Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 10:02
Static task
static1
Behavioral task
behavioral1
Sample
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe
Resource
win10v2004-20240802-en
General
-
Target
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe
-
Size
1.8MB
-
MD5
8f051507449e73b6415351694009fb14
-
SHA1
44beb908fb82d6eafd3050544695b6ffde58c50c
-
SHA256
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf
-
SHA512
d8b4aa25dcb073a09d2ae78de0a9eb50e3ea744a65853ed61e5a6a9c6389495b1979cd9ba6f976b2c2cc4b65c588fa62a8482b3a7ffca83cff1499c1394d6a31
-
SSDEEP
49152:giC9An4RqHLNifybQPOG15yY7qtS4ai3B9moryzTVNL5:Hf4RqHgmQ2EB2B9DryzBNL5
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
explorti.exeexplorti.exe9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exe9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exe5dc03dbeaa.exe0ae611e92b.exeaccebe5e21.exeexplorti.exeexplorti.exepid process 2028 explorti.exe 2136 5dc03dbeaa.exe 4468 0ae611e92b.exe 3640 accebe5e21.exe 5820 explorti.exe 1492 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5dc03dbeaa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\5dc03dbeaa.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/4840-44-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/4840-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/4840-48-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exeexplorti.exeexplorti.exepid process 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe 2028 explorti.exe 5820 explorti.exe 1492 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5dc03dbeaa.exe0ae611e92b.exedescription pid process target process PID 2136 set thread context of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 4468 set thread context of 1432 4468 0ae611e92b.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exedescription ioc process File created C:\Windows\Tasks\explorti.job 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
explorti.exe5dc03dbeaa.exeRegAsm.exe0ae611e92b.exeRegAsm.exeaccebe5e21.exe9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dc03dbeaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ae611e92b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language accebe5e21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exeexplorti.exeexplorti.exepid process 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe 2028 explorti.exe 2028 explorti.exe 5820 explorti.exe 5820 explorti.exe 1492 explorti.exe 1492 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4744 firefox.exe Token: SeDebugPrivilege 4744 firefox.exe Token: SeDebugPrivilege 4744 firefox.exe Token: SeDebugPrivilege 4744 firefox.exe Token: SeDebugPrivilege 4744 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeRegAsm.exefirefox.exepid process 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4744 firefox.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe 4840 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4744 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exeexplorti.exe5dc03dbeaa.exe0ae611e92b.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 1672 wrote to memory of 2028 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe explorti.exe PID 1672 wrote to memory of 2028 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe explorti.exe PID 1672 wrote to memory of 2028 1672 9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe explorti.exe PID 2028 wrote to memory of 2136 2028 explorti.exe 5dc03dbeaa.exe PID 2028 wrote to memory of 2136 2028 explorti.exe 5dc03dbeaa.exe PID 2028 wrote to memory of 2136 2028 explorti.exe 5dc03dbeaa.exe PID 2136 wrote to memory of 1260 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 1260 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 1260 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2136 wrote to memory of 4840 2136 5dc03dbeaa.exe RegAsm.exe PID 2028 wrote to memory of 4468 2028 explorti.exe 0ae611e92b.exe PID 2028 wrote to memory of 4468 2028 explorti.exe 0ae611e92b.exe PID 2028 wrote to memory of 4468 2028 explorti.exe 0ae611e92b.exe PID 4468 wrote to memory of 3096 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 3096 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 3096 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1176 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1176 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1176 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 4468 wrote to memory of 1432 4468 0ae611e92b.exe RegAsm.exe PID 2028 wrote to memory of 3640 2028 explorti.exe accebe5e21.exe PID 2028 wrote to memory of 3640 2028 explorti.exe accebe5e21.exe PID 2028 wrote to memory of 3640 2028 explorti.exe accebe5e21.exe PID 4840 wrote to memory of 1712 4840 RegAsm.exe firefox.exe PID 4840 wrote to memory of 1712 4840 RegAsm.