Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 10:21
Static task
static1
Behavioral task
behavioral1
Sample
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe
Resource
win10v2004-20240802-en
General
-
Target
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe
-
Size
1.8MB
-
MD5
c9fa55d8572cf366bdfa9013244a191e
-
SHA1
94289da9815d1d2f4fe372a5f3295c23e13009f6
-
SHA256
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510
-
SHA512
156bc7fcbf891341759fcc463045c4a6ca52d1aa9c5cd8c5b89f7a6f471f044ca54d0ab23dc4e85cb031a3ca4ec4488651b14843a79e714e4af87427f8d55215
-
SSDEEP
49152:h58Y6LRy9vKJb5dHjee1izISXYGSQoUKmykA:ht6315dHSe1inXYGSZUKm1A
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exeexplorti.exeexplorti.exeexplorti.exe2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 7 IoCs
Processes:
explorti.exe4dde3e6fff.exec861ede2eb.exe7443a7e688.exeexplorti.exeexplorti.exeexplorti.exepid process 5084 explorti.exe 3432 4dde3e6fff.exe 3716 c861ede2eb.exe 2312 7443a7e688.exe 5756 explorti.exe 4012 explorti.exe 4792 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4dde3e6fff.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\4dde3e6fff.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/3776-44-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/3776-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/3776-48-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe 5084 explorti.exe 5756 explorti.exe 4012 explorti.exe 4792 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4dde3e6fff.exec861ede2eb.exedescription pid process target process PID 3432 set thread context of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3716 set thread context of 2716 3716 c861ede2eb.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exedescription ioc process File created C:\Windows\Tasks\explorti.job 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exe7443a7e688.exe2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exe4dde3e6fff.exeRegAsm.exec861ede2eb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7443a7e688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4dde3e6fff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c861ede2eb.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe 5084 explorti.exe 5084 explorti.exe 5756 explorti.exe 5756 explorti.exe 4012 explorti.exe 4012 explorti.exe 4792 explorti.exe 4792 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2496 firefox.exe Token: SeDebugPrivilege 2496 firefox.exe Token: SeDebugPrivilege 2496 firefox.exe Token: SeDebugPrivilege 2496 firefox.exe Token: SeDebugPrivilege 2496 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeRegAsm.exefirefox.exepid process 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 2496 firefox.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe 3776 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 2496 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exeexplorti.exe4dde3e6fff.exec861ede2eb.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 712 wrote to memory of 5084 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe explorti.exe PID 712 wrote to memory of 5084 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe explorti.exe PID 712 wrote to memory of 5084 712 2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe explorti.exe PID 5084 wrote to memory of 3432 5084 explorti.exe 4dde3e6fff.exe PID 5084 wrote to memory of 3432 5084 explorti.exe 4dde3e6fff.exe PID 5084 wrote to memory of 3432 5084 explorti.exe 4dde3e6fff.exe PID 3432 wrote to memory of 2176 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 2176 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 2176 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 3432 wrote to memory of 3776 3432 4dde3e6fff.exe RegAsm.exe PID 5084 wrote to memory of 3716 5084 explorti.exe c861ede2eb.exe PID 5084 wrote to memory of 3716 5084 explorti.exe c861ede2eb.exe PID 5084 wrote to memory of 3716 5084 explorti.exe c861ede2eb.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 3716 wrote to memory of 2716 3716 c861ede2eb.exe RegAsm.exe PID 5084 wrote to memory of 2312 5084 explorti.exe 7443a7e688.exe PID 5084 wrote to memory of 2312 5084 explorti.exe 7443a7e688.exe PID 5084 wrote to memory of 2312 5084 explorti.exe 7443a7e688.exe PID 3776 wrote to memory of 4912 3776 RegAsm.exe firefox.exe PID 3776 wrote to memory of 4912 3776 RegAsm.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 2496 4912 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe PID 2496 wrote to memory of 668 2496 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe"C:\Users\Admin\AppData\Local\Temp\2c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\1000036001\4dde3e6fff.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\4dde3e6fff.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:2176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b54f575-1201-411b-9461-cda26e7bbce8} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" gpu7⤵PID:668
