Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
07/10/2024, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48e040a64c6cc7db7bc79730c51d67f5.exe
Resource
win7-20240903-en
windows7-x64
31 signatures
150 seconds
General
- Target 48e040a64c6cc7db7bc79730c51d67f5.exe
- Size 1.8MB
- Sample241007-ddv8ps1emk
- SHA256 fc3286ee1ef68ef62e2dd2652d5a37b9a24bf47f2c0e81b1c4023ec0c64a7146
- MD5 48e040a64c6cc7db7bc79730c51d67f5
- SHA1 e84a71654dc5915b2ee1627854478b646bf77ac0
- SHA512 4e25bfc0d4ab743323167f3ed0ad3965d15a23df4f2e1ead1665197c43c8998638382b437043f92aaf60ffbd44c1594eaa972355b6261b7dcb2ebf2b5f6fa674
- SSDEEP 49152:g0SKAoUNAHyKgK5L4bLPafsDPT6o2hWNQrv:FSAgAHP0bLPafsf6ZwSL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
amadey
Version
-
4.42
Botnet
-
9c9aa5
C2
-
http://185.215.113.43
Attributes
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
rc4.plain
Extracted
Family
-
stealc
Botnet
-
doma
C2
-
http://185.215.113.37
Attributes
-
url_path
/e2b1563c6670f193.php
Extracted
Family
-
lumma
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 48e040a64c6cc7db7bc79730c51d67f5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bd9b21b8fa.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe - Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 48e040a64c6cc7db7bc79730c51d67f5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bd9b21b8fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bd9b21b8fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 48e040a64c6cc7db7bc79730c51d67f5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 48e040a64c6cc7db7bc79730c51d67f5.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation skotes.exe - Executes dropped EXE 6 IoCs
pid Process 5036 skotes.exe 2560 fc1e581af6.exe 4984 num.exe 840 bd9b21b8fa.exe 1656 skotes.exe 4720 skotes.exe - Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine 48e040a64c6cc7db7bc79730c51d67f5.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine bd9b21b8fa.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine skotes.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc1e581af6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000332001\\fc1e581af6.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\num.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000336001\\num.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bd9b21b8fa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000349001\\bd9b21b8fa.exe" skotes.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023485-31.dat autoit_exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 5036 skotes.exe 840 bd9b21b8fa.exe 1656 skotes.exe 4720 skotes.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 48e040a64c6cc7db7bc79730c51d67f5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language num.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48e040a64c6cc7db7bc79730c51d67f5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd9b21b8fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc1e581af6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Kills process with taskkill 5 IoCs
