Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe
Resource
win10v2004-20240802-en
General
-
Target
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe
-
Size
1.8MB
-
MD5
d3d78e1c124fae22319920f6cd2519fd
-
SHA1
4dc7763f9097c4f88e5ea69c05f8d591c3ff4628
-
SHA256
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be
-
SHA512
c1ac5b72b44720b75010aa09674f35bda28a49f0c09ffaeba46e2eb911bbc3ec5976aef957e896b60e43e186a6344f96a9fde8a66da31ed033c04cb8f077ef98
-
SSDEEP
24576:zny4cxyFlHVMcEqyJPjQwFueUz0BnabD9dRXZFkYPRsAC2x5BkDRKhTzIc7yQNw:D1lpiPjvCz0Bn4MoRfCuLkDRwl77
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exee29accf2cd.exe8f6e692d26.exef3eaefc4f8.exeexplorti.exeexplorti.exepid process 2144 explorti.exe 1068 e29accf2cd.exe 4704 8f6e692d26.exe 1776 f3eaefc4f8.exe 2088 explorti.exe 6136 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e29accf2cd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\e29accf2cd.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2168-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2168-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2168-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exeexplorti.exeexplorti.exepid process 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe 2144 explorti.exe 2088 explorti.exe 6136 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e29accf2cd.exe8f6e692d26.exedescription pid process target process PID 1068 set thread context of 2168 1068 e29accf2cd.exe RegAsm.exe PID 4704 set thread context of 876 4704 8f6e692d26.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exedescription ioc process File created C:\Windows\Tasks\explorti.job e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
f3eaefc4f8.exee2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exee29accf2cd.exeRegAsm.exe8f6e692d26.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3eaefc4f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e29accf2cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f6e692d26.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exeexplorti.exeexplorti.exepid process 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe 2144 explorti.exe 2144 explorti.exe 2088 explorti.exe 2088 explorti.exe 6136 explorti.exe 6136 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4604 firefox.exe Token: SeDebugPrivilege 4604 firefox.exe Token: SeDebugPrivilege 4604 firefox.exe Token: SeDebugPrivilege 4604 firefox.exe Token: SeDebugPrivilege 4604 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeRegAsm.exefirefox.exepid process 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 4604 firefox.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe 2168 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4604 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exeexplorti.exee29accf2cd.exe8f6e692d26.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 4004 wrote to memory of 2144 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe explorti.exe PID 4004 wrote to memory of 2144 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe explorti.exe PID 4004 wrote to memory of 2144 4004 e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe explorti.exe PID 2144 wrote to memory of 1068 2144 explorti.exe e29accf2cd.exe PID 2144 wrote to memory of 1068 2144 explorti.exe e29accf2cd.exe PID 2144 wrote to memory of 1068 2144 explorti.exe e29accf2cd.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 1068 wrote to memory of 2168 1068 e29accf2cd.exe RegAsm.exe PID 2144 wrote to memory of 4704 2144 explorti.exe 8f6e692d26.exe PID 2144 wrote to memory of 4704 2144 explorti.exe 8f6e692d26.exe PID 2144 wrote to memory of 4704 2144 explorti.exe 8f6e692d26.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 4704 wrote to memory of 876 4704 8f6e692d26.exe RegAsm.exe PID 2144 wrote to memory of 1776 2144 explorti.exe f3eaefc4f8.exe PID 2144 wrote to memory of 1776 2144 explorti.exe f3eaefc4f8.exe PID 2144 wrote to memory of 1776 2144 explorti.exe f3eaefc4f8.exe PID 2168 wrote to memory of 2348 2168 RegAsm.exe firefox.exe PID 2168 wrote to memory of 2348 2168 RegAsm.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 2348 wrote to memory of 4604 2348 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe PID 4604 wrote to memory of 1420 4604 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe"C:\Users\Admin\AppData\Local\Temp\e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\1000036001\e29accf2cd.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\e29accf2cd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5aa96de7-9758-4dcb-b604-3aa9e899bff7} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" gpu7⤵PID:1420