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b50145-2fcc-4790-ad1a-c6a30b4635ae} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" socket7⤵PID:4396
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3268 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2972 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e6b501a-a10b-48ef-88f2-81902757bb10} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab7⤵PID:3912
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4100 -childID 2 -isForBrowser -prefsHandle 4028 -prefMapHandle 3972 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {397ace17-646a-4d91-b450-5e0b5ba4636a} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab7⤵PID:1352
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4692 -prefMapHandle 4672 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fc489fa-7201-41f0-ae7c-33a0c2739808} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" utility7⤵
- Checks processor information in registry
PID:5396 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5080 -prefMapHandle 5248 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef207620-156b-4808-8b29-97bce48bf716} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab7⤵PID:5796
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a457740-59a0-4350-a3ff-0d426ab7d0c8} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab7⤵PID:5808
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 5 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {720683c4-ea5a-4fe3-b659-b5e6f9b1c452} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab7⤵PID:5844
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6256 -childID 6 -isForBrowser -prefsHandle 6236 -prefMapHandle 6252 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1076 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e64f4efe-0291-40c7-bcc6-f79d8402e263} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab7⤵PID:4576
-
C:\Users\Admin\1000037002\c861ede2eb.exe"C:\Users\Admin\1000037002\c861ede2eb.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1000038001\7443a7e688.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\7443a7e688.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5756
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4792
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD575990096077c1eb9c1da28255e8c6beb
SHA1522618e1fb7e5c96fd580658b60dbcf99b0355b4
SHA256d7b867a7cbf5c2ff477ca1baa1d6d437d5798c4d65a862ebd54f85529346b4c6
SHA512de79349cc9eef97c02bc2ae88f61c8f001573f635b1d6be783cda52366924bda21d3ba5feb3533f5652fb0138ef64a0ea40ca7ac7537193d220d4b5588e3b7b1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD55f8d42f6018685378f245284733c403a
SHA1ce66a0290e59cce8d98fcdb6b34a27494e2cbd05
SHA256ce3cc7a60aab3823251705b77e7a81fa4cfa3a546b7432f7e10f2b386c4e1dfd
SHA5122e1944b81745952fffcaa213190dbf16b1b1b90b9c7abee94a38410b081b4e49f1820fa3b9726c29b4ceecd7e8730cf590e9886d46a4ba71e69f83a010401d74
-
Filesize
1.8MB
MD5c9fa55d8572cf366bdfa9013244a191e
SHA194289da9815d1d2f4fe372a5f3295c23e13009f6
SHA2562c308b17b9a74b604bb0ca961e755e1a05cdeb8b7368ccf770d385bfa33a9510
SHA512156bc7fcbf891341759fcc463045c4a6ca52d1aa9c5cd8c5b89f7a6f471f044ca54d0ab23dc4e85cb031a3ca4ec4488651b14843a79e714e4af87427f8d55215
-
Filesize
1.2MB
MD5531502fd99b86924df6c84ed89331e38
SHA1384b4fc4f639da0138bdcda682a3e0dda2345525
SHA256ad9949bf0e2984d16e62a3093eb3bd63d97bde59fd5084ce41d64089294e9b7a
SHA512ef596856a3d15972cc029209d0f76d6615cad3395413a3266a44ff2628c8711a14c1bf0074c6edb16475d246ed08f2c3b772a59d13347fe11d834ea440e73b57
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin
Filesize8KB
MD59c00a385bbddab80d5cc4efd85b79791
SHA1678aad4c98d6a59a3022823e7f9e65d158578921