pid Process 2808 taskkill.exe 1660 taskkill.exe 2516 taskkill.exe 1440 taskkill.exe 1656 taskkill.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133727432612752072" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 5036 skotes.exe 5036 skotes.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 3392 chrome.exe 3392 chrome.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 840 bd9b21b8fa.exe 840 bd9b21b8fa.exe 1656 skotes.exe 1656 skotes.exe 4720 skotes.exe 4720 skotes.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 fc1e581af6.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3392 chrome.exe 3392 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2808 taskkill.exe Token: SeDebugPrivilege 1660 taskkill.exe Token: SeDebugPrivilege 2516 taskkill.exe Token: SeDebugPrivilege 1440 taskkill.exe Token: SeDebugPrivilege 1656 taskkill.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe 2560 fc1e581af6.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 5036 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 84 PID 4964 wrote to memory of 5036 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 84 PID 4964 wrote to memory of 5036 4964 48e040a64c6cc7db7bc79730c51d67f5.exe 84 PID 5036 wrote to memory of 2560 5036 skotes.exe 89 PID 5036 wrote to memory of 2560 5036 skotes.exe 89 PID 5036 wrote to memory of 2560 5036 skotes.exe 89 PID 2560 wrote to memory of 2808 2560 fc1e581af6.exe 91 PID 2560 wrote to memory of 2808 2560 fc1e581af6.exe 91 PID 2560 wrote to memory of 2808 2560 fc1e581af6.exe 91 PID 2560 wrote to memory of 1660 2560 fc1e581af6.exe 93 PID 2560 wrote to memory of 1660 2560 fc1e581af6.exe 93 PID 2560 wrote to memory of 1660 2560 fc1e581af6.exe 93 PID 2560 wrote to memory of 2516 2560 fc1e581af6.exe 95 PID 2560 wrote to memory of 2516 2560 fc1e581af6.exe 95 PID 2560 wrote to memory of 2516 2560 fc1e581af6.exe 95 PID 2560 wrote to memory of 1440 2560 fc1e581af6.exe 97 PID 2560 wrote to memory of 1440 2560 fc1e581af6.exe 97 PID 2560 wrote to memory of 1440 2560 fc1e581af6.exe 97 PID 2560 wrote to memory of 1656 2560 fc1e581af6.exe 99 PID 2560 wrote to memory of 1656 2560 fc1e581af6.exe 99 PID 2560 wrote to memory of 1656 2560 fc1e581af6.exe 99 PID 2560 wrote to memory of 3392 2560 fc1e581af6.exe 101 PID 2560 wrote to memory of 3392 2560 fc1e581af6.exe 101 PID 3392 wrote to memory of 1896 3392 chrome.exe 102 PID 3392 wrote to memory of 1896 3392 chrome.exe 102 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 1376 3392 chrome.exe 103 PID 3392 wrote to memory of 2864 3392 chrome.exe 104 PID 3392 wrote to memory of 2864 3392 chrome.exe 104 PID 3392 wrote to memory of 3564 3392 chrome.exe 105 PID 3392 wrote to memory of 3564 3392 chrome.exe 105 PID 3392 wrote to memory of 3564 3392 chrome.exe 105 PID 3392 wrote to memory of 3564 3392 chrome.exe 105 PID 3392 wrote to memory of 3564 3392 chrome.exe 105 PID 3392 wrote to memory of 3564 3392 chrome.exe 105 PID 3392 wrote to memory of 3564 3392 chrome.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\48e040a64c6cc7db7bc79730c51d67f5.exe"C:\Users\Admin\AppData\Local\Temp\48e040a64c6cc7db7bc79730c51d67f5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\1000332001\fc1e581af6.exe"C:\Users\Admin\AppData\Local\Temp\1000332001\fc1e581af6.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9bbebcc40,0x7ff9bbebcc4c,0x7ff9bbebcc585⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1992,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1988 /prefetch:25⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1876,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2036 /prefetch:35⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2304,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2488 /prefetch:85⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:15⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3232 /prefetch:15⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4496,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3712 /prefetch:85⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4660 /prefetch:85⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4880,i,14731078775939356044,7853920953783983157,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4956 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\1000349001\bd9b21b8fa.exe"C:\Users\Admin\AppData\Local\Temp\1000349001\bd9b21b8fa.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:840
