Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2024 15:00
Static task
static1
Behavioral task
behavioral1
Sample
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe
Resource
win7-20240708-en
General
-
Target
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe
-
Size
1.8MB
-
MD5
6d0f73b4a2b84bef406470efcd79a990
-
SHA1
3e76cd04a8655c14330a7392bbeedb2e17f2e015
-
SHA256
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf
-
SHA512
54ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d
-
SSDEEP
49152:HfpD+gCvPwVQBncS0hkViHM+aWKdya3dW:HxKgMw6cS8kEHfaWIyaN
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exeexplorti.exe6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exe6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation explorti.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exef54a68e4b7.exe83baa72830.exe6a6c2648f4.exeexplorti.exeexplorti.exepid process 2276 explorti.exe 2076 f54a68e4b7.exe 1804 83baa72830.exe 1636 6a6c2648f4.exe 5984 explorti.exe 2380 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f54a68e4b7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\f54a68e4b7.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2352-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/2352-50-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/2352-48-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exeexplorti.exeexplorti.exepid process 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe 2276 explorti.exe 5984 explorti.exe 2380 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f54a68e4b7.exe83baa72830.exedescription pid process target process PID 2076 set thread context of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 1804 set thread context of 964 1804 83baa72830.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exedescription ioc process File created C:\Windows\Tasks\explorti.job 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exef54a68e4b7.exeRegAsm.exe83baa72830.exeRegAsm.exe6a6c2648f4.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f54a68e4b7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83baa72830.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a6c2648f4.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exeexplorti.exeexplorti.exepid process 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe 2276 explorti.exe 2276 explorti.exe 5984 explorti.exe 5984 explorti.exe 2380 explorti.exe 2380 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 3200 firefox.exe Token: SeDebugPrivilege 3200 firefox.exe Token: SeDebugPrivilege 3200 firefox.exe Token: SeDebugPrivilege 3200 firefox.exe Token: SeDebugPrivilege 3200 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeRegAsm.exefirefox.exepid process 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 2352 RegAsm.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 2352 RegAsm.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 3200 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exeexplorti.exef54a68e4b7.exe83baa72830.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 4032 wrote to memory of 2276 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe explorti.exe PID 4032 wrote to memory of 2276 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe explorti.exe PID 4032 wrote to memory of 2276 4032 6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe explorti.exe PID 2276 wrote to memory of 2076 2276 explorti.exe f54a68e4b7.exe PID 2276 wrote to memory of 2076 2276 explorti.exe f54a68e4b7.exe PID 2276 wrote to memory of 2076 2276 explorti.exe f54a68e4b7.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2076 wrote to memory of 2352 2076 f54a68e4b7.exe RegAsm.exe PID 2276 wrote to memory of 1804 2276 explorti.exe 83baa72830.exe PID 2276 wrote to memory of 1804 2276 explorti.exe 83baa72830.exe PID 2276 wrote to memory of 1804 2276 explorti.exe 83baa72830.exe PID 1804 wrote to memory of 796 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 796 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 796 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 1804 wrote to memory of 964 1804 83baa72830.exe RegAsm.exe PID 2276 wrote to memory of 1636 2276 explorti.exe 6a6c2648f4.exe PID 2276 wrote to memory of 1636 2276 explorti.exe 6a6c2648f4.exe PID 2276 wrote to memory of 1636 2276 explorti.exe 6a6c2648f4.exe PID 2352 wrote to memory of 2636 2352 RegAsm.exe firefox.exe PID 2352 wrote to memory of 2636 2352 RegAsm.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 2636 wrote to memory of 3200 2636 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe PID 3200 wrote to memory of 1936 3200 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"C:\Users\Admin\AppData\Local\Temp\6dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\f54a68e4b7.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ff5a678-ce06-40c2-b75e-db90c2d18fcf} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" gpu7⤵PID:1936
