Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-09-2024 00:00
Static task
static1
Behavioral task
behavioral1
Sample
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe
Resource
win11-20240802-en
General
-
Target
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe
-
Size
1.8MB
-
MD5
aa4fb267d83447b5d217b699cf3e747a
-
SHA1
a79d9a2d98f30754bbea11392dbc16429c4da236
-
SHA256
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306
-
SHA512
b98fd785054af047d9db3e84d5fbb5733232452985e97e5b6bc1d7db0771015702a6dc3bec7d3d80a8769aaa9d4d54c35815e65ac061312d0672f112f6da2568
-
SSDEEP
49152:UyzE0F2yv+HxQ//cbHwsAUuPFaXQ5LHi:UyzEi+RQ0wJNaXQ8
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
cryptbot
fivev5sb.top
-
url_path
/v1/upload.php
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
redline
bundle
185.215.113.67:15206
Extracted
xworm
exonic-hacks.com:1920
-
Install_directory
%Userprofile%
-
install_file
Windows.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe family_xworm behavioral2/memory/4464-1516-0x0000000000E10000-0x0000000000E2E000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2420-45-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe family_redline behavioral2/memory/2588-289-0x0000000000F80000-0x0000000000FD2000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
Processes:
RMS1.exedescription pid process target process PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE PID 3568 created 3320 3568 RMS1.exe Explorer.EXE -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
axplong.exeaxplong.exeaxplong.exed1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplong.exeaxplong.exed1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Executes dropped EXE 18 IoCs
Processes:
axplong.exegold.exeaxplong.exeNework.exeHkbsse.exestealc_default2.exeSеtup.exeneedmoney.exepenis.exesvchost015.exebundle.exeHkbsse.exeacentric.exeaxplong.exeRMS1.exeservice123.exefreedom.exefilename.exepid process 2112 axplong.exe 4296 gold.exe 3972 axplong.exe 2200 Nework.exe 4104 Hkbsse.exe 3120 stealc_default2.exe 3496 Sеtup.exe 2188 needmoney.exe 1180 penis.exe 3136 svchost015.exe 2588 bundle.exe 3312 Hkbsse.exe 932 acentric.exe 4004 axplong.exe 3568 RMS1.exe 1684 service123.exe 4464 freedom.exe 1312 filename.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exeaxplong.exeaxplong.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine axplong.exe -
Loads dropped DLL 3 IoCs
Processes:
stealc_default2.exeservice123.exepid process 3120 stealc_default2.exe 3120 stealc_default2.exe 1684 service123.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
acentric.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" acentric.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exeaxplong.exeaxplong.exeaxplong.exepid process 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe 2112 axplong.exe 3972 axplong.exe 4004 axplong.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
gold.exeneedmoney.exeRMS1.exeacentric.exedescription pid process target process PID 4296 set thread context of 2420 4296 gold.exe RegAsm.exe PID 2188 set thread context of 3136 2188 needmoney.exe svchost015.exe PID 3568 set thread context of 4784 3568 RMS1.exe InstallUtil.exe PID 932 set thread context of 1580 932 acentric.exe Explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
Nework.exed1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exedescription ioc process File created C:\Windows\Tasks\Hkbsse.job Nework.exe File created C:\Windows\Tasks\axplong.job d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
needmoney.exeExplorer.exed1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exeNework.exeacentric.exeHkbsse.exebundle.exegold.exepenis.exestealc_default2.exeSеtup.exesvchost015.exeservice123.exeschtasks.exefilename.exeaxplong.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language needmoney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acentric.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bundle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sеtup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language filename.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
stealc_default2.exeSеtup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sеtup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sеtup.exe -
Processes:
RegAsm.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exeaxplong.exeaxplong.exestealc_default2.exepenis.exeaxplong.exebundle.exeRMS1.exepowershell.exepid process 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe 2112 axplong.exe 2112 axplong.exe 3972 axplong.exe 3972 axplong.exe 3120 stealc_default2.exe 3120 stealc_default2.exe 3120 stealc_default2.exe 3120 stealc_default2.exe 1180 penis.exe 4004 axplong.exe 4004 axplong.exe 2588 bundle.exe 2588 bundle.exe 2588 bundle.exe 2588 bundle.exe 2588 bundle.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 3568 RMS1.exe 2960 powershell.exe 2960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
