Analysis
-
max time kernel
294s -
max time network
270s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 22:43
Static task
static1
Behavioral task
behavioral1
Sample
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe
Resource
win7-20240903-en
General
-
Target
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe
-
Size
1.8MB
-
MD5
211e2a18a305834618abddd71045360c
-
SHA1
e30300f3a4b6abc7808d18174bd2205f4f2c45be
-
SHA256
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7
-
SHA512
212649d62a264d9a9b02a97b8750d42501dcf5463e7ed8b1a22ab79aab235da527a928843fc6adcec38b57fd284fc878df3bbc357f84e6e5c2cc619b7e3ae524
-
SSDEEP
49152:z1xHd56Q2gmMoZaB1lWlE47+Up1pglH70KrxDKy:3HGQ28oWlWeypglHLrxD
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Executes dropped EXE 4 IoCs
Processes:
axplong.exeneon.exeneon.exeneon.exepid process 2560 axplong.exe 924 neon.exe 2612 neon.exe 2424 neon.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Wine 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe Key opened \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Wine axplong.exe -
Loads dropped DLL 4 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exeneon.exepid process 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe 2560 axplong.exe 2560 axplong.exe 2612 neon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" reg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exepid process 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe 2560 axplong.exe -
Drops file in Windows directory 1 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exedescription ioc process File created C:\Windows\Tasks\axplong.job 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
neon.exeneon.exe7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid process 1972 cmd.exe 2324 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exeneon.exeneon.exeneon.exepid process 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe 2560 axplong.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 924 neon.exe 2612 neon.exe 2424 neon.exe 2424 neon.exe 2424 neon.exe 924 neon.exe 924 neon.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
neon.exeneon.exeneon.exedescription pid process Token: SeDebugPrivilege 924 neon.exe Token: SeDebugPrivilege 2612 neon.exe Token: SeDebugPrivilege 2424 neon.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exepid process 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exeaxplong.exeneon.execmd.exeneon.exedescription pid process target process PID 2788 wrote to memory of 2560 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe axplong.exe PID 2788 wrote to memory of 2560 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe axplong.exe PID 2788 wrote to memory of 2560 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe axplong.exe PID 2788 wrote to memory of 2560 2788 7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe axplong.exe PID 2560 wrote to memory of 924 2560 axplong.exe neon.exe PID 2560 wrote to memory of 924 2560 axplong.exe neon.exe PID 2560 wrote to memory of 924 2560 axplong.exe neon.exe PID 2560 wrote to memory of 924 2560 axplong.exe neon.exe PID 924 wrote to memory of 1972 924 neon.exe cmd.exe PID 924 wrote to memory of 1972 924 neon.exe cmd.exe PID 924 wrote to memory of 1972 924 neon.exe cmd.exe PID 1972 wrote to memory of 2324 1972 cmd.exe PING.EXE PID 1972 wrote to memory of 2324 1972 cmd.exe PING.EXE PID 1972 wrote to memory of 2324 1972 cmd.exe PING.EXE PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2296 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2280 924 neon.exe InstallUtil.exe PID 1972 wrote to memory of 2268 1972 cmd.exe reg.exe PID 1972 wrote to memory of 2268 1972 cmd.exe reg.exe PID 1972 wrote to memory of 2268 1972 cmd.exe reg.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 1012 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2436 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 944 924 neon.exe InstallUtil.exe PID 924 wrote to memory of 2612 924 neon.exe neon.exe PID 924 wrote to memory of 2612 924 neon.exe neon.exe PID 924 wrote to memory of 2612 924 neon.exe neon.exe PID 924 wrote to memory of 2612 924 neon.exe neon.exe PID 2612 wrote to memory of 2424 2612 neon.exe neon.exe PID 2612 wrote to memory of 2424 2612 neon.exe neon.exe PID 2612 wrote to memory of 2424 2612 neon.exe neon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe"C:\Users\Admin\AppData\Local\Temp\7efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\system32\cmd.exe"cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 65⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2324 -
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"5⤵
- Adds Run key to start application
PID:2268 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2296
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2280
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:1012
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2436
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5b3fd0e1003b1cd38402b6d32829f6135
SHA1c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA51204692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1
-
Filesize
1.8MB
MD5211e2a18a305834618abddd71045360c
SHA1e30300f3a4b6abc7808d18174bd2205f4f2c45be
SHA2567efca2633006752b9b024297c43a41310985b59f258dd4b16a7e3084803ce2f7
SHA512212649d62a264d9a9b02a97b8750d42501dcf5463e7ed8b1a22ab79aab235da527a928843fc6adcec38b57fd284fc878df3bbc357f84e6e5c2cc619b7e3ae524
-
Filesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
Filesize
63B
MD57fbbc13b58424f6d745a0c8d40f50056
SHA122c2c7d4405404af3425fd0175d8533c2902e0a1
SHA256c6e29dec194eac652a9b60537e4bd2a4aecb7185139f5ba5a14e4e75014d64e1
SHA512ded0aa6a07ea41a7faf62f549717160bb6df0bc285052a498e5b853943ce547a803b96cd2d838109a1e82fb51f657e617bc29273db1abd813390214c8fd21c5c
-
Filesize
66B
MD57a9fe2d53be44957d01223fe88ae27ea
SHA1eacfe44289f65ed4f80d4022e6edcb7569574314
SHA256ea9a8df4163594f4e495711fe5012e1dd9ba1d624bd72e3ade3951739e8ad5dc
SHA512af4f4c7e96c5fb9f03cc30c412a531a36794520008d8768baaeb7699b831f63f2a01f6e4bf8a9fdac41a9d20c2c03d0888eff326c586a5a9c99171a9fc972e9f
-
Filesize
66B
MD569d7dea11f9a3b194ecb1ac4851abaa8
SHA1db8699ba3303f441087450770ecf0e5895c7784d
SHA2567b3f2e59d879d6a96f5a4b4e244dce0a3484652c44e573e6464b867857f09064
SHA51290789d83277c1414b6b1765a290a5ecdbc88ff77581fa67c2cad418ba004a5c7a042a32b0097e5e0801d6862a4262eedc9716fc8dec53745cdb73522d1628883