Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
03/09/2024, 05:53
General
- Target f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b.exe
- Size 1.8MB
- Sample240903-glc9mszepe
- SHA256 f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@CLOUDYTTEAM
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
stealc
-
default
-
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 25 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b.exe"C:\Users\Admin\AppData\Local\Temp\f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\zD4fjFCzbY.exe"C:\Users\Admin\AppData\Roaming\zD4fjFCzbY.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\PpwsnGBFex.exe"C:\Users\Admin\AppData\Roaming\PpwsnGBFex.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000228001\Setup.exe"C:\Users\Admin\AppData\Local\Temp\1000228001\Setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\1000238002\Amadeus.exe"C:\Users\Admin\1000238002\Amadeus.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe"C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe"C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F4⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
Amadeus.exe
crypted.exe
crypteda.exe
Nework.exe
stealc_default2.exe
Set-up.exe
1.exe
Setup.exe
build.exe
runtime.exe
ovrflw.exe
channel3.exe
axplong.exe
610320281626
TmpC488.tmp
svchost015.exe
76b53b3ec448f7ccdda2063b15d2bfc3_397a1569-0be2-47f2-b50f-ef09823a05f8
PpwsnGBFex.exe
zD4fjFCzbY.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/444-429-0x0000000000400000-0x000000000106A000-memory.dmp
memory/444-415-0x0000000000400000-0x000000000106A000-memory.dmp
memory/444-386-0x0000000000400000-0x000000000106A000-memory.dmp
memory/1148-310-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1148-304-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1148-308-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1148-307-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1424-309-0x0000000000400000-0x000000000077D000-memory.dmp
memory/1716-0-0x00000000000E0000-0x00000000005A4000-memory.dmp
memory/1716-18-0x00000000000E0000-0x00000000005A4000-memory.dmp
memory/1716-4-0x00000000000E0000-0x00000000005A4000-memory.dmp
memory/1716-3-0x00000000000E0000-0x00000000005A4000-memory.dmp
memory/1716-2-0x00000000000E1000-0x000000000010F000-memory.dmp
memory/1716-1-0x00000000777F6000-0x00000000777F8000-memory.dmp
memory/2036-192-0x0000000009820000-0x0000000009886000-memory.dmp
memory/2036-228-0x000000000AC30000-0x000000000B15C000-memory.dmp
memory/2036-227-0x000000000A530000-0x000000000A6F2000-memory.dmp
memory/2036-126-0x0000000000FA0000-0x000000000102E000-memory.dmp
memory/2488-384-0x0000000000050000-0x0000000000062000-memory.dmp
memory/2488-396-0x000000001B900000-0x000000001B970000-memory.dmp
memory/2488-394-0x000000001B710000-0x000000001B794000-memory.dmp
memory/2548-365-0x00000000006A0000-0x000000000070E000-memory.dmp
memory/2664-93-0x0000000000890000-0x00000000009A2000-memory.dmp
memory/3052-417-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-490-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-226-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-191-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-103-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-328-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-187-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-463-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-469-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-387-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-17-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-301-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-19-0x00000000006F1000-0x000000000071F000-memory.dmp
memory/3052-21-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3052-20-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/3100-42-0x000000007309E000-0x000000007309F000-memory.dmp
memory/3100-43-0x0000000000570000-0x00000000005C4000-memory.dmp
memory/3192-390-0x0000000000380000-0x00000000003D8000-memory.dmp
memory/3192-388-0x0000000000380000-0x00000000003D8000-memory.dmp
memory/3192-393-0x0000000000380000-0x00000000003D8000-memory.dmp
memory/3392-71-0x0000000008890000-0x000000000899A000-memory.dmp
memory/3392-66-0x0000000005F80000-0x0000000005FF6000-memory.dmp
memory/3392-46-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3392-67-0x0000000006740000-0x000000000675E000-memory.dmp
memory/3392-70-0x00000000070D0000-0x00000000076E8000-memory.dmp
memory/3392-51-0x0000000005470000-0x000000000547A000-memory.dmp
memory/3392-49-0x0000000005950000-0x0000000005EF6000-memory.dmp
memory/3392-50-0x0000000005480000-0x0000000005512000-memory.dmp
memory/3392-72-0x0000000007000000-0x0000000007012000-memory.dmp
memory/3392-73-0x0000000007060000-0x000000000709C000-memory.dmp
memory/3392-74-0x00000000089A0000-0x00000000089EC000-memory.dmp
memory/4252-484-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4252-398-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4252-448-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4252-439-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4252-401-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4252-397-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4252-478-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4364-400-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/4364-408-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/4456-506-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/4456-510-0x00000000006F0000-0x0000000000BB4000-memory.dmp
memory/4536-468-0x000000006C9B0000-0x000000006CAEC000-memory.dmp
memory/4536-467-0x0000000000910000-0x0000000000921000-memory.dmp
memory/4544-124-0x0000000000780000-0x00000000007D2000-memory.dmp
memory/4544-240-0x0000000007670000-0x00000000076C0000-memory.dmp
memory/4608-451-0x0000000000060000-0x00000000001C2000-memory.dmp
memory/4624-491-0x0000000000400000-0x000000000106F000-memory.dmp
memory/4796-281-0x00000000005B0000-0x00000000007F3000-memory.dmp
memory/4796-188-0x00000000005B0000-0x00000000007F3000-memory.dmp
memory/4796-194-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/5020-327-0x0000000000400000-0x000000000106B000-memory.dmp
memory/5048-100-0x0000000000400000-0x000000000050D000-memory.dmp
memory/5048-99-0x0000000000400000-0x000000000050D000-memory.dmp
memory/5048-97-0x0000000000400000-0x000000000050D000-memory.dmp
memory/5048-95-0x0000000000400000-0x000000000050D000-memory.dmp
memory/5048-121-0x0000000000400000-0x000000000050D000-memory.dmp