Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-08-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe
Resource
win10v2004-20240802-en
General
-
Target
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe
-
Size
1.8MB
-
MD5
5193ccd3d4b697e58c680bcd4954dd6e
-
SHA1
1faafc8d8f4ae43f14523d3d9ccab85c6e79af10
-
SHA256
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189
-
SHA512
e2f53360c3e07cc56b140ffa616f4fd0e9f2e6a1df82d8f434db1ff4a0aa5d657edb8b1fb03704980fbad23b240e2196dd67c6000fd1ce8f1732783e86f19c4d
-
SSDEEP
49152:v0A0UJmzu8TD0P7mVi4onvOqYhEXze9kxQ:vJ0Jq8H0zsPU2byaCxQ
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
explorti.exe6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exe6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exee6301dcfdc.exe1f852a278e.exe3409f4d3ce.exeexplorti.exeexplorti.exepid process 1872 explorti.exe 2968 e6301dcfdc.exe 1480 1f852a278e.exe 908 3409f4d3ce.exe 1028 explorti.exe 5220 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exeexplorti.exeexplorti.exe6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Microsoft\Windows\CurrentVersion\Run\e6301dcfdc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\e6301dcfdc.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3612-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/3612-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/3612-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exeexplorti.exepid process 2764 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe 1872 explorti.exe 1028 explorti.exe 5220 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e6301dcfdc.exe1f852a278e.exedescription pid process target process PID 2968 set thread context of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 1480 set thread context of 1552 1480 1f852a278e.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exedescription ioc process File created C:\Windows\Tasks\explorti.job 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
explorti.exee6301dcfdc.exeRegAsm.exe1f852a278e.exeRegAsm.exe3409f4d3ce.exe6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e6301dcfdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f852a278e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3409f4d3ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exeexplorti.exepid process 2764 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe 2764 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe 1872 explorti.exe 1872 explorti.exe 1028 explorti.exe 1028 explorti.exe 5220 explorti.exe 5220 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4760 firefox.exe Token: SeDebugPrivilege 4760 firefox.exe Token: SeDebugPrivilege 4760 firefox.exe Token: SeDebugPrivilege 4760 firefox.exe Token: SeDebugPrivilege 4760 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe 3612 RegAsm.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
firefox.exepid process 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe 4760 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exee6301dcfdc.exe1f852a278e.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 2764 wrote to memory of 1872 2764 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe explorti.exe PID 2764 wrote to memory of 1872 2764 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe explorti.exe PID 2764 wrote to memory of 1872 2764 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe explorti.exe PID 1872 wrote to memory of 2968 1872 explorti.exe e6301dcfdc.exe PID 1872 wrote to memory of 2968 1872 explorti.exe e6301dcfdc.exe PID 1872 wrote to memory of 2968 1872 explorti.exe e6301dcfdc.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 2968 wrote to memory of 3612 2968 e6301dcfdc.exe RegAsm.exe PID 1872 wrote to memory of 1480 1872 explorti.exe 1f852a278e.exe PID 1872 wrote to memory of 1480 1872 explorti.exe 1f852a278e.exe PID 1872 wrote to memory of 1480 1872 explorti.exe 1f852a278e.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 1480 wrote to memory of 1552 1480 1f852a278e.exe RegAsm.exe PID 3612 wrote to memory of 756 3612 RegAsm.exe firefox.exe PID 3612 wrote to memory of 756 3612 RegAsm.