Analysis
-
max time kernel
291s -
max time network
285s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 22:39
Static task
static1
Behavioral task
behavioral1
Sample
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe
Resource
win7-20240903-en
General
-
Target
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe
-
Size
1.8MB
-
MD5
1eb29fa0ff443a7e9a35fa1bf00a8663
-
SHA1
ea3120a71769399bb5ba6b313ab44928d218193a
-
SHA256
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41
-
SHA512
86fa86d8d8bb990cae20e974d20a13356ba7559840b191c1c83f885bf04e9ff4e1e96a28eb4a6136b5dc2dc4b523a41a1521442ab0824aff2b8e3b49cbfdac58
-
SSDEEP
49152:qCrObKXX0VxtBvhvisr8leUB/+y3q42oelcFcR:qCGggB5iVlXB+oelcCR
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
redline
@OLEH_PSP
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
cryptbot
fivevd5ht.top
analforeverlovyu.top
sevtvd17ht.top
-
url_path
/v1/upload.php
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
redline
bundle
185.215.113.67:15206
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2484-46-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2484-52-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2484-51-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2484-44-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2484-49-0x0000000000400000-0x0000000000452000-memory.dmp family_redline \Users\Admin\AppData\Roaming\FW3dxdsLtP.exe family_redline behavioral1/memory/908-98-0x00000000008F0000-0x0000000000942000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe family_redline behavioral1/memory/2876-340-0x0000000000260000-0x00000000002B2000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
axplong.exe7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe -
Drops startup file 1 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enOv1UdtlNApRgVCSTcX3KXw.bat InstallUtil.exe -
Executes dropped EXE 24 IoCs
Processes:
axplong.exegold.execrypteda.exemuU1tpDOTw.exeFW3dxdsLtP.exeNework.exeHkbsse.exestealc_default2.exe2.exeJLumma.exeneedmoney.exepenis.exesvchost015.exebundle.exeacentric.exe2.exeJUmer.exeservice123.exefilename.exeBubly2.exeservice123.exeservice123.exeservice123.exeservice123.exepid process 1552 axplong.exe 1436 gold.exe 2668 crypteda.exe 2256 muU1tpDOTw.exe 908 FW3dxdsLtP.exe 1456 Nework.exe 636 Hkbsse.exe 540 stealc_default2.exe 2540 2.exe 2112 JLumma.exe 1812 needmoney.exe 984 penis.exe 2232 svchost015.exe 2876 bundle.exe 1972 acentric.exe 2084 2.exe 1460 JUmer.exe 3024 service123.exe 264 filename.exe 2516 Bubly2.exe 1612 service123.exe 984 service123.exe 2216 service123.exe 2884 service123.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine axplong.exe -
Loads dropped DLL 35 IoCs
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeaxplong.execrypteda.exeNework.exestealc_default2.exeHkbsse.exeneedmoney.exe2.exe2.exeservice123.exebundle.exeservice123.exeservice123.exeservice123.exeservice123.exepid process 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe 1552 axplong.exe 1552 axplong.exe 1552 axplong.exe 2668 crypteda.exe 2668 crypteda.exe 1552 axplong.exe 1456 Nework.exe 1552 axplong.exe 1552 axplong.exe 540 stealc_default2.exe 540 stealc_default2.exe 1552 axplong.exe 1552 axplong.exe 636 Hkbsse.exe 1552 axplong.exe 1552 axplong.exe 1552 axplong.exe 1812 needmoney.exe 1552 axplong.exe 1552 axplong.exe 1552 axplong.exe 2084 2.exe 636 Hkbsse.exe 636 Hkbsse.exe 2540 2.exe 2540 2.exe 3024 service123.exe 2876 bundle.exe 1552 axplong.exe 1552 axplong.exe 1612 service123.exe 984 service123.exe 2216 service123.exe 2884 service123.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
acentric.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" acentric.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeaxplong.exepid process 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe 1552 axplong.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
gold.exeneedmoney.exeBubly2.exedescription pid process target process PID 1436 set thread context of 2484 1436 gold.exe RegAsm.exe PID 1812 set thread context of 2232 1812 needmoney.exe svchost015.exe PID 2516 set thread context of 2244 2516 Bubly2.exe InstallUtil.exe -
Drops file in Windows directory 2 IoCs
Processes:
