amadey | 686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
Size 1.8MB
Sample240810-tp8aea1drc
SHA256 686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618
MD5 43e6feee4ae6e6a918c0fe9d6f7b3ce3
SHA1 b7d436239cd2b654a7702538faea29e910bfe5fd
SHA512 696eb21cf7a6379a43490513bfc3769229d362a0ed6f5aea60f9b4a469f33ed3e7d8dcc234f391d1811b922301f21af5e73247d3f0fdd7115403f0d815a9c2b3
SSDEEP 49152:EvbZHz6EUMs7ZOapkjka7385dDSgRcSHE:EjZHJUwzwhY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline stealc default fed3aa credential_access discovery evasion infostealer spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

185.215.113.67:21405

Extracted

Family

stealc

Botnet

default

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019614-124.dat	family_redline
behavioral1/memory/1660-140-0x0000000000020000-0x0000000000072000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe

Executes dropped EXE 7 IoCs

pid	Process
2652	axplong.exe
2100	GOLD.exe
1940	crypteda.exe
1604	newalp.exe
3040	Hkbsse.exe
1660	06082025.exe
2612	stealc_default.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	axplong.exe

Loads dropped DLL 18 IoCs

pid	Process
3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
2652	axplong.exe
2652	axplong.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2652	axplong.exe
2652	axplong.exe
2652	axplong.exe
1604	newalp.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2652	axplong.exe
2652	axplong.exe
2652	axplong.exe
2612	stealc_default.exe
2612	stealc_default.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
25	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
29	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
2652	axplong.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	newalp.exe
File created	C:\Windows\Tasks\axplong.job	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2592	2100	WerFault.exe	31
2160	1940	WerFault.exe	35

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newalp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06082025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Hkbsse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Hkbsse.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Hkbsse.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
2652	axplong.exe
2612	stealc_default.exe
2612	stealc_default.exe
1660	06082025.exe
1660	06082025.exe
1660	06082025.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	06082025.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
1604	newalp.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2652	3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe	30
PID 3028 wrote to memory of 2652	3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe	30
PID 3028 wrote to memory of 2652	3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe	30
PID 3028 wrote to memory of 2652	3028	686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe	30
PID 2652 wrote to memory of 2100	2652	axplong.exe	31
PID 2652 wrote to memory of 2100	2652	axplong.exe	31
PID 2652 wrote to memory of 2100	2652	axplong.exe	31
PID 2652 wrote to memory of 2100	2652	axplong.exe	31
PID 2100 wrote to memory of 2592	2100	GOLD.exe	33
PID 2100 wrote to memory of 2592	2100	GOLD.exe	33
PID 2100 wrote to memory of 2592	2100	GOLD.exe	33
PID 2100 wrote to memory of 2592	2100	GOLD.exe	33
PID 2652 wrote to memory of 1940	2652	axplong.exe	35
PID 2652 wrote to memory of 1940	2652	axplong.exe	35
PID 2652 wrote to memory of 1940	2652	axplong.exe	35
PID 2652 wrote to memory of 1940	2652	axplong.exe	35
PID 2652 wrote to memory of 1604	2652	axplong.exe	37
PID 2652 wrote to memory of 1604	2652	axplong.exe	37
PID 2652 wrote to memory of 1604	2652	axplong.exe	37
PID 2652 wrote to memory of 1604	2652	axplong.exe	37
PID 1604 wrote to memory of 3040	1604	newalp.exe	38
PID 1604 wrote to memory of 3040	1604	newalp.exe	38
PID 1604 wrote to memory of 3040	1604	newalp.exe	38
PID 1604 wrote to memory of 3040	1604	newalp.exe	38
PID 1940 wrote to memory of 2160	1940	crypteda.exe	39
PID 1940 wrote to memory of 2160	1940	crypteda.exe	39
PID 1940 wrote to memory of 2160	1940	crypteda.exe	39
PID 1940 wrote to memory of 2160	1940	crypteda.exe	39
PID 2652 wrote to memory of 1660	2652	axplong.exe	40
PID 2652 wrote to memory of 1660	2652	axplong.exe	40
PID 2652 wrote to memory of 1660	2652	axplong.exe	40
PID 2652 wrote to memory of 1660	2652	axplong.exe	40
PID 2652 wrote to memory of 2612	2652	axplong.exe	41
PID 2652 wrote to memory of 2612	2652	axplong.exe	41
PID 2652 wrote to memory of 2612	2652	axplong.exe	41
PID 2652 wrote to memory of 2612	2652	axplong.exe	41

C:\Users\Admin\AppData\Local\Temp\686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe
"C:\Users\Admin\AppData\Local\Temp\686ac7bd9e19dc8bbddbd7bfdaed9291b78527723f6f751f6fea1f82e5d73618.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 64
      4⤵
      Loads dropped DLL
      Program crash
      PID:2592
- - C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 64
      4⤵
      Loads dropped DLL
      Program crash
      PID:2160
- - C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3040
- - C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe
    "C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A66A8DB907BADC9D16AD67B2FBFFDD5C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Size 280B
SHA256 661b208091012d429b08254dad6b7312ec5ce369dc3a7d03b0359308ad0793b9
MD5 a66b7796ff6187b51f5747254c94f21d
SHA1 980d0fba2fa21527709831b7fcf92e0443696c11
SHA512 4ffaf245aeb244fed74200585f5a3c197fec954c399e201901ea50a02e9ff012519deeddbf03b195b1d5e6c0120272e7db64b83f882f17d2a206fafd957111ee
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Size 1KB
SHA256 95999c081ad63d5303fce13b5f586f6a82d9c795ea7fcc76d3b3e9f45c34c023
MD5 27b4ac4d33ea87ea34c6bf4463e9f5fe
SHA1 e4dac1f826d4b0acd8e1f247fe95fe5847eb4809
SHA512 f359086dac50291abfb54790d7d3d0486ab90b8dfd31848a44861a79a81ac17474f233aad97c7218301a41957da367a2913dbcf54cb5a298d1a6c35feda22851
MD5 SHA1 SHA512

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Size 979B
SHA256 abead8e00e65d83f7c5055f34ec15c29a478648975e416536446447e46da01b5
MD5 979e41b6e144bdb24d4a4b0efd2a23f9
SHA1 7272d75da833c58b27ee264bec05859b0b8659a7
SHA512 3feb269aad6b612d66d49697083bd5c72d9be213a63c10c55702ca1df153ef868d48551419ff7d61861ab47790909c760c839e70607934e01c07b44d8ad142b1
MD5 SHA1 SHA512

Submit Download