SHA256d1e8c3f2bf5e96b3f0a1202182f9bca1fbfaf2c881661fc34ef4d47ca6e74223
SHA512c0246429e2e94659d03a3aeb10f3b273ea61c6e84545198741dce43a1615249daccb620f2e4d8e64a7bf31035ba852c1a1e1566acd026269697262d84d261ea2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin
Filesize11KB
MD559385628c47bc40dda889355d375ed82
SHA1692a45606a08da9fb07ab3ca3e8ba5cc688e7064
SHA2569855283f093f47c163e316380cd95f5cb733040eaa9c5fb783ffafab0d8b0f91
SHA5122963c0e89b4bbfce3904642538c5d1d8bda47513e328953842b457574d760470b5707e2f700eafad6d8fa44ac7597bcac1d9a2f60961c790efd1a861da89da35
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5efd964ebfb0201b9ef8085c990955318
SHA18388c68829327137c5385c86ec7d3f33f5dda7c7
SHA2561faaaec1a15c33ac1a4bf6397fcc5fd913caed2959d968be5e4b6a9d763bc921
SHA512e380f0f70d65f4417aaea0d4b1359bc58f4a176847a75ccbe73dfd963eb3d6b3117ef7b0dedf919c365049cb4e74b29cd3eca2504317814f1d163d90f6f1c17e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD53e19748ef280ab99505f2ba404c0e696
SHA1136103167e2882595b050111d7c220cf7fc1d6cb
SHA25627563ea7cc234ca5650cab15bc397d67c04acbe071b16665474a6a08fcf8c08d
SHA51289df0ad427a5996410856e29d5fddcde97ea0e99872f6cdf14e86b3f0964e7dd694ff11476d48deb44a6a7da7e767c6304ba003a04de9d7e0857340a594accdb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5a8e25ee6e85c0b93cf0a8628776c3412
SHA1c6fb3d54e45d76aa1574f0af6e51b9c1638a147c
SHA256c987f4f67ab406853b7b38003ab47549aa88270991fca2c45918b048e221dab9
SHA5121ed489a09306a238686c9ea00bb476b0279bd1fb85a4a05bc7328ff69772456881c6d92bc6f57732f3365543160ef659862a0b6858e5c656735fd7add298b903
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\105dfdbf-076a-45d9-a827-45708355a662
Filesize671B
MD56db4cec707effebbb15f363ed9d4909d
SHA1642a1ed864d4750441f85d919bb3a16a4912cb92
SHA2563aeb433126fd5fe7009b3c604bb15c44ef913f655d71b55100cd2f0c5fe2a638
SHA5128b41f1978e6c28a6e94957b51409593fea145844ac68c15d19a171dc0028f1c8847c2f05a9120a887c628e281e0b149be1d9901652b4ba75ffe4225bb3aaffc0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\7ee70754-ccae-49c8-b38e-c7e39b0dc881
Filesize982B
MD58905141981344c01934d1e0ba46f3eb4
SHA1ce31a65f22490729faa5a7463ff05ffee28ae7fa
SHA256741ec953bd332a6c1930a5a99be64aa0d79fedbb1460b8f81638a3055be83efc
SHA512eedc0cfd6f8464556d703f95629162f3a87ea4cab3f36f4c6137b4fd63932b54f7f2937e81242b313cbef6b2ce9ebd6b2dca340ac92cb7e57fbcc94ebb3c034e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\8609bc97-356f-4c8b-a232-92c21c8f251d
Filesize27KB
MD5f4f3885135b1b4dbb0910d68842afb96
SHA15d0069c92cd6ae89df21e5462161fc0d65b6da28
SHA256f664406b18514ab527e5a9e6d748f763155f371bae1b467629e120ba0c4b6f12
SHA512dde32c5aa030b676cd24ab2f3ba0b557b7c8285903f7c5a35e0280e4159a92f9af1765f718e12fd9d56cbb17ae2de7bea8743c7dabecb4894e5d2ffd8630211c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
16KB
MD5327069a1d55bb9b1ab28e8145741140b
SHA1cafe5269a431b7142bf00274c09db6caa23ca7a7
SHA2564fb38cef10202d70eb8b9c1a8b38701cb5f6b03a6f9763ae542ea1307fbed49a
SHA5123faac7de199b8c375b2f64e790c040d100a1817999369b77bc707fdfe5b29569ae122d36b4abdebdeed820c12ee21509e1f3c904cb97e326489ce8a9d5a6dc6a
-
Filesize
15KB
MD50f4108178ce2cd7bcc2baea935d63b71
SHA1672bcf6aa9d6ffcdebb4d2ca6b0e1e6d8136d4c4
SHA256b4ac1e347155de0a7b34eb6093f8877b6cdc98c257c8e3ac77186fc874b12e92
SHA5120eef78fc02530e088b329bb7abe2e229b80745bc9bee2778a7f280b11ff8d120c289229b6a52c2138ea7a5f60b5a33aee8ed438297862323fbd28974d0ae1c17
-
Filesize
12KB
MD59799303e04fcf3eb2516b51bf621044b
SHA1ce04020fb8004d646808c113235d1f2d5b33619a
SHA2564af08213073abb52fa5bbfe9ecf21314dab7546bd932beecf2c15a6b23208aaf
SHA5124a8584a42066743aa8dcd5969cf41bbdaa78124cb110df03325076bde66f44ec8a3be1f47639229cf043d909d11247624b6daefa2dbc52ad5c111c52e6148c54
-
Filesize
11KB
MD5e95d543ff3ac19eb976c173d980f7b66
SHA1b315fe367eb9f6c49482662e4160df2d67ede680
SHA2561ef84be5401374b8b731dbbc21abd2b2b83b74a03f638c44b18e1291a8a56426
SHA5123a8cdc617c805621eea7829ee15a5c838bf956d7e9bd464cef995a29aed78802dbb8aec39a466468c10ea7ee6baf9aa56b4c21d8bda44d27ef73c8da5df59752
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.4MB
MD593f5fc7d2c19ce3e83fd3d643a446388
SHA15482cf6a44cac0819b8841c4604512e3d1ca3845
SHA2563700f28dcc63b34ad1c15fb3259d5df6d99b9c205b617499f1a6037c766b8adb
SHA512c0b4465845b1c404a0ca597d0b945970c51fd7ff92045466371c47ddcd7853327ca36df7593f5465159efac08d59ccfc92d50bf649a317820cb7d28d4193fe88