Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
12/09/2024, 11:18
General
- Target 854563e49f3d4e9625ff31a8f561ad04ab1b66ed928beba34bb027e867164fdc.exe
- Size 1.8MB
- Sample240912-nesjbatama
- SHA256 854563e49f3d4e9625ff31a8f561ad04ab1b66ed928beba34bb027e867164fdc
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@CLOUDYTTEAM
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
redline
-
bundle
-
185.215.113.67:15206
Extracted
-
stealc
-
default
-
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
-
cryptbot
-
analforeverlovyu.top
-
fivevd5sr.top
-
url_path
/v1/upload.php
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detects ZharkBot payload 1 IoCs
ZharkBot is a botnet written C++.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- ZharkBot
ZharkBot is a botnet written C++.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 42 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 51 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\854563e49f3d4e9625ff31a8f561ad04ab1b66ed928beba34bb027e867164fdc.exe"C:\Users\Admin\AppData\Local\Temp\854563e49f3d4e9625ff31a8f561ad04ab1b66ed928beba34bb027e867164fdc.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\REZrLeZO8z.exe"C:\Users\Admin\AppData\Roaming\REZrLeZO8z.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\XF6Mj7NL14.exe"C:\Users\Admin\AppData\Roaming\XF6Mj7NL14.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000038001\off.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\off.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-98VQK.tmp\off.tmp"C:\Users\Admin\AppData\Local\Temp\is-98VQK.tmp\off.tmp" /SL5="$90212,2651321,56832,C:\Users\Admin\AppData\Local\Temp\1000038001\off.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\IC Video Converter\icvideoconverter_32.exe"C:\Users\Admin\AppData\Local\IC Video Converter\icvideoconverter_32.exe" -i8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe"C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\4go9zUGvM1.exe"C:\Users\Admin\AppData\Roaming\4go9zUGvM1.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\QhZ0Vq3h60.exe"C:\Users\Admin\AppData\Roaming\QhZ0Vq3h60.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe"C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000223001\2793c71f24.exe"C:\Users\Admin\AppData\Local\Temp\1000223001\2793c71f24.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe"C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6841268⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "VegetablesIndividualBindingGba" Ever8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\684126\Intake.pifIntake.pif C8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 58⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 4887⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"7⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 19647⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe"C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe"C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe"C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 19565⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4132 -ip 41321⤵
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3292 -ip 32921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1512 -ip 15121⤵
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
icvideoconverter_32.exe
crypteda.exe.log
gold.exe
crypteda.exe
Nework.exe
off.exe
stealc_default2.exe
Sеtup.exe
contorax.exe
3546345.exe
needmoney.exe
fikbbm0902845.exe
penis.exe
BowExpert.exe
bundle.exe
kitty.exe
acentric.exe
vlst.exe
freedom.exe
appgate15.exe
axplong.exe
569267554116
Tmp9DD6.tmp
filename.exe
off.tmp
_iscrypt.dll
svchost015.exe
76b53b3ec448f7ccdda2063b15d2bfc3_6f95b8b4-c02b-43c9-8cd4-016780936b63
REZrLeZO8z.exe
XF6Mj7NL14.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/404-545-0x0000000000400000-0x0000000000458000-memory.dmp
memory/404-542-0x0000000000400000-0x0000000000458000-memory.dmp
memory/548-778-0x000000001E9F0000-0x000000001EAFA000-memory.dmp
memory/548-780-0x000000001C620000-0x000000001C65C000-memory.dmp
memory/548-784-0x000000001C600000-0x000000001C61E000-memory.dmp
memory/548-785-0x000000001FB20000-0x000000001FCE2000-memory.dmp
memory/548-776-0x0000000000620000-0x00000000006AC000-memory.dmp
memory/548-786-0x0000000020220000-0x0000000020748000-memory.dmp
memory/548-783-0x000000001D4F0000-0x000000001D566000-memory.dmp
memory/548-779-0x000000001C3B0000-0x000000001C3C2000-memory.dmp
memory/728-481-0x0000000000400000-0x0000000000670000-memory.dmp
memory/728-462-0x0000000000400000-0x0000000000670000-memory.dmp
memory/728-295-0x0000000000400000-0x0000000000670000-memory.dmp
memory/728-296-0x0000000000400000-0x0000000000670000-memory.dmp
memory/728-366-0x0000000000400000-0x0000000000670000-memory.dmp
memory/728-546-0x0000000000400000-0x0000000000670000-memory.dmp
memory/1408-67-0x0000000006A20000-0x0000000006A3E000-memory.dmp
memory/1408-71-0x0000000008C30000-0x0000000008D3A000-memory.dmp
memory/1408-72-0x00000000072B0000-0x00000000072C2000-memory.dmp
memory/1408-47-0x0000000005A30000-0x0000000005FD4000-memory.dmp
