Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2024 17:13
Static task
static1
Behavioral task
behavioral1
Sample
720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe
Resource
win11-20240802-en
General
-
Target
720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe
-
Size
1.8MB
-
MD5
25ff288da2eb7d31303fb31ebefd966e
-
SHA1
ef9a47a5e9b55c55406fb3aa6b12a648d7b04d0d
-
SHA256
720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0
-
SHA512
eda3cd07b83275a46a20c2976a950734953468c0df8b7b77889c2084f0a7c543dd25465a3bb3b1b2b93c7a2e315521ce3415ecf7716d7c0387603509b085775b
-
SSDEEP
49152:dV82O1bjnosunOT42EOWq01aDt3ifxHjRGuvvxijQ:chno7OT42E7qG6MHc4vAs
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
redline
@CLOUDYTTEAM
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
amadey
4.41
1176f2
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Extracted
lumma
https://locatedblsoqp.shop/api
https://millyscroqwp.shop/api
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/memory/3740-47-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/files/0x00070000000234ac-125.dat family_redline behavioral1/memory/4304-126-0x0000000000D60000-0x0000000000DB2000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4332 created 3368 4332 wrsoc.exe 55 -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Set-up.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation joffer2.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation ovrflw.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Nework.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Hkbsse.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation runtime.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation runtime.exe -
Executes dropped EXE 27 IoCs
pid Process 4132 axplong.exe 4960 crypted.exe 2940 crypteda.exe 2800 wvarQfndqw.exe 4304 9mQXEytXYo.exe 512 Nework.exe 1724 Hkbsse.exe 2860 stealc_default2.exe 3052 Set-up.exe 2736 joffer2.exe 4264 1.exe 2544 svchost015.exe 4072 Hkbsse.exe 4632 axplong.exe 5088 GetSys.exe 2808 Amadeus.exe 2436 build.exe 3616 runtime.exe 860 service123.exe 868 service123.exe 3928 ovrflw.exe 4340 mswabnet.exe 4332 wrsoc.exe 3172 wrsoc.exe 4632 axplong.exe 2928 Hkbsse.exe 2864 runtime.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine axplong.exe -
Loads dropped DLL 4 IoCs
pid Process 2860 stealc_default2.exe 2860 stealc_default2.exe 868 service123.exe 3172 wrsoc.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook wrsoc.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\runtime = "C:\\Users\\Admin\\Pictures\\Lighter Tech\\runtime.exe" runtime.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\runtime = "C:\\Users\\Admin\\Pictures\\Lighter Tech\\runtime.exe" runtime.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amadeus.exe = "C:\\Users\\Admin\\1000238002\\Amadeus.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Network Agent = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Network Agent\\mswabnet.exe\"" ovrflw.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 82 raw.githubusercontent.com 86 raw.githubusercontent.com 81 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe 4132 axplong.exe 4632 axplong.exe 4632 axplong.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 4960 set thread context of 3740 4960 crypted.exe 91 PID 2940 set thread context of 3912 2940 crypteda.exe 97 PID 4264 set thread context of 2544 4264 1.exe 109 PID 5088 set thread context of 3516 5088 GetSys.exe 115 PID 2808 set thread context of 4288 2808 Amadeus.exe 121 PID 3616 set thread context of 968 3616 runtime.exe 123 PID 4332 set thread context of 3172 4332 wrsoc.exe 127 PID 2864 set thread context of 5672 2864 runtime.exe 134 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe File created C:\Windows\Tasks\Hkbsse.job Nework.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wvarQfndqw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wrsoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language joffer2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GetSys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amadeus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wrsoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9mQXEytXYo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Set-up.