Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
30/08/2024, 03:04
General
- Target 2d11a5d7f14523c93d9c1ebc4ed7d65e90a5fe4f3a6bda8efac5c632da92ed12.exe
- Size 1.8MB
- Sample240830-dkk2batere
- SHA256 2d11a5d7f14523c93d9c1ebc4ed7d65e90a5fe4f3a6bda8efac5c632da92ed12
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@CLOUDYTTEAM
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
amadey
-
4.41
-
a51500
-
http://api.garageserviceoperation.com
-
install_dir
0cf505a27f
-
install_file
ednfovi.exe
-
strings_key
0044a8b8e295529eaf3743c9bc3171d2
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detects Monster Stealer. 1 IoCs
- Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
- Monster
Monster is a Golang stealer that was discovered in 2024.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Drops startup file 2 IoCs
- Executes dropped EXE 19 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 35 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Enumerates processes with tasklist 1 TTPs 6 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 9 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 1 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2d11a5d7f14523c93d9c1ebc4ed7d65e90a5fe4f3a6bda8efac5c632da92ed12.exe"C:\Users\Admin\AppData\Local\Temp\2d11a5d7f14523c93d9c1ebc4ed7d65e90a5fe4f3a6bda8efac5c632da92ed12.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\oIg7NK0Sgt.exe"C:\Users\Admin\AppData\Roaming\oIg7NK0Sgt.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\PnJgDxsuFN.exe"C:\Users\Admin\AppData\Roaming\PnJgDxsuFN.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 403656⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "HopeBuildersGeniusIslam" Sonic6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pifBeijing.pif s6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000223001\openvpn12.exe"C:\Users\Admin\AppData\Local\Temp\1000223001\openvpn12.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000225001\WASSetup.exe"C:\Users\Admin\AppData\Local\Temp\1000225001\WASSetup.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 12326⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000226001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000226001\build.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\onefile_3536_133694606957855102\stub.exeC:\Users\Admin\AppData\Local\Temp\1000226001\build.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""6⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"7⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('/start', 0, 'System Error', 0+16);close()""6⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('/start', 0, 'System Error', 0+16);close()"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"6⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard7⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"6⤵
-
C:\Windows\system32\chcp.comchcp7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"6⤵
-
C:\Windows\system32\chcp.comchcp7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"6⤵
- Network Service Discovery
-
C:\Windows\system32\systeminfo.exesysteminfo7⤵
- Gathers system information
-
-
C:\Windows\system32\HOSTNAME.EXEhostname7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername7⤵
- Collects information from the system
-
-
C:\Windows\system32\net.exenet user7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user8⤵
-
-
-
C:\Windows\system32\query.exequery user7⤵
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"8⤵
-
-
-
C:\Windows\system32\net.exenet localgroup7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup8⤵
-
-
-
C:\Windows\system32\net.exenet localgroup administrators7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators8⤵
-
-
-
C:\Windows\system32\net.exenet user guest7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest8⤵
-
-
-
C:\Windows\system32\net.exenet user administrator7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator8⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command7⤵
-
-
C:\Windows\system32\tasklist.exetasklist /svc7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\ipconfig.exeipconfig /all7⤵
- Gathers network information
-
-
C:\Windows\system32\ROUTE.EXEroute print7⤵
-
-
C:\Windows\system32\ARP.EXEarp -a7⤵
- Network Service Discovery
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano7⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\system32\sc.exesc query type= service state= all7⤵
- Launches sc.exe
-
-
C:\Windows\system32\netsh.exenetsh firewall show state7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh firewall show config7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4444 -ip 44441⤵
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
crypted.exe
crypteda.exe
Nework.exe
stealc_default2.exe
Set-up+%282%29.exe
runtime.exe
BitcoinCore.exe
openvpn12.exe
WASSetup.exe
build.exe
Beijing.pif
s
axplong.exe
Continue
Continues
Corresponding
Dietary
Minister
Mobile
Mr
_ctypes.pyd
_rust.pyd
Sonic
Speak
Template
TmpBBFD.tmp
Web.db
Web.db
Zinc
__PSScriptPolicyTest_ti33s5yk.t0j.ps1
_bz2.pyd