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6936a5b3-5ac5-46dd-99e6-b2eeb5825b2a} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" socket7⤵PID:3128
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3336 -childID 1 -isForBrowser -prefsHandle 3348 -prefMapHandle 2972 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d616a724-9c29-4b2d-bd3e-d45bd0b53ce8} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab7⤵PID:1440
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 2796 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50d25e87-02e2-4a62-9bb9-fed9e6621ede} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab7⤵PID:1148
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4860 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4856 -prefMapHandle 4852 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11573081-d2a0-4ef1-9be4-5abb8d72cc6a} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" utility7⤵
- Checks processor information in registry
PID:5400 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 3 -isForBrowser -prefsHandle 5492 -prefMapHandle 5484 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffbea39d-a416-4ccb-8e44-822ea39b28ab} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab7⤵PID:5948
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 4 -isForBrowser -prefsHandle 5652 -prefMapHandle 5656 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f9c40cc-bb74-4f9c-9715-76a6499acfc6} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab7⤵PID:5960
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5856 -childID 5 -isForBrowser -prefsHandle 5868 -prefMapHandle 5812 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33ac4c9a-e687-4698-a98d-a64aca18c5d1} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab7⤵PID:5972
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6296 -childID 6 -isForBrowser -prefsHandle 6408 -prefMapHandle 6416 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f007d4d7-fa4c-41be-8feb-134a8806c48b} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab7⤵PID:5148
-
C:\Users\Admin\1000037002\8f6e692d26.exe"C:\Users\Admin\1000037002\8f6e692d26.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\1000038001\f3eaefc4f8.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\f3eaefc4f8.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2088
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6136
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5bbe806cb79b33ffa22e8936f13aa6f2a
SHA1130f60ce2aa9160eb3f56178e40153c9ff0ba04c
SHA2568d2938ce81c0bdec367c5d8843d1c10d7ff99ff384342fbd832cdfdb301d733c
SHA512264534078c13bef72a571dcea5f67172938f1b18655b16e3ef629c44fb0d14a77254c3714c08171ff63254beca78c1aea5dce69a5a6757e165cd1cf212568841
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD582dd94f3ad85ea352a85694b64305797
SHA1088a8ea7aadb2ea5b69c98ca0eef14c5e554a857
SHA256ebf2a0a7a1c28d75e6da7d609f1561de3bd412bee029871fe0f8b03983daf552
SHA512896abf37f4c43132d86356d9eea2630a51a889adba67f1ade4625c3dba932f9e31d2d482e21c3ca6b6c8dba789f5c6f0532d5be2ecbbe11b308eb6584c780902
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize7KB
MD5c460716b62456449360b23cf5663f275
SHA106573a83d88286153066bae7062cc9300e567d92
SHA2560ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
SHA512476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
-
Filesize
1.8MB
MD5d3d78e1c124fae22319920f6cd2519fd
SHA14dc7763f9097c4f88e5ea69c05f8d591c3ff4628
SHA256e2009d4ba870727729dfb0a3640923948cb5bddefa41902a9ea98879aaf384be
SHA512c1ac5b72b44720b75010aa09674f35bda28a49f0c09ffaeba46e2eb911bbc3ec5976aef957e896b60e43e186a6344f96a9fde8a66da31ed033c04cb8f077ef98
-
Filesize
1.2MB
MD55d0ffc867062f7deae37eede861b190d
SHA12fea2ad5abd61031c200b0d54c0534aaf216cdd3
SHA25686aefa1f3bd48d3e58d04159ece977abaa54d0e1dd18eb50c1382a2838e3b793
SHA5128367eceb7fcfa060d9df57277d45ce8a2e479530556ebccd76331c5ffa07107482a156edfea50656b83a58f39074c8ca4d88fbb403775fb0c6231180b77370c5
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
Filesize16KB
