Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 06:22
Static task
static1
Behavioral task
behavioral1
Sample
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe
Resource
win10v2004-20240802-en
General
-
Target
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe
-
Size
1.8MB
-
MD5
f3ef6ea2a9629f605bb4c6bdd197b3e1
-
SHA1
ffc67e08bf3897b3b6d8eb45150ddfab9d11ce96
-
SHA256
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0
-
SHA512
3e769090ab70a81bcf37e01701ff1e1f6081c3258e65dc25d16f19ac7804ffbbc0823229bc765465d0c7a7e24514524a9a007d6919a2fe098d6be026ac3c44c5
-
SSDEEP
49152:gIVv4/yD9/yNR5cZF/Tu1klo6iVRAZJsAiQ6:LVPR/1ZFr3oFVRqGk
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
explorti.exeexplorti.exeexplorti.exeexplorti.exef1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 7 IoCs
Processes:
explorti.exe7c1ec43858.exe9fd1a2f5ad.exe35ece3dd27.exeexplorti.exeexplorti.exeexplorti.exepid process 3484 explorti.exe 1132 7c1ec43858.exe 4664 9fd1a2f5ad.exe 4468 35ece3dd27.exe 5932 explorti.exe 6008 explorti.exe 6008 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7c1ec43858.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\7c1ec43858.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/4652-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/4652-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/4652-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 3484 explorti.exe 5932 explorti.exe 6008 explorti.exe 6008 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7c1ec43858.exe9fd1a2f5ad.exedescription pid process target process PID 1132 set thread context of 4652 1132 7c1ec43858.exe RegAsm.exe PID 4664 set thread context of 1452 4664 9fd1a2f5ad.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exedescription ioc process File created C:\Windows\Tasks\explorti.job f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
35ece3dd27.exef1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exe7c1ec43858.exeRegAsm.exe9fd1a2f5ad.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35ece3dd27.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c1ec43858.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fd1a2f5ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 3484 explorti.exe 3484 explorti.exe 5932 explorti.exe 5932 explorti.exe 6008 explorti.exe 6008 explorti.exe 6008 explorti.exe 6008 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe Token: SeDebugPrivilege 4560 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeRegAsm.exefirefox.exepid process 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4560 firefox.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe 4652 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4560 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exe7c1ec43858.exe9fd1a2f5ad.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 2072 wrote to memory of 3484 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe explorti.exe PID 2072 wrote to memory of 3484 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe explorti.exe PID 2072 wrote to memory of 3484 2072 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe explorti.exe PID 3484 wrote to memory of 1132 3484 explorti.exe 7c1ec43858.exe PID 3484 wrote to memory of 1132 3484 explorti.exe 7c1ec43858.exe PID 3484 wrote to memory of 1132 3484 explorti.exe 7c1ec43858.exe PID 1132 wrote to memory of 3596 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 3596 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 3596 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 1132 wrote to memory of 4652 1132 7c1ec43858.exe RegAsm.exe PID 3484 wrote to memory of 4664 3484 explorti.exe 9fd1a2f5ad.exe PID 3484 wrote to memory of 4664 3484 explorti.exe 9fd1a2f5ad.exe PID 3484 wrote to memory of 4664 3484 explorti.exe 9fd1a2f5ad.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 4664 wrote to memory of 1452 4664 9fd1a2f5ad.exe RegAsm.exe PID 3484 wrote to memory of 4468 3484 explorti.exe 35ece3dd27.exe PID 3484 wrote to memory of 4468 3484 explorti.exe 35ece3dd27.exe PID 3484 wrote to memory of 4468 3484 explorti.exe 35ece3dd27.exe PID 4652 wrote to memory of 4912 4652 RegAsm.exe firefox.exe PID 4652 wrote to memory of 4912 4652 RegAsm.