penis.exeRMS1.exebundle.exeacentric.exepowershell.exefreedom.exedescription pid process Token: SeDebugPrivilege 1180 penis.exe Token: SeBackupPrivilege 1180 penis.exe Token: SeSecurityPrivilege 1180 penis.exe Token: SeSecurityPrivilege 1180 penis.exe Token: SeSecurityPrivilege 1180 penis.exe Token: SeSecurityPrivilege 1180 penis.exe Token: SeDebugPrivilege 3568 RMS1.exe Token: SeDebugPrivilege 2588 bundle.exe Token: SeDebugPrivilege 932 acentric.exe Token: SeDebugPrivilege 3568 RMS1.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 4464 freedom.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exepid process 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exeaxplong.exegold.exeNework.exeneedmoney.exeSеtup.exeRMS1.exedescription pid process target process PID 5112 wrote to memory of 2112 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe axplong.exe PID 5112 wrote to memory of 2112 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe axplong.exe PID 5112 wrote to memory of 2112 5112 d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe axplong.exe PID 2112 wrote to memory of 4296 2112 axplong.exe gold.exe PID 2112 wrote to memory of 4296 2112 axplong.exe gold.exe PID 2112 wrote to memory of 4296 2112 axplong.exe gold.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 4296 wrote to memory of 2420 4296 gold.exe RegAsm.exe PID 2112 wrote to memory of 2200 2112 axplong.exe Nework.exe PID 2112 wrote to memory of 2200 2112 axplong.exe Nework.exe PID 2112 wrote to memory of 2200 2112 axplong.exe Nework.exe PID 2200 wrote to memory of 4104 2200 Nework.exe Hkbsse.exe PID 2200 wrote to memory of 4104 2200 Nework.exe Hkbsse.exe PID 2200 wrote to memory of 4104 2200 Nework.exe Hkbsse.exe PID 2112 wrote to memory of 3120 2112 axplong.exe stealc_default2.exe PID 2112 wrote to memory of 3120 2112 axplong.exe stealc_default2.exe PID 2112 wrote to memory of 3120 2112 axplong.exe stealc_default2.exe PID 2112 wrote to memory of 3496 2112 axplong.exe Sеtup.exe PID 2112 wrote to memory of 3496 2112 axplong.exe Sеtup.exe PID 2112 wrote to memory of 3496 2112 axplong.exe Sеtup.exe PID 2112 wrote to memory of 2188 2112 axplong.exe needmoney.exe PID 2112 wrote to memory of 2188 2112 axplong.exe needmoney.exe PID 2112 wrote to memory of 2188 2112 axplong.exe needmoney.exe PID 2112 wrote to memory of 1180 2112 axplong.exe penis.exe PID 2112 wrote to memory of 1180 2112 axplong.exe penis.exe PID 2112 wrote to memory of 1180 2112 axplong.exe penis.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2188 wrote to memory of 3136 2188 needmoney.exe svchost015.exe PID 2112 wrote to memory of 2588 2112 axplong.exe bundle.exe PID 2112 wrote to memory of 2588 2112 axplong.exe bundle.exe PID 2112 wrote to memory of 2588 2112 axplong.exe bundle.exe PID 2112 wrote to memory of 932 2112 axplong.exe acentric.exe PID 2112 wrote to memory of 932 2112 axplong.exe acentric.exe PID 2112 wrote to memory of 932 2112 axplong.exe acentric.exe PID 2112 wrote to memory of 3568 2112 axplong.exe RMS1.exe PID 2112 wrote to memory of 3568 2112 axplong.exe RMS1.exe PID 3496 wrote to memory of 1684 3496 Sеtup.exe service123.exe PID 3496 wrote to memory of 1684 3496 Sеtup.exe service123.exe PID 3496 wrote to memory of 1684 3496 Sеtup.exe service123.exe PID 3496 wrote to memory of 2812 3496 Sеtup.exe schtasks.exe PID 3496 wrote to memory of 2812 3496 Sеtup.exe schtasks.exe PID 3496 wrote to memory of 2812 3496 Sеtup.exe schtasks.exe PID 3568 wrote to memory of 2656 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 2656 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 3700 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 3700 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 3000 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 3000 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 3488 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 3488 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 4436 3568 RMS1.exe InstallUtil.exe PID 3568 wrote to memory of 4436 3568 RMS1.exe InstallUtil.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe"C:\Users\Admin\AppData\Local\Temp\d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"6⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe"C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:2656
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:3700
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:3000
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:3488