_lzma.pyd
_sqlite3.pyd
libffi-7.dll
python310.dll
sqlite3.dll
stub.exe
vcruntime140.dll
76b53b3ec448f7ccdda2063b15d2bfc3_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8
PnJgDxsuFN.exe
oIg7NK0Sgt.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/1120-125-0x0000000000090000-0x000000000011E000-memory.dmp
memory/1120-268-0x0000000009AD0000-0x0000000009FFC000-memory.dmp
memory/1120-267-0x00000000092D0000-0x0000000009492000-memory.dmp
memory/1120-219-0x0000000007C70000-0x0000000007CD6000-memory.dmp
memory/1412-4-0x0000000000FB0000-0x000000000145A000-memory.dmp
memory/1412-0-0x0000000000FB0000-0x000000000145A000-memory.dmp
memory/1412-1-0x0000000077776000-0x0000000077778000-memory.dmp
memory/1412-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp
memory/1412-3-0x0000000000FB0000-0x000000000145A000-memory.dmp
memory/1412-16-0x0000000000FB0000-0x000000000145A000-memory.dmp
memory/1732-587-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/2400-126-0x0000000000FC0000-0x0000000001012000-memory.dmp
memory/3128-380-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-360-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-415-0x0000000000400000-0x0000000000E13000-memory.dmp
memory/3128-362-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-424-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-363-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-364-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-365-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-367-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-366-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-354-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3128-361-0x0000000140000000-0x0000000140278000-memory.dmp
memory/3440-21-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-195-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-269-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-335-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-431-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-17-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-270-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-20-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-19-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-387-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-22-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-274-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3440-206-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/3728-412-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/3728-410-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/3728-414-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/3732-71-0x0000000006BD0000-0x00000000071E8000-memory.dmp
memory/3732-75-0x00000000084A0000-0x00000000084EC000-memory.dmp
memory/3732-47-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3732-50-0x0000000005530000-0x0000000005AD6000-memory.dmp
memory/3732-51-0x0000000004F80000-0x0000000005012000-memory.dmp
memory/3732-52-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/3732-67-0x0000000005BE0000-0x0000000005C56000-memory.dmp
memory/3732-278-0x0000000009190000-0x00000000091E0000-memory.dmp
memory/3732-68-0x0000000006240000-0x000000000625E000-memory.dmp
memory/3732-72-0x0000000008390000-0x000000000849A000-memory.dmp
memory/3732-73-0x0000000006B00000-0x0000000006B12000-memory.dmp
memory/3732-74-0x0000000006B60000-0x0000000006B9C000-memory.dmp
memory/3756-96-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3756-121-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3756-101-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3756-100-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3756-98-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3872-43-0x000000007301E000-0x000000007301F000-memory.dmp
memory/3872-44-0x00000000001B0000-0x0000000000204000-memory.dmp
memory/3880-94-0x0000000000D80000-0x0000000000E92000-memory.dmp
memory/4364-334-0x00000000006F0000-0x0000000000933000-memory.dmp
memory/4364-220-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4364-186-0x00000000006F0000-0x0000000000933000-memory.dmp
memory/4504-577-0x000001542CEC0000-0x000001542CEE2000-memory.dmp
memory/4644-409-0x0000000005E30000-0x0000000005E52000-memory.dmp
memory/4644-406-0x0000000000F40000-0x00000000014D8000-memory.dmp
memory/4644-408-0x0000000005FC0000-0x0000000006272000-memory.dmp
memory/4644-407-0x0000000005F20000-0x0000000005FBC000-memory.dmp
memory/4968-420-0x0000000004500000-0x000000000456F000-memory.dmp
memory/4968-416-0x0000000004500000-0x000000000456F000-memory.dmp
memory/4968-417-0x0000000004500000-0x000000000456F000-memory.dmp
memory/4968-419-0x0000000004500000-0x000000000456F000-memory.dmp
memory/4968-422-0x0000000004500000-0x000000000456F000-memory.dmp
memory/4968-418-0x0000000004500000-0x000000000456F000-memory.dmp
memory/4968-421-0x0000000004500000-0x000000000456F000-memory.dmp
memory/5036-629-0x0000000000E20000-0x00000000012CA000-memory.dmp
memory/5036-631-0x0000000000E20000-0x00000000012CA000-memory.dmp