Nework.exe7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exedescription ioc process File created C:\Windows\Tasks\Hkbsse.job Nework.exe File created C:\Windows\Tasks\axplong.job 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Hkbsse.exeJLumma.exebundle.exesvchost015.exeJUmer.exeaxplong.exegold.exemuU1tpDOTw.exeacentric.exefilename.exeBubly2.exeInstallUtil.exeFW3dxdsLtP.exeneedmoney.exepenis.exe2.exe7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.execrypteda.exeNework.exeschtasks.exeRegAsm.exestealc_default2.exe2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLumma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bundle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUmer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language muU1tpDOTw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acentric.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language filename.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bubly2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FW3dxdsLtP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language needmoney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
stealc_default2.exe2.exeJUmer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JUmer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JUmer.exe -
Processes:
muU1tpDOTw.exebundle.exeRegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 muU1tpDOTw.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 muU1tpDOTw.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 muU1tpDOTw.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 muU1tpDOTw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 bundle.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 bundle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeaxplong.exeRegAsm.exemuU1tpDOTw.exestealc_default2.exeFW3dxdsLtP.exepenis.exebundle.exeBubly2.exepid process 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe 1552 axplong.exe 2484 RegAsm.exe 2256 muU1tpDOTw.exe 540 stealc_default2.exe 908 FW3dxdsLtP.exe 908 FW3dxdsLtP.exe 908 FW3dxdsLtP.exe 2484 RegAsm.exe 2484 RegAsm.exe 540 stealc_default2.exe 984 penis.exe 2876 bundle.exe 2876 bundle.exe 2876 bundle.exe 2516 Bubly2.exe 2516 Bubly2.exe 2516 Bubly2.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
muU1tpDOTw.exeRegAsm.exeFW3dxdsLtP.exepenis.exebundle.exeacentric.exeBubly2.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2256 muU1tpDOTw.exe Token: SeBackupPrivilege 2256 muU1tpDOTw.exe Token: SeSecurityPrivilege 2256 muU1tpDOTw.exe Token: SeSecurityPrivilege 2256 muU1tpDOTw.exe Token: SeSecurityPrivilege 2256 muU1tpDOTw.exe Token: SeSecurityPrivilege 2256 muU1tpDOTw.exe Token: SeDebugPrivilege 2484 RegAsm.exe Token: SeDebugPrivilege 908 FW3dxdsLtP.exe Token: SeDebugPrivilege 984 penis.exe Token: SeBackupPrivilege 984 penis.exe Token: SeSecurityPrivilege 984 penis.exe Token: SeSecurityPrivilege 984 penis.exe Token: SeSecurityPrivilege 984 penis.exe Token: SeSecurityPrivilege 984 penis.exe Token: SeDebugPrivilege 2876 bundle.exe Token: SeDebugPrivilege 1972 acentric.exe Token: SeDebugPrivilege 2516 Bubly2.exe Token: SeDebugPrivilege 2244 InstallUtil.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeNework.exepid process 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe 1456 Nework.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exeaxplong.exegold.execrypteda.exeNework.exeHkbsse.exeneedmoney.exedescription pid process target process PID 2028 wrote to memory of 1552 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe axplong.exe PID 2028 wrote to memory of 1552 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe axplong.exe PID 2028 wrote to memory of 1552 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe axplong.exe PID 2028 wrote to memory of 1552 2028 7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe axplong.exe PID 1552 wrote to memory of 1436 1552 axplong.exe gold.exe PID 1552 wrote to memory of 1436 1552 axplong.exe gold.exe PID 1552 wrote to memory of 1436 1552 axplong.exe gold.exe PID 1552 wrote to memory of 1436 1552 axplong.exe gold.