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 1712 wrote to memory of 4744 1712 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe PID 4744 wrote to memory of 2816 4744 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe"C:\Users\Admin\AppData\Local\Temp\9bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1000036001\5dc03dbeaa.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\5dc03dbeaa.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:1260
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53cd63bd-7d36-4592-8d1d-f09f8702cf73} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" gpu7⤵PID:2816
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cded2ef1-25bc-42b3-bf8d-ccdfae4dd588} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" socket7⤵PID:4964
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2844 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 1452 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a8b8e0c-053e-4b43-9f62-de07aea41d70} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab7⤵PID:2660
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3856 -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 2928 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d6a7056-f96a-4cfc-b3b5-3b6838778903} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab7⤵PID:60
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4192 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ef2c871-5550-41fa-8530-73cc6113471c} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" utility7⤵
- Checks processor information in registry
PID:5376 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 3 -isForBrowser -prefsHandle 5396 -prefMapHandle 5416 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {110df10c-65ab-474e-bc84-2d98eca79637} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab7⤵PID:5872
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2ca0008-79ad-4493-a3c3-c8768fc0c0eb} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab7⤵PID:5884
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5768 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a68c552d-dfb4-4b63-8094-69c462e71725} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab7⤵PID:5896
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6320 -childID 6 -isForBrowser -prefsHandle 6248 -prefMapHandle 6252 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90026601-6797-42c9-a5f5-48152472f083} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab7⤵PID:4540
-
C:\Users\Admin\1000037002\0ae611e92b.exe"C:\Users\Admin\1000037002\0ae611e92b.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:3096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:1176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1000038001\accebe5e21.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\accebe5e21.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5820
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1492
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5fa5cd7b86d35c07d61b9251b3d6813f8
SHA1d484235241beade85f2ede79d38ba56dce5d59c7
SHA2561233bbb7a019e56b109ca8606b713aabce6262fb7ff45ea4c854f15380843a96
SHA512572d502952a422f23bf7d5f633833808d710c934df96cebe2d2fdc938cf4bf585e69ce9c492bc2aa06400eaf34e901ca7b18d9893a47dfa811ac3059023af36d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json
Filesize44KB
MD57e6b3269e2eec67152ca4d906d948dc2
SHA129a27c679dfe1dec37ef4c048e34e376e7c20241
SHA25619e8d54344cf51bf43bf6dbd9534395127d73cfba01ff9671f05266a11db7bc2
SHA5122beb916c06cc14f2f832a9bbe18f9ada528341267fcbaf877f2654c1ba6357aa18f1696b032e2d966a4259902f5806def87e71a16dd5f38006d043563c127cb2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD58653104a1496003ba7bdd0f0fd24ae2a
SHA1c29c906516f252bcc0e1cb3bc98250082a96c1ef
SHA256f45df1c398c4a6f5cb06434a7e305637152fe990780d60d6ada548b16cfd8bc4
SHA5122627fcb1cc97b5558f84cbfe837537123f64bc44c5276bc3e840e60b6cb70695333e9826098b47d7694cda7c497de946d106c85c89963637db3990070919e89e