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4560 4912 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe PID 4560 wrote to memory of 4856 4560 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe"C:\Users\Admin\AppData\Local\Temp\f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\1000036001\7c1ec43858.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\7c1ec43858.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:3596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {004e016f-6b50-494f-887f-772fab7900eb} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" gpu7⤵PID:4856
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b401917-7c7d-4194-afa5-0995316082a6} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" socket7⤵PID:3384
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -childID 1 -isForBrowser -prefsHandle 3236 -prefMapHandle 3192 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f419b129-0f7b-4a98-99e1-99bfdd5e15ff} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab7⤵PID:1092
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3656 -childID 2 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2236366e-b312-4bfb-b5c1-d80d1114a3d5} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab7⤵PID:2916
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4344 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4336 -prefMapHandle 4276 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c39558cb-7147-430c-829b-dd43e3abe844} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" utility7⤵
- Checks processor information in registry
PID:5456 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 3 -isForBrowser -prefsHandle 5504 -prefMapHandle 5492 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c9990b-ad79-4db0-a32d-3ae571d15277} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab7⤵PID:6116
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5648 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b751b9c7-087a-4798-a304-ba58e72a3c6e} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab7⤵PID:6128
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 5 -isForBrowser -prefsHandle 5940 -prefMapHandle 5936 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0e95c9d-6795-43b8-ad61-3a544736e587} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab7⤵PID:1912
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6412 -childID 6 -isForBrowser -prefsHandle 6424 -prefMapHandle 6420 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36b23759-6455-450e-88c4-8a4b3d223eff} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab7⤵PID:5356
-
C:\Users\Admin\1000037002\9fd1a2f5ad.exe"C:\Users\Admin\1000037002\9fd1a2f5ad.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1000038001\35ece3dd27.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\35ece3dd27.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4468
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5932
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6008
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6008
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5023067031c6cfdf586bdad2cab514c6c
SHA1831efce5366ab12d5f63079d0767048b8333bfbf
SHA256f7de5cbeab4c68986a67448e0efa72b244ecd86eca1cc8bf373168b6fba454de
SHA51259c96c2b182702793abfd5d89b2572f27dc5275aafdc13b7b373e20910ea06d155532a28cc9d9339d0a5b3ea60c5aa7de57f74521ab3ea56122a51f39e006ccd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\activity-stream.discovery_stream.json
Filesize38KB
MD5fb9da356fcbb08c9c44a6e87c07dedb0
SHA1905a450c0ba05432a1a99ff55bb259fad9824850
SHA25665236722d7098abd5486837ff37e25e18f9789b6209e0dd63d83f4695d5eab24
SHA512386ee7eabac8a55a76d8e1cbe8ba03af4458901039c9b605f52dc0745ce358e045922868e5fdc0f25295b17898b8f9d03597e0ac5842830f0b14f6b892143aa4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5f363529309c2c2cd2e659811c3b31af4
SHA121850969959b8ea4256d9bfedb48201a2c1008b0
SHA256f5a1da3678a118cc6b0b0e160936b4e9de0d817d6950320d3ccbaa7df0abcb90
SHA512b073d8cbe791acf4b1c2b9c3abd0e444ac1b25e6cdae430c02a71a6894e5e9a28d8ca86bdd56078ddb6500ba8804038d49555e809422a74bf2a91bdae44d7fc4