MD54588c452ab8b826fd1f8b9a544c28cb0
SHA1c45c1c2e7251ea0299e798a40e42855f02120c22
SHA256e7313d771aeb56b2d6ddee727a12bb2225589bd298a506de1843165ead96d84f
SHA51252e5c3928025bd9138bbaaa76ac605b1673b88bcba7807a099a221036f0baf5b2041f29036199ef4eb9a184d8d27568dc014a0f0056217b50d9d13d78e3f52fd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
Filesize7KB
MD5597009566d776580cf5e5ebd7f973029
SHA1aa237207864ab86989ce12fba43c30b210fcfcfd
SHA2561a57729940b9bbca776c780e56fb78cb940c912524775945f1e2109c2d25f281
SHA5128d6d63c00364a1f7215c652ca3d73b11e5f323a2966b969d635e8381b035958c0ef907c8bf3b09617faac778c46fd134c1ba7d41cbedf3a8b2f1f10b2af76424
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin
Filesize10KB
MD5b23b6862b62d971b579ac1ad458f4112
SHA171a175aea62f829480c3ca9fb52eede6a111a7c2
SHA2564931ba2e988bad6b8f9a52824c6a79aedc96e680d1b9ab421f7a500a8d31e91a
SHA512bf77b3d71b044511eb76efa166c8150cb53a7dee025bfc5e6ca26936432e5ff1db26b414882ae63deda358838f388c24928109f658872ba2f22536764553d908
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD5ddf574ad9549f73cb804121c527ee72b
SHA1b24beace4837acf061e27256e1d306dbd76607fc
SHA2564d1a78a55d92ec51dae00a89bd03a588d66acb8c2199f9051c8586c43f386d13
SHA512c982dc49f4de0c9df39dd3c9aa4e060c2434f04b8e29b0e300b487b079ca1d63dd13eef4a5f900cfec020e7e360680e9e6fcf74834215b9d04c4179a4d36ec08
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp
Filesize25KB
MD5d0f14a54ccbd48afdb6a85d5e925c92a
SHA117127b7a5f5b4a580966ba83a904b39a42652225
SHA256abbee1ba8398c47b7de2a7976e6fdd6a32912708457230ef0d1705156eb580fc
SHA5126828acc4b30778802430aa4a099fd0ea3c75e8d091e5fff42f57a5098845112d407a1b0cac9ff2db8461b86b5975cef840b31923eaa68b4799d88b472893162e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\23c2e944-b8e6-461f-8cc4-5d681d87a442
Filesize659B
MD5e743172b6872223b2801606bbfc66c9a
SHA19d43542235927d3c23c871d000fc56dfc2d73896
SHA256213d8c03681f03669ff0a7b43c72050e88421eb5e2f40e5d01643d651e97a104
SHA512f1b22eb739fa38953cd2ceaca8827a0cd0a75819f4009891ab38498b83020b898433f12675d30bac362077528a15177813f2835f2c7e65a69b4d76186d0d4406
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\5d641671-72f4-4f5a-9378-7ed38ec48faf
Filesize982B
MD5ba6322d93f80b0b99078bc308b02921e
SHA19873bb68dc7073190ebc3826a3db4c13e31faeec
SHA25691871c62fc366fd91a77f0f4745f29d3af29e8bf988ed5dcd403ae1d827b730f
SHA5125fdac708f6822a781ef0b735a812a337276911c5f15e409c519df0b34dcc9579d0117bef445d3d811e61b0879e700045d5c9a9db96a4af398407b8c9fd265044
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD5ce61c3db62292264cb34d418c0fafd08
SHA11e64456e1b9746b80183a3852d09de1641b9b54f
SHA256509a600c4ed68c5aa582291421c775204a0cbcc0cec2a846ee5b51a1685b80ac
SHA512ceb2045e0ac0131710832a3d85b2918d7a68e95fa2f124a3e47af5a0841e86bb8a0d02e6b415f5957d7b74aa2605a17b7edc4f0ce38a643607ad6a4c0b4df216
-
Filesize
12KB
MD533eef8b126ef2e1f61dbc2b3818a4c44
SHA1e5fda03938f812192d6711b54231eb1a912d2f0e
SHA256f10894aa03db266da5d20c3e4778cb8c1f4d2e72ca2cdd3971ea7a92dc9b763c
SHA5123efaf735c903c8aa663b010829b13f561c2af3e41529dc83e35f8e91a07d968a398623f3d5bb2c1d7390445765ed870a18986816d9fdd5f6146c9dd5b098d059
-
Filesize
16KB
MD528550e3a73aae45347e4da4652336a47
SHA19692bfdd06d4cab97ae39da997e32eaadf456649
SHA256c80989b6ea325ddb0821a1ee4a6f949b2243f67c89b87db5b2b73e328c00bbf0
SHA5127a27899f189642f2e0102695eb13018521a39596b5f96cb5d9c9fc98677160028cb3874ca8114b399c2df94580ac77e714ec28f02ce320a3c398bddeb2103d2b
-
Filesize
11KB
MD5b5607caea914fd22b07b3ada7724b2ad
SHA199d1e205c1c6635d58a2eba6a3c9c6407fb3d6f0
SHA2564355cdca87e8f37cd09e955c90f3e62ddabea58549c77eba31297993a97ec88f
SHA51242adff817e63e73b67618ad81a2dcba3cadc9bdb92af0c0b3bc3b1a06b473e68654309cb3eb43959d0ee5add408f2cdd0fe1d767e6a64be63ef37ff4ce199530
-
Filesize
11KB
MD5966ff59951768497f635d058048e1cfa
SHA1315c0bfcddd8f85a6ed30e157dcaa924f1f14ca3
SHA256e51f100ba8934d8f15bf7664ac0bcec618c946fd7b17152bd27f26d93593be27
SHA5120e245d4188b5e5306e75f589b5aab437e7604b33db4646ac5731691594f80d8fd69dd321f42b9dc07d4fa6582461cfe598f817459ef0f12cc36314a8c81b087b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.4MB
MD597fee50395e793d1395391596f6ae518
SHA1e32a9386624634689eb0dabf6bc547e20eb77933
SHA2563aff9ccea4d38404fef73a573cf93911e5915ac60fe857a74956f088edfce530
SHA5129431dcdf6b6262a418143dc2dfebe559c4eb1f3ea5774e96ebf3a92d2db97d7c3c05baf20edddab96cfbb07f6869a889dc050dff87fe453b5d21735538db58b2