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07b9caa3-7540-4b53-9a67-65899fe1abde} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" socket7⤵PID:2228
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1040 -childID 1 -isForBrowser -prefsHandle 952 -prefMapHandle 2812 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eeb7850-069f-458d-bba6-eb4b3bd55603} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab7⤵PID:4732
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4000 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3984 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c8949a-f09d-40ff-903d-b7a7cf044761} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab7⤵PID:3076
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4764 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c20342c6-94ea-4bdd-b629-92ef6e499f46} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" utility7⤵
- Checks processor information in registry
PID:5248 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5208 -prefMapHandle 5152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40e7df2a-af41-42ff-af32-3ece76e1ace0} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab7⤵PID:5900
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 4 -isForBrowser -prefsHandle 5372 -prefMapHandle 5380 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {413f1909-8f93-4d1c-ac84-73e42eabfeb5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab7⤵PID:5912
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5560 -prefMapHandle 5544 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d438dc-84f3-48d3-b510-59385fa41fcb} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab7⤵PID:5940
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6116 -childID 6 -isForBrowser -prefsHandle 5896 -prefMapHandle 6104 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1315c751-cb77-4289-bc90-b350ddbcdaa5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab7⤵PID:4396
-
C:\Users\Admin\1000037002\83baa72830.exe"C:\Users\Admin\1000037002\83baa72830.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:796
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:964 -
C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\6a6c2648f4.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5984
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2380
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD56e9fc400fc9748327378354da7b3d022
SHA18bad09df89fc51f0cfb3209e1b39e15063f5c5e6
SHA2567dd2c5bf200354ec22205f04d5eb6c3e336f49bf2d09809f68ba2ed7f9826f32
SHA512daa0ed49c72b481f4bd898f048f8e9ba47285e845d3e43d8bd17e2801ade49e2d8c4c82bc797723deb8f2914aa9f6e4d0e7ff58bcc0b0195b4499bc5d9ac18a9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json.tmp
Filesize28KB
MD51c436c5a2b11fee1cb52e9cda4d31f9b
SHA1846cd4051211593985b6b64962810f6a3007a84a
SHA256d3249b02bf42f33b917a65bde86de5c661e60867c1c13a85fda2e9aedd0be696
SHA512c3b369d5d222253defc25aa4f775e0c894a70abfdb35f8d63b209d8b78fa2905d7b5201c0836621b74c4fba6ccf2ff6c5047c293f2dbe1092bc730a548e05878
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5b2118ec98a1b3c34240d06cddac5b4a2
SHA18659a1477dead8108e6798a87779fa5d1bf2abde
SHA256d446f246f41c3798dc9c44422e28bd7f84fc77d83e0a47cf32b4aaffcc4b556a
SHA512b8daf61e0bd72e3a3d25264bec5d6d838b3473976f7e6ea7d04870204ce0847f59319af552882dd14edcd04877bb8ccedf757b894c86539ee759f965b2846377
-
Filesize
1.8MB
MD56d0f73b4a2b84bef406470efcd79a990
SHA13e76cd04a8655c14330a7392bbeedb2e17f2e015
SHA2566dc00b02c91a51431b4d9bafbf70bf204de2152ae1391a4e374205939f81c5bf
SHA51254ba08bb0194c37dbbcf0f017ba9f7a87f370b9378e6191c6f4654c479c89de398e4b467d7506dc93f580d4cb773563eaa3c4da97c46e0b10feda0a82a9a627d
-
Filesize
1.2MB
MD5d1be0f6f034c55fc17558f2ae445f1b2
SHA16b7f7599af54f730451f8344906acc7d0a206af7
SHA25621a8a20a3cf2e59afeea5b810da2fd7b132780a8167ab28b0bf8da4d7061478e
SHA5123e96bbee8cb19b3dc7c45d302f5321122722562f2ad41ce9d61bb34d2fdd65c7eaf133bdb097445df327629b2fea78caa22041ca122884a9ec1758da0288f465
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize8KB
MD55cb156a069d3563ff9b577101e596d9f
SHA1c97c0eefdb681843b42ae5593d69adc0260097c0
SHA256f1bef5ce7948c68333ac21f725a1e814f5e7cd380c22f05dc9a5ba46de4fa837