-
Filesize
1.8MB
MD5f3ef6ea2a9629f605bb4c6bdd197b3e1
SHA1ffc67e08bf3897b3b6d8eb45150ddfab9d11ce96
SHA256f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0
SHA5123e769090ab70a81bcf37e01701ff1e1f6081c3258e65dc25d16f19ac7804ffbbc0823229bc765465d0c7a7e24514524a9a007d6919a2fe098d6be026ac3c44c5
-
Filesize
1.2MB
MD5fdf21f3d12ad57882b440a836e1d34cd
SHA1989c59558befc0b36398f37ffebe3e7a1e547d7d
SHA2567a70259c92053fe11ab86abd7939df74094b9a62617d146eaeff3b1fbbdfa6af
SHA512dcca41ee0f1df37fc5deb762f272dd763f2078f404dc615973231e2f6d360b4a18e331be9060ae3b70337efc4484bfc5f13d7e2cc0d1fe57cbd309146425959c
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
Filesize10KB
MD57a11ab3bd24fd1c9cdf57eefc1c4d1a7
SHA18248c6d96ef0026a93e4441e0e1759a2f779884c
SHA256e86af81739b9494132f973b0b433d24141e10508c603660ecbd94e36c1db52ed
SHA512e778136c4d044c994a034f9a109574fd2ac1aa220e88520d19dfe3a5557167c8f040127098d105f9062a5095338b3bb8956e67f18e34caaa2bd8785fa2594b60
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD573032c3aa923d3ccd86f7a4dd1a56d62
SHA102f5e15216a3d3c77db54daf7cbb5a8c417f6ce0
SHA256eb12b063ddf1aa2c3b2ba537ea801e9fd88d3c98dc3057bb2eb857daab9e666a
SHA5124abb2420339a229f2574bf0e25eb9353c663442801c94044de91aaf78bf52047613eb5d229e44f3df8f95fd00c8a32ecd298efffe2a7c10f22086dad578b8cb0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5b87e9312e940c2b9a17c734a0e7c1341
SHA15f115f90daa382a0f0cae54ee7e6f2f16c168dea
SHA256f3b8862340f73695361033ab1c79c0af0cda759c41262063796d4684b8dedffa
SHA5120e751d1a9f243f06a04468b33256b5c61582c6abc303bacda639a974070b99694f0ca23c7c3dde6774108ef407323d3956ec00404cc72b703889870c285c0b61
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5316f7223e4297cab2fb0e5c428cee9b5
SHA13fffdb36a41b3aa6257297500a0aff944c505f91
SHA256682e3c7e4173ab893fb9ece1c5a703d9b49ceffb9c8695d43e3ad2422f69f416
SHA512147b3407a181d68e41cf13db1db3945f129ac725ca61bb8b0f5f10d2e826501bfe88e7a09dcc32d0dd9d9a6518318c075dd8a56054bda51e7157244d666bfb05
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\3ce457bb-1159-4cb5-a62f-20c84a651fae
Filesize26KB
MD5e6df05dd08aca60d1a2999d42beaabae
SHA108a15936e1a263507243acef0742a249515fc8d9
SHA256ddc018bf322f9b285d6cd1ba0f7817bbdbaf7a603c2f9202fd715a653657259a
SHA5126c0072dfe3bcc682ce20fb5d7f17e2c529be773a3adeb57add96c96c4a375679ca978d38908f25df762fc6a12c7621063849e44425759cfc8fe37fd92b133b54
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\c7806fcf-9fd4-4f47-b21d-54223d5a5ddb
Filesize982B
MD509ce1066daa06fd3d27c6a221cfebe82
SHA1799ccdc89a719eaa407d87a49f5f6af03fbb192d
SHA256dc762415f91d4e4e2ac9ee3431c14018d48b52f581a4bff149063e11d9b2b1b1
SHA5123a4fa79a72d2d05bfe65c78d18f4cee8a78fc87958dc4d531a731bea18165043e508ef5062a31cbfade71150b60fd036f5cca9d34cb47d196e9c865a43a5cd8e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\d56b220c-df1b-4ff6-bf1a-a24587dd9aeb
Filesize671B
MD589af6c4c846163be7304dacf66eaabed
SHA137174669e2d3144c29a068f38a112ea1fb822249
SHA256b5e05cb0bf59d07a3f22b98c80c6615a48cb6efb1fd3e0e49c8be571bfacdc47
SHA512c57901afcc34a299368b59df0b0f134644b69b9144585443e422f42d14591fb775f44e44d71715e9fc2dc5273399ad70927ce402ed5e8396dfecfa9c713bf7bb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD5dce0df233aa56badb780ed8b3dfbf9a5
SHA19e370fa9f62b1785664ee1413e0136053fe07f91
SHA256166cc8efdf693abbd45553197634052e1105ec5ad2e8540050516e4352cf5660
SHA512ff88590fbbb94260a492bc78e38eb946bac072aa7686a13014c44fcd0b80f5364d3e9103af9a2cbe35135b55daf8fc5b71e303d57bb23723cf95d3296bdae3cc
-
Filesize
11KB
MD54484f2590486977c64ce0152c61a8174
SHA1105fc8df6817efab85a274a405d5f0591ec39a93
SHA256ade13abad007bf65d7171da92fe5a816e889d94e0ba5767ef431da96bc3cb081
SHA512848312587e9d4032679dad5d94a80d41e62836c957e17f730451ca7c6700fc6fec725ab24c71070ce4edcd070efb1caceec0f0811da4182e662a87dd50899f3f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.6MB
MD512b6449b433bf3780432875225493e29
SHA107cba346c423fd7fcffe523fe0b3a6ce6396aecf
SHA2565495cdada397fc02382fdc66f1ea9bbd3961cf63c80c52fd2b3560d3dbbf39b5
SHA51284c084a581af003f0e62bc0e98332db254c636385a14a7d1c28906792d38d77dc5b02b6c0cb8863c31ebf6ec02f103c0861793bf37f3b8514ba97513b9a0c298