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1436 wrote to memory of 2484 1436 gold.exe RegAsm.exe PID 1552 wrote to memory of 2668 1552 axplong.exe crypteda.exe PID 1552 wrote to memory of 2668 1552 axplong.exe crypteda.exe PID 1552 wrote to memory of 2668 1552 axplong.exe crypteda.exe PID 1552 wrote to memory of 2668 1552 axplong.exe crypteda.exe PID 2668 wrote to memory of 2256 2668 crypteda.exe muU1tpDOTw.exe PID 2668 wrote to memory of 2256 2668 crypteda.exe muU1tpDOTw.exe PID 2668 wrote to memory of 2256 2668 crypteda.exe muU1tpDOTw.exe PID 2668 wrote to memory of 2256 2668 crypteda.exe muU1tpDOTw.exe PID 2668 wrote to memory of 908 2668 crypteda.exe FW3dxdsLtP.exe PID 2668 wrote to memory of 908 2668 crypteda.exe FW3dxdsLtP.exe PID 2668 wrote to memory of 908 2668 crypteda.exe FW3dxdsLtP.exe PID 2668 wrote to memory of 908 2668 crypteda.exe FW3dxdsLtP.exe PID 1552 wrote to memory of 1456 1552 axplong.exe Nework.exe PID 1552 wrote to memory of 1456 1552 axplong.exe Nework.exe PID 1552 wrote to memory of 1456 1552 axplong.exe Nework.exe PID 1552 wrote to memory of 1456 1552 axplong.exe Nework.exe PID 1456 wrote to memory of 636 1456 Nework.exe Hkbsse.exe PID 1456 wrote to memory of 636 1456 Nework.exe Hkbsse.exe PID 1456 wrote to memory of 636 1456 Nework.exe Hkbsse.exe PID 1456 wrote to memory of 636 1456 Nework.exe Hkbsse.exe PID 1552 wrote to memory of 540 1552 axplong.exe stealc_default2.exe PID 1552 wrote to memory of 540 1552 axplong.exe stealc_default2.exe PID 1552 wrote to memory of 540 1552 axplong.exe stealc_default2.exe PID 1552 wrote to memory of 540 1552 axplong.exe stealc_default2.exe PID 1552 wrote to memory of 2540 1552 axplong.exe 2.exe PID 1552 wrote to memory of 2540 1552 axplong.exe 2.exe PID 1552 wrote to memory of 2540 1552 axplong.exe 2.exe PID 1552 wrote to memory of 2540 1552 axplong.exe 2.exe PID 636 wrote to memory of 2112 636 Hkbsse.exe JLumma.exe PID 636 wrote to memory of 2112 636 Hkbsse.exe JLumma.exe PID 636 wrote to memory of 2112 636 Hkbsse.exe JLumma.exe PID 636 wrote to memory of 2112 636 Hkbsse.exe JLumma.exe PID 1552 wrote to memory of 1812 1552 axplong.exe needmoney.exe PID 1552 wrote to memory of 1812 1552 axplong.exe needmoney.exe PID 1552 wrote to memory of 1812 1552 axplong.exe needmoney.exe PID 1552 wrote to memory of 1812 1552 axplong.exe needmoney.exe PID 1552 wrote to memory of 984 1552 axplong.exe penis.exe PID 1552 wrote to memory of 984 1552 axplong.exe penis.exe PID 1552 wrote to memory of 984 1552 axplong.exe penis.exe PID 1552 wrote to memory of 984 1552 axplong.exe penis.exe PID 1812 wrote to memory of 2232 1812 needmoney.exe svchost015.exe PID 1812 wrote to memory of 2232 1812 needmoney.exe svchost015.exe PID 1812 wrote to memory of 2232 1812 needmoney.exe svchost015.exe PID 1812 wrote to memory of 2232 1812 needmoney.exe svchost015.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe"C:\Users\Admin\AppData\Local\Temp\7b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Roaming\muU1tpDOTw.exe"C:\Users\Admin\AppData\Roaming\muU1tpDOTw.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Users\Admin\AppData\Roaming\FW3dxdsLtP.exe"C:\Users\Admin\AppData\Roaming\FW3dxdsLtP.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe"C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe"C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:540 -
C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:264 -
C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe"C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
C:\Windows\system32\taskeng.exetaskeng.exe {6F74DDA7-01D9-4CA8-9EC7-3FA5D8B9DDBF} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]1⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5557eed83eebbb000f2f18bb157b5d68e
SHA1b437d9d8a29c7627eaf50b4896b906555ae25418
SHA2562c1ff62be49cf5027f60951cab75352ec5218fe6161b8a9d210e52913417f3e8
SHA5125078f28faeb42d7a5cba27488caf9b1a4abfa1ffe134a51fca9a28ce63a422b00231567957924ebead22e2ddfb9a1e47121293475c248a94c4e96565d8651bdd
-
Filesize
312KB
MD5389881b424cf4d7ec66de13f01c7232a
SHA1d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA2569d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA5122b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96
-
Filesize
1.1MB
MD5ec23d4868753f523df127f531451dcbd
SHA18a172e091d057a8db1e3e1999d48060967b99f36
