Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 01:16
Static task
static1
Behavioral task
behavioral1
Sample
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe
Resource
win11-20240802-en
General
-
Target
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe
-
Size
1.8MB
-
MD5
501eab002a4a0d559144dfa818371a24
-
SHA1
208f1a0cbc530223a68513981ed2c76c6ece6694
-
SHA256
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e
-
SHA512
6d19c48bfc14253a57ccfc5575fff8640020c85e25a67be435a1fc7c9e750796f162c31ec9fc97f29c8099a86101118b90ced4bfe47be661c42d52d0a974c418
-
SSDEEP
49152:EH4EMNaIGDMfSDCYMflfr5hp1yJM74vnyL756q3iGQ:EH0NaIKMqDCYm1y2cnyL756qSGQ
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
redline
@CLOUDYTTEAM
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
cryptbot
sevtv17sb.top
analforeverlovyu.top
fivev5sb.top
-
url_path
/v1/upload.php
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/6116-57-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\5a8iGVXqTl.exe family_redline behavioral1/memory/5888-149-0x0000000000430000-0x0000000000482000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplong.exeaxplong.exe9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeaxplong.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
axplong.exeRegAsm.exeNework.exeHkbsse.exejoffer2.exe9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation Nework.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation Hkbsse.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation joffer2.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe -
Executes dropped EXE 18 IoCs
Processes:
axplong.exeaxplong.exegold.execrypteda.exexx6vYjqavZ.exe5a8iGVXqTl.exeNework.exeHkbsse.exestealc_default2.exejoffer2.exeHkbsse.exeaxplong.exeSеtup.exeservice123.exepenis.exeaxplong.exeHkbsse.exeservice123.exepid process 3640 axplong.exe 2500 axplong.exe 912 gold.exe 5404 crypteda.exe 3112 xx6vYjqavZ.exe 5888 5a8iGVXqTl.exe 1284 Nework.exe 4544 Hkbsse.exe 4908 stealc_default2.exe 5856 joffer2.exe 3060 Hkbsse.exe 5548 axplong.exe 3896 Sеtup.exe 2132 service123.exe 4420 penis.exe 4960 axplong.exe 1224 Hkbsse.exe 2892 service123.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplong.exeaxplong.exe9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeaxplong.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine axplong.exe -
Loads dropped DLL 2 IoCs
Processes:
service123.exeservice123.exepid process 2132 service123.exe 2892 service123.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exepid process 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe 3640 axplong.exe 2500 axplong.exe 5548 axplong.exe 4960 axplong.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
gold.execrypteda.exedescription pid process target process PID 912 set thread context of 6116 912 gold.exe RegAsm.exe PID 5404 set thread context of 3476 5404 crypteda.exe RegAsm.exe -
Drops file in Windows directory 2 IoCs
Processes:
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeNework.exedescription ioc process File created C:\Windows\Tasks\axplong.job 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe File created C:\Windows\Tasks\Hkbsse.job Nework.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
schtasks.exeaxplong.exe5a8iGVXqTl.exeNework.exexx6vYjqavZ.exeservice123.exepenis.exeRegAsm.execrypteda.exeHkbsse.exestealc_default2.exe9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exegold.exeRegAsm.exejoffer2.exeSеtup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a8iGVXqTl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xx6vYjqavZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language joffer2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sеtup.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
stealc_default2.exejoffer2.exeSеtup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 joffer2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString joffer2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sеtup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sеtup.exe -