memory/1408-74-0x0000000007350000-0x000000000739C000-memory.dmp
memory/1408-73-0x0000000007310000-0x000000000734C000-memory.dmp
memory/1408-48-0x0000000005520000-0x00000000055B2000-memory.dmp
memory/1408-49-0x00000000056E0000-0x00000000056EA000-memory.dmp
memory/1408-44-0x0000000000400000-0x0000000000452000-memory.dmp
memory/1408-70-0x00000000073B0000-0x00000000079C8000-memory.dmp
memory/1408-66-0x0000000006260000-0x00000000062D6000-memory.dmp
memory/1432-876-0x0000000000720000-0x00000000007AC000-memory.dmp
memory/1472-516-0x0000000000E80000-0x0000000000EA0000-memory.dmp
memory/1472-518-0x000000001B9B0000-0x000000001B9B6000-memory.dmp
memory/1560-364-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1592-464-0x0000000000400000-0x000000000106F000-memory.dmp
memory/1592-436-0x0000000000400000-0x000000000106F000-memory.dmp
memory/1592-539-0x0000000000400000-0x000000000106F000-memory.dmp
memory/1788-385-0x0000000000730000-0x00000000007B0000-memory.dmp
memory/2296-122-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2296-97-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2296-100-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2296-99-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2296-95-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2820-561-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-513-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-572-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-504-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-555-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-581-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-485-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-482-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2820-484-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2880-858-0x00000000058F0000-0x000000000598C000-memory.dmp
memory/2880-857-0x0000000000BF0000-0x000000000104C000-memory.dmp
memory/2880-859-0x0000000005A00000-0x0000000005D26000-memory.dmp
memory/2880-861-0x0000000005870000-0x0000000005892000-memory.dmp
memory/2920-404-0x0000000000B60000-0x0000000000BB2000-memory.dmp
memory/3116-2-0x00000000000D1000-0x00000000000FF000-memory.dmp
memory/3116-1-0x0000000077404000-0x0000000077406000-memory.dmp
memory/3116-3-0x00000000000D0000-0x00000000005A0000-memory.dmp
memory/3116-4-0x00000000000D0000-0x00000000005A0000-memory.dmp
memory/3116-16-0x00000000000D0000-0x00000000005A0000-memory.dmp
memory/3116-0-0x00000000000D0000-0x00000000005A0000-memory.dmp
memory/3312-649-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/3312-651-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4132-463-0x00000000084E0000-0x00000000084FA000-memory.dmp
memory/4132-455-0x0000000000D00000-0x0000000000D78000-memory.dmp
memory/4272-427-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4272-426-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4272-435-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4272-423-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4332-902-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4332-900-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4364-432-0x0000000000400000-0x000000000079D000-memory.dmp
memory/4556-196-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4556-343-0x00000000005E0000-0x0000000000823000-memory.dmp
memory/4556-190-0x00000000005E0000-0x0000000000823000-memory.dmp
memory/4560-18-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-456-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-19-0x00000000001B1000-0x00000000001DF000-memory.dmp
memory/4560-344-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-465-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-191-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-189-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-103-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-541-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-195-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-21-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-234-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4560-20-0x00000000001B0000-0x0000000000680000-memory.dmp
memory/4592-41-0x00000000000E0000-0x0000000000134000-memory.dmp
memory/4592-40-0x000000007301E000-0x000000007301F000-memory.dmp
memory/4608-302-0x0000000007E20000-0x0000000007E70000-memory.dmp
memory/4608-125-0x0000000000DE0000-0x0000000000E32000-memory.dmp
memory/4608-327-0x000000006C1B0000-0x000000006C1D8000-memory.dmp
memory/4608-326-0x000000006C1E0000-0x000000006C201000-memory.dmp
memory/4652-672-0x0000000000D00000-0x00000000011D0000-memory.dmp
memory/4652-670-0x0000000000D00000-0x00000000011D0000-memory.dmp
memory/4728-261-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4728-363-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4980-93-0x0000000000A40000-0x0000000000B52000-memory.dmp
memory/5084-194-0x0000000007E30000-0x0000000007E96000-memory.dmp
memory/5084-212-0x00000000096F0000-0x00000000098B2000-memory.dmp
memory/5084-126-0x0000000000250000-0x00000000002DE000-memory.dmp
memory/5084-213-0x0000000009DF0000-0x000000000A31C000-memory.dmp