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 756 wrote to memory of 4760 756 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 3004 4760 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe"C:\Users\Admin\AppData\Local\Temp\6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1000036001\e6301dcfdc.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\e6301dcfdc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1880 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea653c3f-04c2-4709-b3bd-f88604f956ae} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" gpu7⤵PID:3004
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2384 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c33d286a-e6a0-41be-ace6-ffa6c2bf187d} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" socket7⤵PID:2612
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3204 -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3176 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c0281bb-2695-4b52-83db-c4f3f3c42d5d} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" tab7⤵PID:416
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -childID 2 -isForBrowser -prefsHandle 4108 -prefMapHandle 4104 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05c5dd76-c72a-43e6-9b7a-997e360b93ec} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" tab7⤵PID:656
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4292 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4148 -prefMapHandle 2756 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76e3bc5f-bd1b-4a61-8529-9dbad3f12718} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" utility7⤵
- Checks processor information in registry
PID:4696 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 3 -isForBrowser -prefsHandle 5444 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84ab2751-4cd3-4cde-a02e-5bd2f6409434} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" tab7⤵PID:5868
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 4 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90af4a7d-64a1-4821-ae7d-6f9aa0d77cd8} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" tab7⤵PID:5880
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5864 -childID 5 -isForBrowser -prefsHandle 5784 -prefMapHandle 5788 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d61bf1c-cef9-423d-a8fc-adfb339a6e58} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" tab7⤵PID:5892
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 6 -isForBrowser -prefsHandle 6012 -prefMapHandle 6140 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6dcf360-4d97-485f-ad7a-8f31be6c292c} 4760 "\\.\pipe\gecko-crash-server-pipe.4760" tab7⤵PID:4628
-
C:\Users\Admin\1000037002\1f852a278e.exe"C:\Users\Admin\1000037002\1f852a278e.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1000038001\3409f4d3ce.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\3409f4d3ce.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1028
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5220
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD5cce7286520fba2ea0ebcb5ded18c5ee7
SHA106879b8744cccd54fdd33dcb0c9309e60a416386
SHA25699a73b9c1d55b09c417d4b106a761619e8733f04569665708dfd6b7c3b03061a
SHA512f1b350449b3d6bb9f1b234868fd353cadc9a33fac368519589d3ccb24ab60ba1081fe92a363ebecafd49ad066003525cec292dfd6add3c8622bdbc4fa1c7658d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\activity-stream.discovery_stream.json
Filesize36KB
MD5f54ed9f30158afdfa55492d81d3e9138
SHA15ba5ef1b9b977ef8246ee3570ac569089d1d43bd
SHA256eb8697199ceaaf0676c22de98fff59c26270b2db6d57fdd62c1bca15c0c01aed
SHA512cf7586bcbc17dc827fecc6285a8c3765e3927b94b8b3dcce270a3cd86ccfe2368f9744c77b2ad54cace0f071898930f8296bc7a2bb6792c3fc97dd8e424b9c07
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5a1c40b4413e966c7f751f7b1f75f414d
SHA11accc332755e3bb46dc2406c3c2d6f15874e48b5
SHA2563ebe5058ac0564dc2f9b74681e0d09171389d436629b2c1119d3c037c4b1e2a3
SHA5122abf761412cad714d4d08addf8e8af14b7c783c5f9c1269bfd641aa495434335350d44a611b7360059cb5cdf0db17dd2b8a85435c07a4deaaa04f97df2206013