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeaxplong.exeaxplong.exestealc_default2.exeRegAsm.exexx6vYjqavZ.exeaxplong.exe5a8iGVXqTl.exeaxplong.exepid process 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe 3640 axplong.exe 3640 axplong.exe 2500 axplong.exe 2500 axplong.exe 4908 stealc_default2.exe 4908 stealc_default2.exe 6116 RegAsm.exe 6116 RegAsm.exe 3112 xx6vYjqavZ.exe 3112 xx6vYjqavZ.exe 6116 RegAsm.exe 6116 RegAsm.exe 6116 RegAsm.exe 6116 RegAsm.exe 5548 axplong.exe 5548 axplong.exe 5888 5a8iGVXqTl.exe 5888 5a8iGVXqTl.exe 5888 5a8iGVXqTl.exe 5888 5a8iGVXqTl.exe 5888 5a8iGVXqTl.exe 4908 stealc_default2.exe 4908 stealc_default2.exe 4960 axplong.exe 4960 axplong.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
xx6vYjqavZ.exeRegAsm.exe5a8iGVXqTl.exepenis.exedescription pid process Token: SeDebugPrivilege 3112 xx6vYjqavZ.exe Token: SeBackupPrivilege 3112 xx6vYjqavZ.exe Token: SeSecurityPrivilege 3112 xx6vYjqavZ.exe Token: SeSecurityPrivilege 3112 xx6vYjqavZ.exe Token: SeSecurityPrivilege 3112 xx6vYjqavZ.exe Token: SeSecurityPrivilege 3112 xx6vYjqavZ.exe Token: SeDebugPrivilege 6116 RegAsm.exe Token: SeDebugPrivilege 5888 5a8iGVXqTl.exe Token: SeDebugPrivilege 4420 penis.exe Token: SeBackupPrivilege 4420 penis.exe Token: SeSecurityPrivilege 4420 penis.exe Token: SeSecurityPrivilege 4420 penis.exe Token: SeSecurityPrivilege 4420 penis.exe Token: SeSecurityPrivilege 4420 penis.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeNework.exepid process 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe 1284 Nework.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exeaxplong.exegold.execrypteda.exeRegAsm.exeNework.exeHkbsse.exejoffer2.exedescription pid process target process PID 3128 wrote to memory of 3640 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe axplong.exe PID 3128 wrote to memory of 3640 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe axplong.exe PID 3128 wrote to memory of 3640 3128 9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe axplong.exe PID 3640 wrote to memory of 912 3640 axplong.exe gold.exe PID 3640 wrote to memory of 912 3640 axplong.exe gold.exe PID 3640 wrote to memory of 912 3640 axplong.exe gold.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 912 wrote to memory of 6116 912 gold.exe RegAsm.exe PID 3640 wrote to memory of 5404 3640 axplong.exe crypteda.exe PID 3640 wrote to memory of 5404 3640 axplong.exe crypteda.exe PID 3640 wrote to memory of 5404 3640 axplong.exe crypteda.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 5404 wrote to memory of 3476 5404 crypteda.exe RegAsm.exe PID 3476 wrote to memory of 3112 3476 RegAsm.exe xx6vYjqavZ.exe PID 3476 wrote to memory of 3112 3476 RegAsm.exe xx6vYjqavZ.exe PID 3476 wrote to memory of 3112 3476 RegAsm.exe xx6vYjqavZ.exe PID 3476 wrote to memory of 5888 3476 RegAsm.exe 5a8iGVXqTl.exe PID 3476 wrote to memory of 5888 3476 RegAsm.exe 5a8iGVXqTl.exe PID 3476 wrote to memory of 5888 3476 RegAsm.exe 5a8iGVXqTl.exe PID 3640 wrote to memory of 1284 3640 axplong.exe Nework.exe PID 3640 wrote to memory of 1284 3640 axplong.exe Nework.exe PID 3640 wrote to memory of 1284 3640 axplong.exe Nework.exe PID 1284 wrote to memory of 4544 1284 Nework.exe Hkbsse.exe PID 1284 wrote to memory of 4544 1284 Nework.exe Hkbsse.exe PID 1284 wrote to memory of 4544 1284 Nework.exe Hkbsse.exe PID 3640 wrote to memory of 4908 3640 axplong.exe stealc_default2.exe PID 3640 wrote to memory of 4908 3640 axplong.exe stealc_default2.exe PID 3640 wrote to memory of 4908 3640 axplong.exe stealc_default2.exe PID 4544 wrote to memory of 5856 4544 Hkbsse.exe joffer2.exe PID 4544 wrote to memory of 5856 4544 Hkbsse.exe joffer2.exe PID 4544 wrote to memory of 5856 4544 Hkbsse.exe joffer2.exe PID 3640 wrote to memory of 3896 3640 axplong.exe Sеtup.exe PID 3640 wrote to memory of 3896 3640 axplong.exe Sеtup.exe PID 3640 wrote to memory of 3896 3640 axplong.exe Sеtup.exe PID 5856 wrote to memory of 2132 5856 joffer2.exe service123.exe PID 5856 wrote to memory of 2132 5856 joffer2.exe service123.exe PID 5856 wrote to memory of 2132 5856 joffer2.exe service123.exe PID 5856 wrote to memory of 5776 5856 joffer2.exe schtasks.exe PID 5856 wrote to memory of 5776 5856 joffer2.exe schtasks.exe PID 5856 wrote to memory of 5776 5856 joffer2.exe schtasks.exe PID 3640 wrote to memory of 4420 3640 axplong.exe penis.exe PID 3640 wrote to memory of 4420 3640 axplong.exe penis.exe PID 3640 wrote to memory of 4420 3640 axplong.exe penis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe"C:\Users\Admin\AppData\Local\Temp\9974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Roaming\xx6vYjqavZ.exe"C:\Users\Admin\AppData\Roaming\xx6vYjqavZ.