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 joffer2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString joffer2.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5528 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe 4132 axplong.exe 4132 axplong.exe 2860 stealc_default2.exe 2860 stealc_default2.exe 3740 RegAsm.exe 3740 RegAsm.exe 3740 RegAsm.exe 3740 RegAsm.exe 3740 RegAsm.exe 3740 RegAsm.exe 2800 wvarQfndqw.exe 2800 wvarQfndqw.exe 4304 9mQXEytXYo.exe 4304 9mQXEytXYo.exe 4304 9mQXEytXYo.exe 4304 9mQXEytXYo.exe 4304 9mQXEytXYo.exe 4304 9mQXEytXYo.exe 4632 axplong.exe 4632 axplong.exe 2860 stealc_default2.exe 2860 stealc_default2.exe 2436 build.exe 2436 build.exe 4332 wrsoc.exe 3172 wrsoc.exe 3172 wrsoc.exe 4632 axplong.exe 4632 axplong.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2800 wvarQfndqw.exe Token: SeBackupPrivilege 2800 wvarQfndqw.exe Token: SeSecurityPrivilege 2800 wvarQfndqw.exe Token: SeSecurityPrivilege 2800 wvarQfndqw.exe Token: SeSecurityPrivilege 2800 wvarQfndqw.exe Token: SeSecurityPrivilege 2800 wvarQfndqw.exe Token: SeDebugPrivilege 3740 RegAsm.exe Token: SeDebugPrivilege 4304 9mQXEytXYo.exe Token: SeDebugPrivilege 2436 build.exe Token: SeBackupPrivilege 2436 build.exe Token: SeSecurityPrivilege 2436 build.exe Token: SeSecurityPrivilege 2436 build.exe Token: SeSecurityPrivilege 2436 build.exe Token: SeSecurityPrivilege 2436 build.exe Token: SeDebugPrivilege 3616 runtime.exe Token: SeDebugPrivilege 3928 ovrflw.exe Token: SeDebugPrivilege 4340 mswabnet.exe Token: SeDebugPrivilege 4332 wrsoc.exe Token: SeDebugPrivilege 4332 wrsoc.exe Token: SeDebugPrivilege 3172 wrsoc.exe Token: SeDebugPrivilege 2864 runtime.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 4132 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe 86 PID 3040 wrote to memory of 4132 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe 86 PID 3040 wrote to memory of 4132 3040 720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe 86 PID 4132 wrote to memory of 4960 4132 axplong.exe 89 PID 4132 wrote to memory of 4960 4132 axplong.exe 89 PID 4132 wrote to memory of 4960 4132 axplong.exe 89 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4960 wrote to memory of 3740 4960 crypted.exe 91 PID 4132 wrote to memory of 2940 4132 axplong.exe 95 PID 4132 wrote to memory of 2940 4132 axplong.exe 95 PID 4132 wrote to memory of 2940 4132 axplong.exe 95 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 2940 wrote to memory of 3912 2940 crypteda.exe 97 PID 3912 wrote to memory of 2800 3912 RegAsm.exe 98 PID 3912 wrote to memory of 2800 3912 RegAsm.exe 98 PID 3912 wrote to memory of 2800 3912 RegAsm.exe 98 PID 3912 wrote to memory of 4304 3912 RegAsm.exe 100 PID 3912 wrote to memory of 4304 3912 RegAsm.exe 100 PID 3912 wrote to memory of 4304 3912 RegAsm.exe 100 PID 4132 wrote to memory of 512 4132 axplong.exe 101 PID 4132 wrote to memory of 512 4132 axplong.exe 101 PID 4132 wrote to memory of 512 4132 axplong.exe 101 PID 512 wrote to memory of 1724 512 Nework.exe 102 PID 512 wrote to memory of 1724 512 Nework.exe 102 PID 512 wrote to memory of 1724 512 Nework.exe 102 PID 4132 wrote to memory of 2860 4132 axplong.exe 103 PID 4132 wrote to memory of 2860 4132 axplong.exe 103 PID 4132 wrote to memory of 2860 4132 axplong.exe 103 PID 4132 wrote to memory of 3052 4132 axplong.exe 106 PID 4132 wrote to memory of 3052 4132 axplong.exe 106 PID 4132 wrote to memory of 3052 4132 axplong.exe 106 PID 1724 wrote to memory of 2736 1724 Hkbsse.exe 107 PID 1724 wrote to memory of 2736 1724 Hkbsse.exe 107 PID 1724 wrote to memory of 2736 1724 Hkbsse.exe 107 PID 4132 wrote to memory of 4264 4132 axplong.exe 108 PID 4132 wrote to memory of 4264 4132 axplong.exe 108 PID 4132 wrote to memory of 4264 4132 axplong.exe 108 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4264 wrote to memory of 2544 4264 1.exe 109 PID 4132 wrote to memory of 5088 4132 axplong.exe 114 PID 4132 wrote to memory of 5088 4132 axplong.exe 114 PID 4132 wrote to memory of 5088 4132 axplong.exe 114 PID 5088 wrote to memory of 3516 5088 GetSys.exe 115 PID 5088 wrote to memory of 3516 5088 GetSys.