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:4436
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:2004
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:1188
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3972
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:3312
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4004
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
313KB
MD52d647cf43622ed10b6d733bb5f048fc3
SHA16b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA25641426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA51262400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a
-
Filesize
16KB
MD5503631b381969d0c58d8c7e2071e512d
SHA12ff3b27778ff8d57f2619cf27d85c0109345c726
SHA256346a65bdf95b4162616d9f21250e5a7b292130cdb19ded7889513e78318905ef
SHA512e4762a7b266fcdf6e56113ecb2bc9fab9b01a9d5fb0602d9dd1105f90d6d26d5be6a2b1b9f27b31e6109cef2febafcf2791608bda3e3ba22a9dc7c45516e2d8e
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.3MB
MD545b55d1e5d2bf60cc572f541ae6fa7d1
SHA12329f56147a299bcdbf20520e626cc8253e49a8d
SHA256039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA5125483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2
-
Filesize
3.6MB
MD57e6a519688246fe1180f35fe0d25d370
SHA18e8719ac897dfef7305311dc216f570af40709af
SHA25632a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972
-
Filesize
402KB
MD562eab4110407c75c3f17b9d40a41462c
SHA1ee0e876f23db4fd5c9b7fc02b51d9ae9f2daa49e
SHA256e71efcdf203c7da30c32b3f42dc7f04587dc071a71d4e007d6b3424421da197c
SHA5120ec379ce8f1aa55648d53aa9dec014b8dcdf9782c6547caceaa9eb7c6e0780c35e6f7eec4789fa73258b78425f3314c8bf940d68e8fa925d437a2fdb49a396fd
-
Filesize
304KB
MD530daa686c1f31cc4833bd3d7283d8cdc
SHA170f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA5129f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9
-
Filesize
454KB
MD537d198ad751d31a71acc9cb28ed0c64e
SHA18eb519b7a6df66d84c566605da9a0946717a921d
SHA2561ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA51260923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96
-
Filesize
1.4MB
MD503b1ed4c105e5f473357dad1df17cf98
SHA1faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA2566be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA5123f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765
-
Filesize
94KB
MD5db5717fd494495eea3c8f7d4ab29d6b0
SHA139ba82340121d9b08e9cf3d4ba6dfcb12eb6c559
SHA2566b59309ab12f1859a94fb2ce1c98639b2a538e6e098ffac127e45c29733bd993
SHA512b16c7bffc8418a0349e5189d61439df325d2ab33a42c720380a305decde00348f83d96b6c263a95dc253128eb0e47b1a3dc96f8f115da868ff9227b9a40882de
-
Filesize
6KB
MD5307dca9c775906b8de45869cabe98fcd
SHA12b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
SHA2568437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c
SHA51280c03f7add3a33a5df7b1f1665253283550dac484d26339ecd85672fb506dce44bd0bf96275d5c41a2e7369c3b604de377b7f5985d7d0d76c7ac663d60a67a1c
-
Filesize
73KB
MD5e9f14d0bd20f33b351f958c92fcc4874
SHA14c57ea75f6ee76a1e01f2d488214d779c255c65e
SHA2560da8e6be2a552887c3a16f04f4cd2a623ce1b62b80aaa8a8046be4e4463ac24b
SHA512e2927e23e6c65b92dc0c0d0f5f996e5aae3b0edbacfd255a92c690666d9616070868cfdc9288f54e193c91dceae22db4818c85e0a6ba6d2b9fdddf96f3d4ebaa
-
Filesize
1.8MB
MD5aa4fb267d83447b5d217b699cf3e747a
SHA1a79d9a2d98f30754bbea11392dbc16429c4da236
SHA256d1982ebf182187037a956c8cc32d203a23bb72fe946b5d28c727449e58b24306
SHA512b98fd785054af047d9db3e84d5fbb5733232452985e97e5b6bc1d7db0771015702a6dc3bec7d3d80a8769aaa9d4d54c35815e65ac061312d0672f112f6da2568
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.3MB
MD536a627b26fae167e6009b4950ff15805
SHA1f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA5122133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4272559161-3282441186-401869126-1000\76b53b3ec448f7ccdda2063b15d2bfc3_e1cb8dfe-5215-4859-82e0-ad3714d680b0
Filesize2KB
MD5ca4164f1fdd4905c03dbcb62de268207
SHA1ce8a0d0ee466a7494eabcef15a0d9483a51ef803
SHA25694dda9ecb8d852618db7bbaadaebcbf60bc8e3757cf0e53c23e5149ceffadcbd
SHA5128e9586060b4d942847216fe45ee8c7013338247cd26bd83352bcc747cadcc52a67d0acdf0af63b124cecec99d5f59c77a6b09693c93009bd5ff092a46314f339
-
Filesize
2KB
MD5f25ea0aff7f3ed07990ea3b05b5440fd
SHA166df6b04a1a5f5c3ccf3b5aaeb6d4287fda786f5
SHA2565b0fa941d94657b7a0fc0e241b34e4ad674ce6842d0fbfb4c86d342e2ff77a6a
SHA5121e3965ba2991658691736161378c7d0ddaa3e98099253dc8e1040fe958c94b890ed07afb2ddd27056c0efa01469a0c6793b20f32a37d1e9a7a7d1d7a24c7dd3c
-
Filesize
2KB
MD5a8ea919515ad98d65a73bf06ce725c81
SHA1c5353949e0c719c765bf2d0b1db5e72083339206
SHA256e5b1b0655fb8e3f8c7bc68a15cf6dfdaa52e7c08e25558e5c4e71b9251c334ba
SHA5125df6ac7477484ff979ef0dd8a39659d6e64055831b970427be112c662fb6e72b7936fd1ac5ec5589eb52a4cdd04f4128cf9fe3020ad2985ae50b27eae42af464