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4720
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 ba8eeed804ee5c6038adb4275908571a7cd551e406e8aa9c669406f68f57f5fa
- MD5 fdd6a8236001b861da86c237991afcb1
- SHA1 7a7a38fda38eb3c5470446bfde1286a62f25c542
- SHA512 f464b650e85fd7093f62eac0e6f9c66fc871dbbdcfb578f1f94b05392c884cb18492a44f7b0c4b0feb82985e74b67c20932531d51869b1f644f9cdfc94e4c673
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 2178312ed9ae1cb176c53bd3a91cbf5d6b487e5c16dda14bca73b2e2cd8a9845
- MD5 b4279b97b541dc7047abbd3966f4f58a
- SHA1 99e77916ea743be27afd177530c1b1589e2e39c1
- SHA512 12c3f5424d6379df94952a2453e5ab4274035e7120506f1887c20b7cd3068e811a57cb215a0ab612c816fedb21b5a0d21b54c81fa43583700d21049c2092a32b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 21b234b3aee5d72f1812a6cc4fa89d3cbeff9428bb3c51b8754f4ca719658ad2
- MD5 3742b7e2c39549cdacc530ade552e614
- SHA1 426fa7acd418aa2e6a4d54eba3671576dc5b4fb9
- SHA512 9b23df48b6fc287280569588ff260f1bb5ca66099e3e82b619d36d5691efb4c51d1500350b1884e893db05beacd5f4914e289b604537cbc51fe8779e590d9c83
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 068faeb01b6c49f2a9849a4f6f3ed57cb0a07873dfeb14f8ce0f0e8c0340ee5c
- MD5 5ef2096b4001b198d096b99bda88ec93
- SHA1 b3a3c559fb7095de710acbe15343ba5d7076a56b
- SHA512 a0ef89ba7869cdb36897caece97e96d2b67d28fef1e1d6ec4ddc676be53265f9b2f89300fb807674c43992fbc1a2fd263730af146f4d1608438d3947dd02bef9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 859B
- SHA256 43837774c13d20ad10a7641ada1056ead947395f7bed1a9fcae68f8faa0ee18b
- MD5 a7856c3856b222ceabaa5c98d5b49227
- SHA1 989a0e672a9a645b9c8b803d4aab0e3e6efe5799
- SHA512 3e6f1906396f83cb914eb350bc229d7f2c866ecafad67254de9ca6c500d1a9b153d1b7a8a7aa711553f9c98808dda5fed8ce687e5db604ebcd4a53f51b355834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 10KB
- SHA256 21df02332ee00fad8d71b5d6cef03215be2aa3d51860b7cad313fc62b967d37e
- MD5 f2302b0f3a102aeec9dfda8a9cd87de9
- SHA1 f272db902690c3a494e0a14457208a6d04125100
- SHA512 71d1a02b34b4d9a2f483ec6b5ab30105603d9795a8728675108b9be4afbcb10ce5e7b839052fa07e6fdd9f27490cf79132115cf532c852bdf62951454b22f2b9
- SSDEEP 192:aEBWZFjoTQeoCHV+Fu/kJPz7oeS2ZPFPo6yIsnVdg4:aEBZsmGqkV7825X4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 10KB
- SHA256 109151b44b8a1c23c3ca8852b0ef22d4cb8b3fd54766ed5fb1176828119ca44a
- MD5 52bb255a15c3150dc3de2ca278590ef3
- SHA1 a9251e3229db60c9642bc22cbd6ca5beaa8e796a
- SHA512 1c416f253f98a9bc9875d927dfaa9425291d7648a2bd464f0958ec22c225502d07bac583fd8a4a3abc0c619b2bac76734f4e1f24d2281ac343ff9678cda51641
- SSDEEP 192:aEBWZFjoaQeoCHV+Fu/kJPz7oeS2ZPFPo6yIsnVdg4:aEBUsmGqkV7825X4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 10KB
- SHA256 92606d49442928a395447215e361f7c1ae1bfe9696ec66d42348685247ee5fcf
- MD5 dc1416371c82884f64294ddfa38c3d03
- SHA1 31139afe31fa39e623f9f43882fc463348c02e51
- SHA512 deeb512f34c3aacf0c736dda2809365a4f1c71d118e3125d56a3bebe0308959481702f54345f3eedf4601f54000f60393de0ff59a3509efb2b243d2a70c27345
- SSDEEP 192:aEBWZFjo7QeoCHV+Fu/kJPz7oeS2ZPFPo6yIsnVdg4:aEBNsmGqkV7825X4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 22159f32c893cf2cb626f298663ed6de4b53aa286ef295f22715150d6b29f2f8
- MD5 ebe453e3fc260989863ad3a36c34573d
- SHA1 4df48f6cc9a487df8b075623118493f5cc1b564c
- SHA512 5b91413b359bb8a263e7bb06b3a9ba8ec7126f0197ea883cfcf5852715b6469bbbede69f65bf844e261024e56afe99316fafb06ceab81f60574ac9c5f751eb3c