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wrsoc.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe"C:\Users\Admin\AppData\Local\Temp\720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Roaming\wvarQfndqw.exe"C:\Users\Admin\AppData\Roaming\wvarQfndqw.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\9mQXEytXYo.exe"C:\Users\Admin\AppData\Roaming\9mQXEytXYo.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1000011001\joffer2.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\joffer2.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:860
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000228001\GetSys.exe"C:\Users\Admin\AppData\Local\Temp\1000228001\GetSys.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3516
-
-
-
C:\Users\Admin\1000238002\Amadeus.exe"C:\Users\Admin\1000238002\Amadeus.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4288
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3616 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- System Location Discovery: System Language Discovery
PID:968 -
C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe"C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000280001\wrsoc.exe"C:\Users\Admin\AppData\Local\Temp\1000280001\wrsoc.exe"6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F5⤵PID:2860
-
C:\Windows\system32\schtasks.exeschtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F6⤵
- Scheduled Task/Job: Scheduled Task
PID:5528
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000280001\wrsoc.exe"C:\Users\Admin\AppData\Local\Temp\1000280001\wrsoc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:4072
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:2928
-
C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5672
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F2⤵PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
5.3MB
MD536a627b26fae167e6009b4950ff15805
SHA1f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA5122133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094
-
Filesize
314KB
MD56134586375c01f97f8777bae1bf5ed98
SHA14787fa996b75dbc54632cc321725ee62666868a1
SHA256414becb8aabd4e8c406e84df062bee1a45cffa334ae30022078cfa71da9e330d
SHA512652ed16d96b5700f105c2bab8e7258f167bc1615b6397be7340c08df7c977842844326e07fdef677aecfaf07263f99bb7968c9fc926e90e5a33d2ed793f8436b
-
Filesize
1.1MB
MD58e74497aff3b9d2ddb7e7f819dfc69ba
SHA11d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA5129aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
6.3MB
MD54386df2790a9752e9cf0424dca91ad15
SHA122da8886a1bf7823fa759540cf88f3e3f1b42671
SHA256e2f0e525c66dba847bedf887398405348159ce607bc6cc826bef73651fd7135d
SHA5120afe4bf35665de41f96c3beeb13688428c840f4501fbc91285dbecf43e9204b2f921966194ea31655a48467620b7e364367684bb50274bd576955ca958b6fe9b
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.4MB
MD506b767bf2a7deac9b9e524c5b6986bf7
SHA18a0d79d7d04b89658394d72c4071a1f4037f32b2
SHA256c4c861dda94e9b3275d123e78d73bb9180b618855730eb2217a656d14e35a854
SHA5120ba0e7d75355847bf9a124fd35a69f3f5281a351f730bd4bab23ad3c5466a40fda58871c77314557d42082c98a476b20fb68351dfbfb635cd6a958ab19765300
-
Filesize
3.5MB
MD517d51083ccb2b20074b1dc2cac5bea36
SHA10a046864ad4304f63dbde5ac14d3dc05cfb48d46
SHA256681eeececd77eb1433111641c33c8424eaf2c1265e2d4a7e4d6f023865fb5d94
SHA5127da8a2fd0321231c17fddf414bf1d5a03d71dbc619f68958ff1d167003f972920f0f3c830b8a25aa715df4fcc044d88d739b6eab115a5b0b0a53852a70f4238a
-
Filesize
10.6MB
MD587939a5b42854b08804a9a0ae605b260
SHA1e21ec74f722d3a5bae0d183a73156a0d42d4b251
SHA256d742a6ae9c12e159c3f74559899934cbf1a4ec7e1e4ae8620f372c59789d8ace
SHA51246a08ea0002f8beef34a5cb167fb2d8aa821a5380952bc9967afdf525b729fc5ca6976af558923811dd2d338d2ec5cae39cce67f666bc811f5abdca1d2d8eb55
-
Filesize
413KB
MD505c1baaa01bd0aa0ccb5ec1c43a7d853
SHA1e47d7f53987eb147f599321c858fe8d71ebc0d71
SHA2569998d38b192309056d5109ac27a8b13f2b36fc27bac9ebdf5385452b2c1b0cdb
