452	508	axplong.exe	90
PID 508 wrote to memory of 4452	508	axplong.exe	90
PID 508 wrote to memory of 4208	508	axplong.exe	91
PID 508 wrote to memory of 4208	508	axplong.exe	91
PID 508 wrote to memory of 3944	508	axplong.exe	93
PID 508 wrote to memory of 3944	508	axplong.exe	93
PID 508 wrote to memory of 3944	508	axplong.exe	93
PID 4208 wrote to memory of 1728	4208	FILE2233.exe	94
PID 4208 wrote to memory of 1728	4208	FILE2233.exe	94
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4208 wrote to memory of 4624	4208	FILE2233.exe	96
PID 4624 wrote to memory of 1668	4624	regsvcs.exe	100

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FILE2233.exe

C:\Users\Admin\AppData\Local\Temp\454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe
"C:\Users\Admin\AppData\Local\Temp\454f65d0741e515c03e0196b9b8fdfb11fb12c1c39717bd277d856d94dcf7db3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:204
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2068
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2144
- - C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Users\Admin\AppData\Roaming\TBWNoH8Ixj.exe
        
        "C:\Users\Admin\AppData\Roaming\TBWNoH8Ixj.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
    - - C:\Users\Admin\AppData\Roaming\ANnPtpr69I.exe
        
        "C:\Users\Admin\AppData\Roaming\ANnPtpr69I.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
- - C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1256
- - C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe
    "C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\5555.exe
      "C:\Users\Admin\AppData\Local\Temp\5555.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      PID:4688
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe
    "C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1728
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Users\Admin\Pictures\HBp7JQplVAnzdzDK11rS07tc.exe
        
        "C:\Users\Admin\Pictures\HBp7JQplVAnzdzDK11rS07tc.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1668
- - C:\Users\Admin\AppData\Local\Temp\1000090001\MYNEWRDX.exe
    "C:\Users\Admin\AppData\Local\Temp\1000090001\MYNEWRDX.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4360

C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3068

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4828

C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:356

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2524

C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:200

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion