Analysis
-
max time kernel
112s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 08:47
Static task
static1
Behavioral task
behavioral1
Sample
2f5ce97e7640bb3309a3a2cb25481a80N.exe
Resource
win7-20240903-en
General
-
Target
2f5ce97e7640bb3309a3a2cb25481a80N.exe
-
Size
1.8MB
-
MD5
2f5ce97e7640bb3309a3a2cb25481a80
-
SHA1
f13301099fc1ee67fb5a7d8b82334bb83ef2c2f9
-
SHA256
79661b9ae7902feed4160a4f2aef08891b039065ce62a81fb0ef8c20a31e642b
-
SHA512
5286e57303ca163af612f7650c24b2a0707da537e4ccdd00b95b33f3f57f27bc1ff8e3ed13261bcef516da5ee4669f183295e23ab84ef8fcb29d8fce849055b8
-
SSDEEP
49152:52w6jXby1mUOzLPLLp44K+18ufxkUClItRQ5dPwE:IhjX2khP+4F18ufxkUaItRCF7
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exeaxplong.exeaxplong.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2f5ce97e7640bb3309a3a2cb25481a80N.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplong.exe2f5ce97e7640bb3309a3a2cb25481a80N.exeaxplong.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2f5ce97e7640bb3309a3a2cb25481a80N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2f5ce97e7640bb3309a3a2cb25481a80N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 2f5ce97e7640bb3309a3a2cb25481a80N.exe -
Executes dropped EXE 3 IoCs
Processes:
axplong.exeaxplong.exeaxplong.exepid process 4904 axplong.exe 4852 axplong.exe 3324 axplong.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplong.exeaxplong.exeaxplong.exe2f5ce97e7640bb3309a3a2cb25481a80N.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine 2f5ce97e7640bb3309a3a2cb25481a80N.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exeaxplong.exeaxplong.exeaxplong.exepid process 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe 4904 axplong.exe 4852 axplong.exe 3324 axplong.exe -
Drops file in Windows directory 1 IoCs
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exedescription ioc process File created C:\Windows\Tasks\axplong.job 2f5ce97e7640bb3309a3a2cb25481a80N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f5ce97e7640bb3309a3a2cb25481a80N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exeaxplong.exeaxplong.exeaxplong.exepid process 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe 4904 axplong.exe 4904 axplong.exe 4852 axplong.exe 4852 axplong.exe 3324 axplong.exe 3324 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exepid process 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2f5ce97e7640bb3309a3a2cb25481a80N.exedescription pid process target process PID 212 wrote to memory of 4904 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe axplong.exe PID 212 wrote to memory of 4904 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe axplong.exe PID 212 wrote to memory of 4904 212 2f5ce97e7640bb3309a3a2cb25481a80N.exe axplong.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f5ce97e7640bb3309a3a2cb25481a80N.exe"C:\Users\Admin\AppData\Local\Temp\2f5ce97e7640bb3309a3a2cb25481a80N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD52f5ce97e7640bb3309a3a2cb25481a80
SHA1f13301099fc1ee67fb5a7d8b82334bb83ef2c2f9
SHA25679661b9ae7902feed4160a4f2aef08891b039065ce62a81fb0ef8c20a31e642b
SHA5125286e57303ca163af612f7650c24b2a0707da537e4ccdd00b95b33f3f57f27bc1ff8e3ed13261bcef516da5ee4669f183295e23ab84ef8fcb29d8fce849055b8