Malware Analysis Report

2024-10-23 17:17

Sample ID 240910-cwyk4stgra
Target 48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829
SHA256 48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829
Tags
amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829

Threat Level: Known bad

The file 48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829 was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer spyware stealer trojan

RedLine payload

Stealc

CryptBot

Amadey

RedLine

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks BIOS information in registry

Identifies Wine through registry keys

Checks computer location settings

Reads data files stored by FTP clients

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Modifies system certificate store

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-10 02:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-10 02:26

Reported

2024-09-10 02:28

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe"

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4528 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4528 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4528 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3612 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 3612 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 3612 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1344 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1344 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3612 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 3612 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 3612 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3352 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe
PID 3352 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe
PID 3352 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe
PID 3352 wrote to memory of 3380 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe
PID 3352 wrote to memory of 3380 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe
PID 3352 wrote to memory of 3380 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe
PID 3612 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3612 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3612 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3452 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 3452 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 3452 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 3612 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 3612 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 3612 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 3612 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 3612 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 3612 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 4316 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4316 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4316 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 3612 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 3612 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 3612 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2440 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3612 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 3612 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

Processes

C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe

"C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe

"C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe"

C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe

"C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"

C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
FI 65.21.18.51:45580 tcp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
FI 95.216.107.53:12311 tcp
US 154.216.17.216:80 154.216.17.216 tcp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 53.107.216.95.in-addr.arpa udp
US 8.8.8.8:53 216.17.216.154.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 fivev5sb.top udp
RU 80.249.144.180:80 fivev5sb.top tcp
US 8.8.8.8:53 sevtv17pn.top udp
RU 195.133.13.230:80 sevtv17pn.top tcp
US 8.8.8.8:53 180.144.249.80.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 230.13.133.195.in-addr.arpa udp
RU 80.249.144.180:80 fivev5sb.top tcp
CZ 188.124.59.28:443 tcp
RU 185.215.113.67:15206 tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
RU 80.249.144.180:80 fivev5sb.top tcp

Files

memory/4528-0-0x00000000001F0000-0x00000000006A9000-memory.dmp

memory/4528-1-0x0000000077BE4000-0x0000000077BE6000-memory.dmp

memory/4528-2-0x00000000001F1000-0x000000000021F000-memory.dmp

memory/4528-3-0x00000000001F0000-0x00000000006A9000-memory.dmp

memory/4528-4-0x00000000001F0000-0x00000000006A9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 4471bdb5f382d9f7dd7bb21a01eeca0b
SHA1 297c542dc175f14db9e3959a6a7275055b1ac6af
SHA256 48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829
SHA512 c8214818c97a5998be7d2349bf566e0bbffece7eeb71fb37b08f2218752d7395ec0d0febfb227867be4499dceeec9160726ef150b30aecd1be3b3e00d12aa48f

memory/4528-17-0x00000000001F0000-0x00000000006A9000-memory.dmp

memory/3612-16-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-19-0x0000000000F51000-0x0000000000F7F000-memory.dmp

memory/3612-20-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-21-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-22-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-23-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-24-0x0000000000F50000-0x0000000001409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 2d647cf43622ed10b6d733bb5f048fc3
SHA1 6b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA256 41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA512 62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

memory/1344-45-0x00000000737FE000-0x00000000737FF000-memory.dmp

memory/1344-46-0x0000000000700000-0x0000000000754000-memory.dmp

memory/1724-48-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1724-50-0x0000000005910000-0x0000000005EB4000-memory.dmp

memory/1724-51-0x0000000005360000-0x00000000053F2000-memory.dmp

memory/1724-52-0x00000000052F0000-0x00000000052FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpEDAC.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/1724-69-0x0000000006040000-0x00000000060B6000-memory.dmp

memory/1724-70-0x0000000006820000-0x000000000683E000-memory.dmp

memory/1724-73-0x00000000071B0000-0x00000000077C8000-memory.dmp

memory/1724-74-0x0000000008A30000-0x0000000008B3A000-memory.dmp

memory/1724-75-0x00000000070B0000-0x00000000070C2000-memory.dmp

memory/1724-76-0x0000000007110000-0x000000000714C000-memory.dmp

memory/1724-77-0x0000000007150000-0x000000000719C000-memory.dmp

memory/3612-78-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-79-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-80-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/2252-82-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-83-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-84-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-85-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-86-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-87-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-88-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/1812-90-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3612-91-0x0000000000F50000-0x0000000001409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 8e74497aff3b9d2ddb7e7f819dfc69ba
SHA1 1d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA512 9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

memory/3140-110-0x00000000005E0000-0x00000000006F2000-memory.dmp

memory/3352-112-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3352-117-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3352-116-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3352-115-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Roaming\1KuKd94Gnz.exe

MD5 88367533c12315805c059e688e7cdfe9
SHA1 64a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA512 7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

C:\Users\Admin\AppData\Roaming\BhT1URTLba.exe

MD5 30f46f4476cdc27691c7fdad1c255037
SHA1 b53415af5d01f8500881c06867a49a5825172e36
SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512 271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

memory/3352-138-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3380-141-0x0000000000170000-0x00000000001C2000-memory.dmp

memory/2652-142-0x0000000000790000-0x000000000081E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-945322488-2060912225-3527527000-1000\76b53b3ec448f7ccdda2063b15d2bfc3_03d68389-5a68-4d9e-92ac-47b927e624dd

MD5 e13260c31221f164b06695c91f077216
SHA1 2f900067b664f4fec9cd4caf872346b34f7a1b4c
SHA256 4c84071766b9cb8e66fc465b04f1376484196597ec83f437b281693516af4ad9
SHA512 0b71626b8ad83c3df749cc81f7115fbbcdcb586125be8054ea709ccc1088142a1954a8e540832d7486136f33adef28bee23b07a61b6ef44954364989362378ae

