Analysis
-
max time kernel
294s -
max time network
266s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 22:46
Static task
static1
Behavioral task
behavioral1
Sample
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe
Resource
win7-20240903-en
General
-
Target
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe
-
Size
1.8MB
-
MD5
05bf47facd1f8b89c7cdaadc238ffb9a
-
SHA1
b43a5f8a3c7213162144402798fa7bc015c7fa23
-
SHA256
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9
-
SHA512
d2e986d794130062b423657b3e40decdb682908c194b076e442a4f13272c296caf11cdde209a1b10abafde2f177c16384c8ca7655c22903e7e66796f08c0dcb7
-
SSDEEP
49152:Sx78jdtEzCSkNxOYxOcVCimZcjSQWYqJWlgUtl+:3tEV+xxWy+JWL4
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Executes dropped EXE 4 IoCs
Processes:
axplong.exeneon.exeneon.exeneon.exepid process 2704 axplong.exe 1656 neon.exe 1964 neon.exe 600 neon.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine axplong.exe -
Loads dropped DLL 4 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exeneon.exepid process 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe 2704 axplong.exe 2704 axplong.exe 1964 neon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" reg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exepid process 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe 2704 axplong.exe -
Drops file in Windows directory 1 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exedescription ioc process File created C:\Windows\Tasks\axplong.job 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exeneon.exeneon.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid process 1488 cmd.exe 676 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exeneon.exeneon.exeneon.exepid process 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe 2704 axplong.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1656 neon.exe 1964 neon.exe 600 neon.exe 600 neon.exe 600 neon.exe 1656 neon.exe 1656 neon.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
neon.exeneon.exeneon.exedescription pid process Token: SeDebugPrivilege 1656 neon.exe Token: SeDebugPrivilege 1964 neon.exe Token: SeDebugPrivilege 600 neon.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exepid process 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exeaxplong.exeneon.execmd.exeneon.exedescription pid process target process PID 2192 wrote to memory of 2704 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe axplong.exe PID 2192 wrote to memory of 2704 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe axplong.exe PID 2192 wrote to memory of 2704 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe axplong.exe PID 2192 wrote to memory of 2704 2192 9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe axplong.exe PID 2704 wrote to memory of 1656 2704 axplong.exe neon.exe PID 2704 wrote to memory of 1656 2704 axplong.exe neon.exe PID 2704 wrote to memory of 1656 2704 axplong.exe neon.exe PID 2704 wrote to memory of 1656 2704 axplong.exe neon.exe PID 1656 wrote to memory of 1488 1656 neon.exe cmd.exe PID 1656 wrote to memory of 1488 1656 neon.exe cmd.exe PID 1656 wrote to memory of 1488 1656 neon.exe cmd.exe PID 1488 wrote to memory of 676 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 676 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 676 1488 cmd.exe PING.EXE PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1036 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2604 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2128 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2968 1656 neon.exe InstallUtil.exe PID 1488 wrote to memory of 748 1488 cmd.exe reg.exe PID 1488 wrote to memory of 748 1488 cmd.exe reg.exe PID 1488 wrote to memory of 748 1488 cmd.exe reg.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 2156 1656 neon.exe InstallUtil.exe PID 1656 wrote to memory of 1964 1656 neon.exe neon.exe PID 1656 wrote to memory of 1964 1656 neon.exe neon.exe PID 1656 wrote to memory of 1964 1656 neon.exe neon.exe PID 1656 wrote to memory of 1964 1656 neon.exe neon.exe PID 1964 wrote to memory of 600 1964 neon.exe neon.exe PID 1964 wrote to memory of 600 1964 neon.exe neon.exe PID 1964 wrote to memory of 600 1964 neon.exe neon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe"C:\Users\Admin\AppData\Local\Temp\9bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 95⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:676 -
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"5⤵
- Adds Run key to start application
PID:748 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:1036
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2604
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2128
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2968
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:600
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5b3fd0e1003b1cd38402b6d32829f6135
SHA1c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA51204692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1
-
Filesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
Filesize
64B
MD59cbeaf85b3f791a57a8c6176d1a6a1b7
SHA1acaa58162deb430fae5dd3a022601565cd58cfb1
SHA2568ec4026b88e8850e4b0b6dcd5470e71a7c0fab8645da0b4956dcab83de3650e4
SHA5123b6803a6f77d055d9bb66c43ae0457f36ed0ffe31dd7d2cd03d3f97030cd19df4cf4a61c0997d8bfdc3b600a10de4c0010415760bc721b6c07f081ed15b0ff6c
-
Filesize
66B
MD5c9aa6e23fb3c7838e717423c6c9a263f
SHA172c4334856b54936905010aee09e84cfe39ffee9
SHA256f4edc5655c1e28f0c70a0ecb871265b6ac0d3a5295c2687747929d29bca60ed9
SHA5126ee40913307721c2ca2d581292b8c7d82d467e099ceb92d5e274bbd9af5e89a13d78e1df20dda0a170baa87d552bc8db2295a74d3227dd74d9bb137954d8b2b0
-
Filesize
1.8MB
MD505bf47facd1f8b89c7cdaadc238ffb9a
SHA1b43a5f8a3c7213162144402798fa7bc015c7fa23
SHA2569bd36e960905f8cbdb1bad11f25430c714f0e8966530b2da5006473a987d55a9
SHA512d2e986d794130062b423657b3e40decdb682908c194b076e442a4f13272c296caf11cdde209a1b10abafde2f177c16384c8ca7655c22903e7e66796f08c0dcb7