SHA51297c80a90cd08edfbb88b01a9dcd81d1141ca3edcaf23f5cfe2c471c6b99a2d13ac3d48c6ff6ab0113e9d373fe7335f53e58b19a530b51d683259aec5d9a982f7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize10KB
MD54603ea4a81cfa3d9f50c107cd63c5f55
SHA17dc03e1428f4bdd008286e7b3127136efdba3a97
SHA256de3517491936adf55058a590add932feb02032a3f4d239c6fc90cf07b218cec8
SHA512190d75f69d3eb7fbec54edccc54ff6396fe54bad16bd60704eb0a4a7b6f96836898cd36395cb882b0e8a2a3f965eb669d31b736f5d0be8c5fbd40070ad3b1ac1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5b977f336a1b2c8e20e621118c0f96c49
SHA1db29e1e5d64d3af912a8338bd631a5b6bbe4b59a
SHA256c944ffddfcc9dce88edd7f4179a710512d673662119c3deaeef01b3d25252572
SHA5121b1c887a482956fae2123866c8384aafbd68b980d9871a4b0cbb1c4d29eafc322d17f6ed4e119430a013ac01b7e297664b618ad10dc8eb85c8cec4bc68096916
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5b8efbe03d9a2bb9ecde28c4777d2ee92
SHA13fa103abfe50330459bf1e31c00c5fa2693535cd
SHA2568aa993bb4f84d2f25d577f25c0367f0f75414b47add7124d116b416995f5c547
SHA51271659fd2800824ee7eeb7ceadbae258c5becdb3949ba113a655a0808ad28d7238249e3a81963a148f14e7c3d9c75c7b95dda87e647093edb488856f4d10bdafd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5a3fac90a51044a3660cd63c1f727d8b8
SHA1d4e271aac48d0341ec91185d252e85a5498643a9
SHA2569942524c7aab23ea48987b6d88d51fba8c8947799e1361661f8fdc2702fdb76e
SHA51276d9db811174cd65a82d52c7d369b13f667d8fff51b706cda4d84d634310d6c4cfe547b0e6e7d155cc5f253007c11cf9ab000ff9de50c8b7690fb21fc05db314
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6e6cdc46-d4c9-4f9b-9c0e-16225760b8c5
Filesize671B
MD55bf28932fb72dcc6c960d027a1b94463
SHA1489096edcc46023bd2a0c4a00c2ed622c18eb171
SHA25642d2e57fab89fbfa04dc489294a33e0efcfe7ccded22507f905dbc6e79c8ae99
SHA512cd93274e7e2dbebfcc19fb3da9fa76ffab12f4b3b9766b43c82a435527addfd2260404b19a337bac4a585de722e87fa08ebba55dde5a7222efc993f39ed3ad41
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6eb108bf-9950-45df-a8ca-d650e498d0e6
Filesize27KB
MD5f58066910b76d14470635f7113dcb1a9
SHA1821f123d04d0dfdb10a31275e89a4dcf453d7fa6
SHA256c3fc4b37d28f58625e6c75bcc7a4fbf60952de366198dc4a1cbded3eca1e12d4
SHA512929d89915e375a64c8589a8377a7022719d041e2fc42a16f44ea27c4d78a9a2ed8f32f153e36b92bfd566bc5855d7ae7a406e8cf4868f6bbf5655d33fc7b767a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\97e3f38c-1ad6-4075-bf9b-6c0b021ae9df
Filesize982B
MD5f46833c6f9cacf3e9497830fa30b496c
SHA1fef830d3bba846353fc58e92476021f4ca32b482
SHA256be705ef9067f807618f3ff80bf14c564695c027d057596b1cec5a38a2dc50fe8
SHA512a8dcffb58c4895605d23b3015be3a505c4212a2e213701dbb8661929b4581103a5a1603d68c3b1566b97c69800659b514cd2790381a98cd82c9d248ba1b27b9f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD5686ad9efb0425fad4a4a9ca43eedc36e
SHA14f3ac9a0066a25c4aec5c17e821ca75e204bf7c6
SHA25612e23e9d18a7aeba4b600d444331a6d94a8767e5233cedc192774237bc13bf66
SHA5123bdda6d194cdb90ce2316a82b7d55cde3566cd5cb35ce5b745695e6b44d3c93ac26f7525dde9346368954da0312fb1da840ac406af8477b13e1c3020931b2076
-
Filesize
11KB
MD55e65cf50ce669af1495ab893df20e38d
SHA17cd41ee92323632690f7365eea4e6200564c49e7
SHA25602230f6ff7ad4247b5de8bd2339ad06008f737cafe4f41140c22821c37071b21
SHA51248950122e16c20b3ddad244afb6ed26351882ee5fc7586ce35b61863e8153c9e9d7d9d5623f252254b5179768f936e6d1bc7f85e5838acdd83883fab127c101c
-
Filesize
11KB
MD559d81ffa22853345c39e64afc0a12b7d
SHA1b4ea5629a6e754c86fc7eb5888c07884eaeaad43
SHA25695a1e6bd28a3021e518192dc3075a1adeaa46e08e096d202b75e88799898096e
SHA5120e3cc071c67e83da8e0ec612262f11e41655713aa7199f990a11784ac0aad2daa498c9f1c0c569ccc1340e7fde9bd665096c20683269997215d0fac105df14be
-
Filesize
16KB
MD5a0e5ff0eba3076308a345f353a78a32f
SHA15290fc4629c2e01f637557ece575c5dc301db78e
SHA2562c008ceb03c9937f1f392de370cca93907fd2e4fc4ac3c2ed609395c0db968ab
SHA51280bf79cba107222f09129639456bd09ddacf6db133f17cd9d0154ea746d7ca2cd59ab96553f8ff73ee5fdf9fd73db2d657c0b1f1dc7ec622151b956004a5613f
-
Filesize
16KB
MD510edd356df5e13d42883394d6e5bf141
SHA14253361dd3dc07adb6ad75be9e0405f33793f703
SHA2560251e88a4d67ed432e8a41519eb4904a1aeae2c158213379392e7b4932f12d17
SHA512c207345d5121e74eed94cd17637352a8e0cfe289559868ed25685fe7e420c899c881fd15084029a338e423324c8d2ba16da2ebaa5c7428e3e31b83d831cd924b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize960KB
MD5128700f20ce55acb234c140a8227ade1
SHA1cdb4b1d3ba34154a62824d4d241d2bfb6d85371e
SHA2567ac8591a4dad9f8b6258c69456fd0bd393c6d0eea780541c92634f76651d3f84
SHA512affcae1177d9b71c8613bd0b6665ddf7c083fffa2b3279515847f551245545ea4b3f48dc2bbaa33ac0bb0f1c354d579c1cc2247df691a534827e6dd5a21a2fcb