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 353e9e2fa47d7a9c14a35cceac0360b3
SHA1 18c41db29a4c28597f096ba252868cb57186eff1
SHA256 a402c8dac3b12da5d655c7b3dcd6483fa998dc33fb49c8fcf8ec0d63fc4bacbf
SHA512 60a044bcdff9cdaf3ac7011e5ca6eca8ce4657db73a1d428008ea153f890e679dce2474917666290764545effb6215b4f4a836304c03ebf1e32da354b685c7ed

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 df35b1229e045b7cfd9b9576c7af6a0a
SHA1 4d685fce7540a4ec10853b20987ca8831e5f184b
SHA256 8168f2470bb7a27e3a09aaa7e8748b2150e4e96a76f6017214c8392d907ce2bc
SHA512 8b8ebc2f658180edec34e20337491bd60829832110d1be28e08544afa2707b8b064933ac8662f524b88b4e0c79776df526e44a786ccc04388271ba9013c1dc55

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/2256-205-0x0000000000A10000-0x0000000000C53000-memory.dmp

memory/2652-206-0x0000000008C10000-0x0000000008C76000-memory.dmp

memory/2652-207-0x0000000009820000-0x00000000099E2000-memory.dmp

memory/2652-208-0x0000000009F20000-0x000000000A44C000-memory.dmp

memory/3612-210-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3380-213-0x0000000006F70000-0x0000000006FC0000-memory.dmp

memory/2256-215-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3612-248-0x0000000000F50000-0x0000000001409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

MD5 45b55d1e5d2bf60cc572f541ae6fa7d1
SHA1 2329f56147a299bcdbf20520e626cc8253e49a8d
SHA256 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA512 5483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2

C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe

MD5 651269f574a059288d0e78b28438a430
SHA1 a22a0fb4669672d2f602d12d2f7a09d91ed6accb
SHA256 feb98395aab41886938dc9f25716097f13792a09af42e22214d862002d82886d
SHA512 d53bc56518f034000c63cc8b692fa55e4902c140bb0b0fc17e693b7a615388d49cd61c5eebd54c024c6708bf7ba345fadfd269c1eb1b3543474a078308b854d7

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7e6a519688246fe1180f35fe0d25d370
SHA1 8e8719ac897dfef7305311dc216f570af40709af
SHA256 32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512 a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

memory/2064-308-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2064-311-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/2440-313-0x0000000000400000-0x000000000079D000-memory.dmp

memory/2064-312-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3612-314-0x0000000000F50000-0x0000000001409000-memory.dmp

memory/3864-315-0x0000000000400000-0x0000000001069000-memory.dmp

memory/3596-319-0x0000000000400000-0x000000000106A000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 0faa6e1a78e6bb809eb5a7cdcdf68e17
SHA1 f1ba39e702710365c345ab034bcd1a6d5ec8d4ad
SHA256 9d6966889f6ec503ae2bd99c666b55429d1835e538e1ac15f06c3524241c0c92
SHA512 261cd43b42ccbe7b6b393d454270dd22110c062632707f73bf045f91aee0f09b4387cac8ba7a9275b1ddaa427240606f654f74224fe6fcd38c8ae40b3c4f8ee7

memory/3460-356-0x0000000002900000-0x0000000002E25000-memory.dmp

memory/3460-357-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/3460-358-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/3460-362-0x0000000002900000-0x0000000002E25000-memory.dmp

memory/3460-363-0x0000000002900000-0x0000000002E25000-memory.dmp

memory/3460-364-0x0000000002900000-0x0000000002E25000-memory.dmp

memory/3460-361-0x0000000002900000-0x0000000002E25000-memory.dmp

memory/3460-359-0x0000000002900000-0x0000000002E25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/3060-383-0x0000000000DA0000-0x0000000000DF2000-memory.dmp

memory/2256-404-0x0000000000A10000-0x0000000000C53000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-10 02:26

Reported

2024-09-10 02:28

Platform

win11-20240802-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe

"C:\Users\Admin\AppData\Local\Temp\48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp

Files

memory/3800-0-0x0000000000DC0000-0x0000000001279000-memory.dmp

memory/3800-1-0x0000000077CA6000-0x0000000077CA8000-memory.dmp

memory/3800-2-0x0000000000DC1000-0x0000000000DEF000-memory.dmp

memory/3800-3-0x0000000000DC0000-0x0000000001279000-memory.dmp

memory/3800-4-0x0000000000DC0000-0x0000000001279000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 4471bdb5f382d9f7dd7bb21a01eeca0b
SHA1 297c542dc175f14db9e3959a6a7275055b1ac6af
SHA256 48518c1d42cdb5731ca0842768f3dbd73bc5aa0b4135f9c6937ebd0157b91829
SHA512 c8214818c97a5998be7d2349bf566e0bbffece7eeb71fb37b08f2218752d7395ec0d0febfb227867be4499dceeec9160726ef150b30aecd1be3b3e00d12aa48f

memory/3800-18-0x0000000000DC0000-0x0000000001279000-memory.dmp

memory/4404-16-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-19-0x00000000004B1000-0x00000000004DF000-memory.dmp

memory/4404-20-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-21-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-22-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-23-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-25-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-26-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-27-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/3324-29-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/3324-30-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/3324-31-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/3324-33-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-34-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-35-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-36-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-37-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-38-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-39-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/1648-41-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-42-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-43-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-44-0x00000000004B0000-0x0000000000969000-memory.dmp

memory/4404-45-0x00000000004B0000-0x0000000000969000-memory.dmp