- SSDEEP 192:aEBWZFjoJ3QeoCHV+Fu/kZ7oeS2ZHFPo6yIsnVdg4:aEBjsmGqkZ782hX4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 93112092ef8de0b1593c47391e51dbbcfe86157205b751516d8a53f8b0bb6cb7
- MD5 875a410437ac1e1460f45fa838d5f615
- SHA1 4fe3d62aacd4b88043ec4da17a221b348535c89d
- SHA512 ea0ce5598334a9f60d9f69e834702afe8884f398b7fbcd7414800429c0a7070e933b5178f4b76abbd571377fd4a92c598ace897e75016d04da136b7c5be0a429
- SSDEEP 192:aEBWZFjoaQeoCHV+Fu/kZ7oeS2ZHFPo6yIsnVdg4:aEBosmGqkZ782hX4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 42fb5a702d631f0267bfa2753bcf02dbdb4cb488733693acd0efe29f6c7f62e5
- MD5 b4ac414aa0a3a3bf8d54c5b940a41a9d
- SHA1 b7b979f5ddce7b09831d5ff803b6953e07afd370
- SHA512 c927a42678d820835224c25687ab9c6ad56a6afc3a5b58c9bd8c38f36c046f5d304e2f125628694540c5e5b37535ee4ab8e3cb6f851840079029b3b6cc62ed87
- SSDEEP 384:Rlv67pLhLc+eZMXmo1kXqKf/pUZNCgVLH2HfS5crUfWTf:Rt67pLhLnyemo1kXqKf/pUZNCgVLH2HR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 212KB
- SHA256 a1a445ec8cf28c838433d0f788116c7a78a1741965c4948ed3b96922e0196bba
- MD5 9ad61787605624febfc65e4167e6a100
- SHA1 103fcbeaac46ea469eb49c22134ea8a076bf5cb9
- SHA512 6e5affd366c8f6cfdb4714be2e3225a09746876ddb30bf4f74b9da244f59405bb3a9e283c9c351fd4a57ce821a2657ac2456621d514eed0ecd3969f8f032cbbf
- SSDEEP 3072:3eDxN1Yh4ChkvR2/gRYPQs6dknaU9klJxfAGavCM306UOGEqGfL8mLJjs2BCe:3eDxN+Y22YJik99er4ZlTFqgImLhs6Ce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 212KB
- SHA256 b83057c166366d19fa61100c4178b5f01efca8921c5623b77c56d9270d424e13
- MD5 46bfbd1217712ecac8ae59c82a3778e0
- SHA1 355fa42dc441c5a23616cc1404261afba76dcc78
- SHA512 951054a9934a5d7d42d3953107b6ad5cc2f04d525b1dd2b8785556339327c85d6a6f1a9d512adb4ffb6a4c7f3769d97f29353af21a4b08f1172fc776b64282b0
- SSDEEP 3072:eeDxN1Yh4ChkvR2/gRYPQs6dknaU9klJxfAGavCM306UOGEqGfL8mLJjs2BCe:eeDxN+Y22YJik99er4ZlTFqgImLhs6Ce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1000332001\fc1e581af6.exe
- Size 897KB
- SHA256 dcf4f1805dd7b15d4cc43003a3915a484b804654288e3a5d01e8c8cc15a021fd
- MD5 6de1e2c886ac553ec26ac814050f5ada
- SHA1 dc7c2d51395c280fd79f61a5f8cbf9f292241fad
- SHA512 ad3c6abda9bb2e3d708192f80b615abf323156d48ca10a7c5e5592f50c018e89ec746679f0f041e4c3a5d7ec4ea60915e0e2c5adfa9be3fb1c88661b168d4600
- SSDEEP 24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8a4PK:7TvC/MTQYxsWR7a4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
- Size 307KB
- SHA256 27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d
- MD5 791fcee57312d4a20cc86ae1cea8dfc4
- SHA1 04a88c60ae1539a63411fe4765e9b931e8d2d992
- SHA512 2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c
- SSDEEP 6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1000349001\bd9b21b8fa.exe
- Size 1.8MB
- SHA256 7c343857fa559a62797ba9d323db74d06835a28880e3f4bb2dd623fe7d01f38c
- MD5 7804b518ce9535a798561bea1b522339
- SHA1 963d686ae99f85e567cdf912a88c1d6a63ef4542
- SHA512 a3ef990d4ea338b4a77b96d28fc3685cd916ed2d8cfcd588c48716f73c30889d27e9b2353b9343101c1d2670f496feec1b7a9e609b576c80ec750e2986311b3e
- SSDEEP 24576:KXfI6+MAK82PiJCyoW6UYnb8UM9ut87MgPisGrdwxTLcW2F873RnrDYzEL9a2HC9:KXb+x0uj6NIMUMb5K4J69YYNitfsO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
- Size 1.8MB
- SHA256 fc3286ee1ef68ef62e2dd2652d5a37b9a24bf47f2c0e81b1c4023ec0c64a7146
- MD5 48e040a64c6cc7db7bc79730c51d67f5
- SHA1 e84a71654dc5915b2ee1627854478b646bf77ac0
- SHA512 4e25bfc0d4ab743323167f3ed0ad3965d15a23df4f2e1ead1665197c43c8998638382b437043f92aaf60ffbd44c1594eaa972355b6261b7dcb2ebf2b5f6fa674
- SSDEEP 49152:g0SKAoUNAHyKgK5L4bLPafsDPT6o2hWNQrv:FSAgAHP0bLPafsf6ZwSL
- MD5 SHA1 SHA512 SSDEEP