SHA2565a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
SHA5122e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
23.1MB
MD58094be340c539b9ac0d2af7ea4c3120c
SHA18d7e93d2ea05a156eefde875bcfaaceaae09b0e6
SHA25671b814a0a6c6d9cd59504a14918e29f59d2b77d981dca01d22a97f098c89c782
SHA512395029ace96b8c0c2d926ac5c2295b625ba93e91d27fd92b6605660c3c555c618df79db01c61ff28e29c05532554b6aac9361e103134cea794e9443439cd460d
-
Filesize
6.4MB
MD5ff693cf46011f7ca21a8ea6886a61e5e
SHA10aa6add8816e6eeeabd18306113e8be4cef8d39e
SHA2562a79f02cad95c2a4eff1aeb267674915b5e1b0a64e0f728f69ec4ff0ae14fe95
SHA512dc99c35c87e7e9aa6d2df5e974a9db7140edcd2de38fb12274c981ecfe7775d3dbd37e7e99c0d5a3289ca79e0ca9dccbbb9fcb9fe4132b4599a120a2329a376c
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.4MB
MD5d3c7b81361bcdec87ed267f8051f3b7b
SHA13e331947d48f99a09383e058614f51d6aee36afb
SHA256ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70
SHA512bedb36b6daf342f52b8e2530cecde0aabfb96b7ee911778e2ebae374540ebb70d77e5193e381b6a76621cdebfe9df1340b62e9ed1495f0d1035325e7ab207da3
-
Filesize
4.1MB
MD57fa5c660d124162c405984d14042506f
SHA169f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c
-
Filesize
494KB
MD56760374f17416485fa941b354d3dd800
SHA1d88389ec19ac3e87bc743ba3f8b7c518601fdbf9
SHA2569dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5
SHA5126e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab
-
Filesize
304KB
MD530daa686c1f31cc4833bd3d7283d8cdc
SHA170f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA5129f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9
-
Filesize
454KB
MD537d198ad751d31a71acc9cb28ed0c64e
SHA18eb519b7a6df66d84c566605da9a0946717a921d
SHA2561ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA51260923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96
-
Filesize
673KB
MD5b859d1252109669c1a82b235aaf40932
SHA1b16ea90025a7d0fad9196aa09d1091244af37474
SHA256083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c
SHA5129c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655
-
Filesize
19.2MB
MD5f1c717609dd44f9e2c979fd9a0f4315c
SHA1efcca65af18339bc8954c12a486f0a0828a981fa
SHA2569b2e59478ea4738cc23cdba5d1b9111c636410661a7a4592c35144de94b8c8ad
SHA5129dabafadb586444a0a8cc47c8d07c1b8a0f353d8e1aaf91cfe849bd15082ee417bb1688659fdea07be5d0a0bb8582ad1680b566884b7d980d1ef182ecfcfc709
-
Filesize
1.8MB
MD51eb29fa0ff443a7e9a35fa1bf00a8663
SHA1ea3120a71769399bb5ba6b313ab44928d218193a
SHA2567b41cabcafca0e5725c874d316f4f5f83561fa571240c0ccdd8b19034282bf41
SHA51286fa86d8d8bb990cae20e974d20a13356ba7559840b191c1c83f885bf04e9ff4e1e96a28eb4a6136b5dc2dc4b523a41a1521442ab0824aff2b8e3b49cbfdac58
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1defa0c0-fc04-4155-83bc-b490dbaa3679
Filesize2KB
MD5ff0da1b2308b8914e84057d060ad5a15
SHA1acd76104227afe6e14598ce433e2a09971e88dbc
SHA2565d423b5d036a00653d3bd4a8c7c0a2cb2b66bcb8015d31b175abf6a7e7af8877
SHA512ddc5cedb7aab92253ebad5aaf59107231d6341d63191589ffa3f6dbdf9e54a4f622c17d41a263396c9c73075b8d6f83f502a5f1d828ae423527877c8eb5c3278
-
Filesize
2KB
MD554de4d7ec60ede898ea6a3ad2611f4c7
SHA1e73c8cacf2a48de986a3332ed66922b78b502a1f
SHA2560a44d810a18c00ab6b688c11874b00b861ac8c22e5f1b5ac62ee2747a51b4f60
SHA5126b020ef703d89ee7eef97d6f38ed328423649136e135ea2b600e48d97632bc8f5f3c75a14ba942e14e1d3fa87f808dda9f945fc5b719e028e637f9e9ae14e056
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
5.3MB
MD536a627b26fae167e6009b4950ff15805
SHA1f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA5122133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
Filesize
304KB
MD57e39ccb9926a01051635f3c2675ff01d
SHA100518801574c9a475b86847db9ff2635ffe4b08b
SHA2564a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
SHA5126c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d
-
Filesize
534KB
MD5a6da8d868dbd5c9fe6b505db0ee7eb71
SHA13dad32b3b3230ad6f44b82d1eb1749c67800c6f8
SHA2564ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c
SHA512132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0
-
Filesize
622KB
MD54c82ed5f54457b13b25a60c6a0544a9c
SHA1e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA25639867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
SHA512474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9