SHA512996450fc8c8b702327eacfe2eb819c86baccf4d49f2eb58d3dd2b3ce35733f1e00857ac71b290bc99db71baab08d7d7b22ef5223504c93b26ade0df6c9369501
-
Filesize
44KB
MD59d78ab0da1948de3977123755ef0fe7c
SHA1b000aa9b5df426225a02f208b78416cc2f8dab86
SHA2567d9733030e72c5ed1016ff372ffde715883bb827391f50fdb9cd7f000f7a67df
SHA5129576fdbeb8ad20a8ebcfc3121247f4e70a7e9240bea4122f471b813ea321566e45bc4db86fe5bed11ce17bbe14dc68cb82f29fe9df0cee78f0f6f90b5c756bf1
-
Filesize
1.4MB
MD53adfc7cf1e296c6fb703991c5233721d
SHA1fddd2877ce7952b91c3f841ca353235d6d8eea67
SHA2566bc23179d079d220337ede270113d4a474b549f5f0c7fd57f3d33d318f7ae471
SHA5125136525626c3021baf8d35be0d76473cc03bfe2433682d613650b8e4bb444f767d2d14ac0070ce46c4c220e0a71a8f2e789e4e684e2042bd78b60f68f35a652b
-
Filesize
86KB
MD59825cb927311f607f08b7a69975c2966
SHA1747dc1799eff573ae6557603481bcba39c2ceeae
SHA256c97ebe1393b54f5d94b8b52b8ef4b452867ab122d15013ccbd79372776288c96
SHA512f11b300ff0d23aded2a6b0e3d137410288042f50a168bd483ee04fbdb80186936b27a8e6b24cc83c090716d223607c90a1654cb798ce84fe35706b1db8d06547
-
Filesize
77KB
MD524bfd5831d94c0d52691a66f2f7ed81c
SHA115918bd17ea5780979ee73c804f5bdea22343df4
SHA256321e6921f3a22ba685a521c41d1dce0f4acc0d933030a31dd86b7298f796cfc4
SHA5120e0547a89f48c4b5e69746faaaccccae2bd394628a34e93d2f9c60383be06d71f740e1cfd56a5184ec5fde66a330431627e67de16c4130fee9a30e9ca5004af6
-
Filesize
1.8MB
MD525ff288da2eb7d31303fb31ebefd966e
SHA1ef9a47a5e9b55c55406fb3aa6b12a648d7b04d0d
SHA256720e48e9539e9b7dd952849c4cb3aff77ca9b4c7f0259ef1a1be74eadf7258a0
SHA512eda3cd07b83275a46a20c2976a950734953468c0df8b7b77889c2084f0a7c543dd25465a3bb3b1b2b93c7a2e315521ce3415ecf7716d7c0387603509b085775b
-
Filesize
1.3MB
MD5e962a1987ddf83d7050ad3752bb56cb6
SHA1378cd57c7afeeb030f7a93cec7af50526123886e
SHA25677b3eadbc24d7bafdb5ffbea389fad9722db7b563e849388510002cb759e2c00
SHA512cf58268c3cdeb4ad98892e46a8615c690b2c66d15c13cd815c8c1f98386eceecc120769936e87ace212fd0fc0716dc497691f4b7c123890823473ff328bfd68e
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
114KB
MD53cfabadfcb05a77b204fe1a6b09a5c90
SHA1f106b5ed22265e64bc61dc5cf1e2d33ed12ec18d
SHA256693617c470d7472e751d872341061cfb663f22ee95bdb42f9db01f02cb90df9c
SHA512d5502023a17213919e2e991f5ba2d0d2c08223fd489d876a47a37239b637d03ace9cb9b92deb71460ae4030194ca49ce9e9752e0bf2ccbcd297dc5afe62a4e7b
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
160KB
MD5f310cf1ff562ae14449e0167a3e1fe46
SHA185c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA5121196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
-
Filesize
300.0MB
MD5736e5c3ccbcb6b277e629a416e012aa8
SHA1d2c6c17b623976c3314ebabb7f2704a1262785f3
SHA25694d6549cb8f69e5d938ebe348ea82a2292ec8ee3a5b483e1e1699ab23e123a20
SHA5124e9bd816651b471d9acf47220279bd9740811ea244ea848fb42e990822da0494c892343f9c430c2a91c2d0da6f3113ec8494917548f78e6098a4f9443fde80fe
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
Filesize
304KB
MD530f46f4476cdc27691c7fdad1c255037
SHA1b53415af5d01f8500881c06867a49a5825172e36
SHA2563a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a53bb4ca-6113-48bb-9609-441860fdd0d7
Filesize2KB
MD5b416afa8b38a008d62c2d17aa36ea7f7
SHA15f594c210b36db9d34a9b5d915226c0c4adbed1a
SHA25627e0a24a64c3d99216565056194a6698224f0c162f7a04650a952434df64935b
SHA512f5e500024f6aa764c4bf12846bfcd109b7830fd252e975108e4e78789e31e3602ee935461c2722ec69a24c61f64414c03f25bbc64075f517ba7237a1c6afc926
-
Filesize
544KB
MD588367533c12315805c059e688e7cdfe9
SHA164a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA5127a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714
-
Filesize
2KB
MD5214c86c5bb09ce53497596fee3bfafbc
SHA1b6bf6ff1623e2007119c687f5e14a40bb29ddddf
SHA2569347e4b3cdada8ec28158151e363da7721579f67503d93965b84224f43b6ada3
SHA512eb4912e6ac6e492538c73a084ac657e7331ce6bb0da60a05dfeba31e62deed6a470adbf7ccb4d6575bd1c00946e846bbd253d892d38172e0ef4bcff299d7b08e
-
Filesize
2KB
MD551009d72444cb05fbcb8ef922ff5f972
SHA1267a957d2793962a195a7c35881d82edf3c3888f
SHA256631bbcd7284379288485627b96e167c094eea72403a07658de060e3c12e8f5a4
SHA5120c9073e5edb16329cad7ede2211f0f86f672889319acb2bf18e3e07ed409fe87a6ab6a8b62503589e303e1259a1bd9c2262d69730d2f1d60b051ea6c83e78a59