-
Filesize
1.8MB
MD58f051507449e73b6415351694009fb14
SHA144beb908fb82d6eafd3050544695b6ffde58c50c
SHA2569bb50c79fcd5eb36eeacb3977ab999d0b63fcf95c1e3cc54447b9fb3dfe336bf
SHA512d8b4aa25dcb073a09d2ae78de0a9eb50e3ea744a65853ed61e5a6a9c6389495b1979cd9ba6f976b2c2cc4b65c588fa62a8482b3a7ffca83cff1499c1394d6a31
-
Filesize
1.2MB
MD5a97c9397775e0bf9e8270435d4a10385
SHA1fc5479bffdf093b01b116a5c11afa5d4bbddbcfd
SHA2562c84872454e51e5b18e070e7305edf9a164c9e8046d2606335bfe424c748856f
SHA512d413e31614513d900c17a9fbbc8b9ae17f87bae0047f344897bebdc1612f2e532be27c165a7675a8410f8626e070ee89e287d173a727d26334ab05168d39e8ed
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
Filesize10KB
MD55cee3d2234fa5dece3f77dcdb995e915
SHA16afc08b6064e19c113866a61c8558b3879f2f51e
SHA25686da902ed7a948dd803a1fcf694d6ce742a4351621dd6081da7e4aaa2775ef4c
SHA512cab7a8a5c7038d341475bf88874136752828818f6bc8b524dbe3912063a5a02c4830ed7be8ff322d466e8d93c3927632e6ad42176fb672344942e269c2e9743d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD55fb58c20572ac69a496706caa2315785
SHA177213f70ebe1a667601c2905395defce7af52309
SHA256e66abd12bfd862903defbf020d9467b5d1bf9f49b2fc65b50a45d69215ac70f3
SHA51276d6b48159197da3e10e1d9f3604c67dd63faa309d7d0c0659275cfdb27311b05c7be8c2e701ce80727088173d17e4d5e11fec4e68bef75e3158fe4860ca79f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD59d14af02283d4488bf4529b2900a6f0b
SHA1ed6d11195c47b3c5d08ba64f519aa91fa41a7dbb
SHA2560ed334463426583113e81b765a64b845986af2c7f7f493ef170fa52eecc68ee5
SHA512422dc9b33635ed7d9929aaf0e7c4d1317dd5d697ce04a0dd46c4e529e48580555795e90bd9082d4488237ea494eade974e097ef28242ccc005fb29b2e7032e1c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5756111da4fc5c532cb635ffaa4bca8db
SHA106ef7dd40c5d4e85c11d644f129759fcc153f349
SHA256dcef3ffbd4c748c505e47b9d19374fe7441e960c6645d1f898116c7462fd3f45
SHA5123411fb86bfbadfdc6497d641fe65eec3cd19e7af22c84e9ddab200150981c18e7e8a6c210e0cab6007076a3bbf4840a6a3e7c8a59f2a2f4846298ab17cc521bc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\9fea4a10-3057-40a9-90f8-a1f3f28579fd
Filesize27KB
MD51c4060bed0d42b614640cd9b8aac946c
SHA1b995a82329bce5e81830f91ba701e454ce9b33f7
SHA256c76e38ebcaacab6f606cb6e06424a9910fd4d08a67bec4c66538d5f7726354c3
SHA512b9310449b370df2630a894bc0de162cd83668926e1ad2de2b4e014be4d5243bd65cbc58995d2cea4866a68c4fb01ea2d233c81649766621271a5a98fdc37ac81
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\ae5cb4ff-e892-4b0a-86b5-d13936e28ebe
Filesize982B
MD5efc930c48f415ea531d8987563fdb8e1
SHA1cbbe7dd2496aa3bbcdc2e5d758dcfa17fcb2c061
SHA2563cf3e41ea1f56c330b209374fe55563e01b18a9136a35c56cd837ffc1b3bc99f
SHA512f72607a35b59814524917b9c73cdb35f63fd9a55ba4e0f7d921ea8663699a6000abb150a5df62c03f38f76d5cb3cc959228f1bb4cb772fe56236c668727e07bd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\bd175d18-314f-45e1-9c16-56b5cb2be649
Filesize671B
MD56e7b03d91cc96eceda2dea3a0605fcf0
SHA18db9e9677f8df5c75e9614d83778105e3f8f65a1
SHA2560da2f355bebadce6b46dc9ea957d09003755b6bfb3d765809fd8569700510781
SHA512a15be2d11e0996ba70326ea8aa949611d84fae678c6f91236b6db1e1d8d3429eab54b1844ab22bd312d0dcc8e24197fb0c1044b3c50eb5ad3e3d1f4f7bdc00c0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD50076fdf23f5c7feebdb0107a2192e98e
SHA1222402f9d190fb93f68fd28dcbf0526349f68c0d
SHA2566506573771271af192410bcab8b451702969943a56b0f3628d6f852871a7d7c0
SHA5124dc2abab28878a260e53a8c12f2f19085e603ee9101267b5615124673e6e57ff935e0ebac39b62b906b42d031456af1fcf83dce68d4d2c0aafedace1cfbec3be
-
Filesize
13KB
MD54a0812199810a580a24151d7788aafe7
SHA13f1d35c9fbe34b13a5a45484e27f97951ffa0ce8
SHA256dfb34bcfbadefc32f7c661cede992d214add39c53b8b2c3e3e2304b18912b22b
SHA5120983c12ae117a2e02291a6a8088e957432c160c269e0bc2ed952b1b7e2324482f87969977870d6f1821b38a3bdae5eb0790e39e73c83d6e35371b1be4f619301
-
Filesize
16KB
MD5b8dc72a757f11f8c727a136af1afd534
SHA172f21bd3ea65de67c362304d4d5dee8c5c504da4
SHA2566a70b7ab004f977aaeb6904b43ab12e549adb9be08d49dae7f9ecde8c68d52fa
SHA512fdf036dc98f1bd5c2f058da124d17a99ca97ec4cd7f747d1e4e8baf324ae0de164249ab974cf47151b72f4d5c7cf0276055ca0cc1f7ab425e93e3f90a8092737
-
Filesize
11KB
MD5e11fdb42a40d05139c422a5bb087c212
SHA1e3b1cf39ff206441772eeb28cfdaf2e4bf83cc8c
SHA256d79409af475ad0f211bf2b9cf248b71781dacf2278b91130260ad794fb32a23f
SHA5125ec91a2f31781172cb60339c37743d43a2fa5947a619fcc7ef28b2dda5064ff28bdc382c10d3f26261152177e74158bf8a5232cf2aa0c7c2802eccec6eec78c3