-
Filesize
1.8MB
MD55193ccd3d4b697e58c680bcd4954dd6e
SHA11faafc8d8f4ae43f14523d3d9ccab85c6e79af10
SHA2566c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189
SHA512e2f53360c3e07cc56b140ffa616f4fd0e9f2e6a1df82d8f434db1ff4a0aa5d657edb8b1fb03704980fbad23b240e2196dd67c6000fd1ce8f1732783e86f19c4d
-
Filesize
1.3MB
MD5a692e9aa849f2e4ef174116c2c7ff1f4
SHA1c6a830449f364888bfdf84b93b50bd2091ceb195
SHA25668418f2dfa408b5d47bd6dd209a2c51d86d946448cdd8533e01aaf663bd37d25
SHA5120ff667c1371512f4794e97344c220bba2baa4cded3a4b6cd7d628e61f0c171fbca4b607df3c4f323e21c7329cf5bdc565ffa2a2c3bd9ae0a7bac706b7e24b335
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin
Filesize10KB
MD5ddd967434d6549050910b1e396a4669b
SHA1e0fb032b40877d4c7e096bc5b8a1041bdefd75d8
SHA2560dac4c26173518fc2bee95960a2357517b4500ac02e05b89d8b91485ba078c1e
SHA512e233ba93449ea482710622bae59e809f1e04bdeaeef1b7b7debfca2d5b3b15250f1088d888a12176a99474909101a6fcafe704f59de1335491682502c3ae53c9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5021492de67e5e8bd65d6f409b71fa56e
SHA1bcc1e57243927dcc00505f4838000230278b07fd
SHA256e78f03dc840efa3070f9d4ed76b38598298658422462e2a659997356b3ff12c4
SHA512b19e62732353ef916e831f93d335b4df257c440c9b82bdc0b2724dfde771a5ec326f96862f5c52432f7e6e1ebe645ca9687b22c759450b22ef4e058666195b31
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5e53ee446894b99636622e096ce842cfa
SHA18d4b606b63698de759a3ae1e4de75283b6ec8321
SHA256cf36d8acfe236daef7c5557c9ec50871dac14020422e5a0d657a56cf2c740264
SHA51291b6e2160aaaec17aa3b6150990d203d8af9ef45eee08e6cb56305c4ee9a5ae82d7d9ddea71dbde8a370418413571600d03090a731b52f2656825e6c42ec3aa1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5e75f84ce683d5808980dfee5aaff3e31
SHA1ea8e5da8aa7789300c9d6ca37f460e127ad23dda
SHA25684aad4d2da53f8a054ec3147cd4750f1e4346a60a1aeb1db32c0fe81697d1cbb
SHA512775278a3537d2ee1bc45dc4ceee530062953b3d80e433f013b8d98fd10e9c94800f1e14a8a875f22c1b4217a7981672cbe65209fa93c8afc80fa776ba02ddb67
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\1da8ec32-2e84-4c00-8840-57633e88c657
Filesize982B
MD5977f4d4ddb0727430f71ac9fda644f7b
SHA1f5929ad1cf0f40694b0708e5e62cea4908ba4a92
SHA256991ea9de19394dfb752bcf884e45f28b9b5192d9794816b541d9d7e77b3e43e6
SHA512ef1e7e9e51c179e0996b75ce3143df9f4bddb2be248a46a20d454b5b0e8639248008742d42a975a9514b7db069e2c881a5041edc927778e1088b57ea69880b38
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\42e63c76-a520-443e-8b8e-d377bc25b117
Filesize671B
MD568f72a25d7807f806811421d2698b93b
SHA109a7e9058c86d0e9bdd10354201d755346fa870b
SHA2567a1840d38d52ae7d681e007a33f8173a69471569c6b8b203c4f74c4f2cf1731e
SHA5123cb9accdaf92d7a597d853beb8000ed373453584f15b3237f5e4ee32967e3319e7235b1bb5e928b0e6ae6416eaa1832bcb0a3f1048f9f79e4ee35395610a06fd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\aa6d3717-9e49-491b-880b-2df21624fc9d
Filesize26KB
MD53f9fe90a0c66dbbf905eeff290a1b6bf
SHA120397a8f177b1a62eb9d7a348f642a2583a1f53a
SHA256038629f9677d35c5de2965bf91cd382990665502653e863f10fde63bc20727e8
SHA512481d88eb971bd2c0e0c718b3444967a19d5eafd80908a21439996065615fb3d3580b79b021031b0ea8af2c5b9a7a7072caa8eaf2c84d30830b3961b85e1f8ea9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD59cbfa875d46bb03eb05798097c589657
SHA1b5cb68a11ea2b8fcbe69912dbc3bd068e3ed69dc
SHA2567b23ca38af1864e299422edac8e9dca2e4e2e27281b5c74662c1a15f5baf6c44
SHA5123ae907b3b380c0732c65560d7a13f5e05b0f261418f1cab728ea746917b9994a9cea0ad0a7106884c438821a37ba19ce0170a4c045a8d0f7602556989b12ae82
-
Filesize
16KB
MD5816043397734e69c6a641f142c7ae289
SHA1bacb4ab7c1a78565dd5153861067634131b0340b
SHA25666412697266534c21b1382962cad8f3a2235aab78986a2f438aeabc5ac996669
SHA5128b6fbcf5dc7517d0d926b50a2ff3c2f68730cc7554bed1d45b90d0f9775b6baf376d609f420217f5af10141fd35d229260da4cbc8222af64db39601a8f94ef1b
-
Filesize
16KB
MD52f4f28ff3094069c7984d673565fad10
SHA19c4d0c373de99607d4e36a6630c1dccf143bb856
SHA256fac60cabb62e658c549bb9421c4bcc83baf6d31342de24fe5df3267be5d4f61b
SHA5120ce7960f71e774feead3b1fc207b1b70a16356befdfba1d4c9b9963f283262dceb7b58f4ab87b9a421d9436095fcd4c347c688547219c950ba06f0a72cd6df1b