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\Users\Admin\AppData\Roaming\5a8iGVXqTl.exe"C:\Users\Admin\AppData\Roaming\5a8iGVXqTl.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe"C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:3060
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5548
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:1224
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD52d647cf43622ed10b6d733bb5f048fc3
SHA16b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA25641426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA51262400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a
-
Filesize
1.1MB
MD58e74497aff3b9d2ddb7e7f819dfc69ba
SHA11d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA5129aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
6.3MB
MD55f1dffeff8714e88b493506256db8f8a
SHA1d554da350b41da8556ce83ed851b975d2325a3d2
SHA256e372a2d6ea5d76b0ffbccfa5b6574b910826fb5b5998e8e5cc4dcd49f6dffff0
SHA5124bf57a4af1514111e301f8a1c8f3e2c145d078ba45a94edb71af6b1f9ca6dcfb3bd35d5114936f5c97ab4b1561b7b5afd4bfcc6d37b2f39b3aca0c96e0b28960
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.3MB
MD545b55d1e5d2bf60cc572f541ae6fa7d1
SHA12329f56147a299bcdbf20520e626cc8253e49a8d
SHA256039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA5125483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2
-
Filesize
256KB
MD5c7aaf6352ad8d2d6431b7b1d94e35591
SHA19409d9fcf049cdfaa8ff4a4b01e26c3c1bf4215f
SHA256ada89daaf963f6cff94f927209eeaac7641d8dc3969df89a68a3a53af0169eea
SHA5123b76cc0b92ace3cbe73b25039e823acdb5adddc4d73d50353935f383afa1bc54eb1e5a9fd71e2b6c4c053e54315cbae11a86da80993d4984bfe0186065bd4a85
-
Filesize
552KB
MD503cf06e01384018ac325de8bc160b4b2
SHA11853505e502b392fd556a9ce6050207230cc70cd
SHA2565ab3785b2b72eaf7edff8961eb8ff8dd3dc6cc7031bc96ceb06a899b6fb3bbbc
SHA512be1f2cf898db93e96e8817bf2d0ab0ef0f49d5bba4efba2de4046f6b381e8eda6ff5fcfdc057b6cbc4de5b3a7b096612c1e0d6b0d395ee685b3844ba5dc0e1b6
-
Filesize
1.8MB
MD5501eab002a4a0d559144dfa818371a24
SHA1208f1a0cbc530223a68513981ed2c76c6ece6694
SHA2569974ad0e6857b2cc143a39ba5ea90a0cfa9971c58ebb298f384020d386c3706e
SHA5126d19c48bfc14253a57ccfc5575fff8640020c85e25a67be435a1fc7c9e750796f162c31ec9fc97f29c8099a86101118b90ced4bfe47be661c42d52d0a974c418
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
304KB
MD530f46f4476cdc27691c7fdad1c255037
SHA1b53415af5d01f8500881c06867a49a5825172e36
SHA2563a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\76b53b3ec448f7ccdda2063b15d2bfc3_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0
Filesize2KB
MD55aa367b44c4c4477e4bf2c393a1bca90
SHA11766a3d1be909d1ee1b4e231d52ba1d36b1dccc5
SHA25600760e507eadfd6ea20ca1c6f9d4f937c77060fb5ddeaf64e2c8e050dd53c753
SHA512f3edbd389767b2d51703d2a0d957ae89e2ee1a16f400fdc15d84adfeb61c2a486bc5c2e9490c8de5c99b708e146f887cdf20b13205f641c75e1e18a4ac83c211
-
Filesize
544KB
MD588367533c12315805c059e688e7cdfe9
SHA164a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA5127a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714
-
Filesize
2KB
MD509605592a467273df4b1b4645781a8d0
SHA18dfaef01c2f5d2c2d99bfe1dccb634168b4909d2
SHA25624505e98db3b90c15ded1936c1cd6bdd452d408dd48d41f94295906a7e047664
SHA5128b78363160d8d32fd7676dceb310536ced9e9e02f73c9a6f56c3a526d179031cd00783a440b5d1f386fc27f9ca59f684689f4f0b3392d850e4aa3ebec73ffb60
-
Filesize
2KB
MD5005fd4b8d22884279a8bab98d2152d08
SHA1beaa4a1d63386b1c1d3da6c014ac6bfd9c429c69
SHA2567d6e2c8ee5f2f4e31072389d337a182db97b987bda3f7ca1dec51903cc8e3bf1
SHA512a44bbeb069719787a717514dcc3f1b28f9f47098c16e16f5b6c7c0618eb3793f935e037644b5a32ec82aa9221333034ca1589c447af83a7f9aa3f2de39ff1db5