Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/10/2024, 00:57
General
- Target a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b.exe
- Size 1.8MB
- Sample241011-bba4ms1grq
- SHA256 a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
lumma
-
https://drawwyobstacw.sbs
-
https://condifendteu.sbs
-
https://ehticsprocw.sbs
-
https://vennurviot.sbs
-
https://resinedyw.sbs
-
https://enlargkiw.sbs
-
https://allocatinow.sbs
-
https://mathcucom.sbs
-
https://clearancek.site
-
https://licendfilteo.site
-
https://spirittunek.store
-
https://bathdoomgaz.store
-
https://studennotediw.store
-
https://dissapoiznw.store
-
https://eaglepawnoy.store
-
https://mobbipenju.store
Extracted
-
stealc
-
default_valenciga
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
-
redline
-
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
-
89.105.223.196:29862
Extracted
-
stealc
-
doma
-
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 26 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 31 IoCs
- Identifies Wine through registry keys 2 TTPs 13 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 5 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 34 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Kills process with taskkill 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 63 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b.exe"C:\Users\Admin\AppData\Local\Temp\a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 2964⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\VUlkg9gNpJ.exe"C:\Users\Admin\AppData\Roaming\VUlkg9gNpJ.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\GHU2dhddba.exe"C:\Users\Admin\AppData\Roaming\GHU2dhddba.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 2604⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000354001\a9cc8cfbfe.exe"C:\Users\Admin\AppData\Local\Temp\1000354001\a9cc8cfbfe.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000355001\2ddc41737b.exe"C:\Users\Admin\AppData\Local\Temp\1000355001\2ddc41737b.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000349001\9494e54a71.exe"C:\Users\Admin\AppData\Local\Temp\1000349001\9494e54a71.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\1000350002\3f792ae61c.exe"C:\Users\Admin\1000350002\3f792ae61c.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000357001\c228bc242f.exe"C:\Users\Admin\AppData\Local\Temp\1000357001\c228bc242f.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe"C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start context.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\context.execontext.exe5⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "InstallUtil.exe"8⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "InstallUtil.exe"6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMAA0ADIANAAwADAAMQBcAGEAcABwAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADAANAAyADQAMAAwADEAXABhAHAAcAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABzAHEAZABxAHMAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAHMAcQBkAHEAcwBkAC4AZQB4AGUA4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 696 -ip 6961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3260 -ip 32601⤵
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
gold.exe
legas.exe
stealc_default2.exe
JavUmar.exe
num.exe
9494e54a71.exe
a9cc8cfbfe.exe
2ddc41737b.exe
c228bc242f.exe
MK.exe
Nework.exe
processclass.exe
splwow64.exe
app.exe
409013623608
axplong.exe
TmpB769.tmp
__PSScriptPolicyTest_ymli3ij3.kha.ps1
GHU2dhddba.exe
Office Manager.url
VUlkg9gNpJ.exe
memory/396-43-0x0000000000400000-0x0000000000463000-memory.dmp
memory/396-46-0x0000000000400000-0x0000000000463000-memory.dmp
memory/396-45-0x0000000000400000-0x0000000000463000-memory.dmp
memory/400-512-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-130-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-21-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-20-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-19-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-16-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-486-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-202-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-129-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-401-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-448-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-132-0x0000000000380000-0x0000000000834000-memory.dmp
memory/400-107-0x0000000000380000-0x0000000000834000-memory.dmp
memory/448-492-0x0000000000480000-0x00000000008D0000-memory.dmp
memory/448-475-0x0000000000480000-0x00000000008D0000-memory.dmp
memory/448-477-0x0000000000480000-0x00000000008D0000-memory.dmp
memory/448-470-0x0000000000480000-0x00000000008D0000-memory.dmp
memory/448-496-0x0000000000480000-0x00000000008D0000-memory.dmp
memory/696-42-0x0000000000D77000-0x0000000000D78000-memory.dmp
memory/908-89-0x0000000000430000-0x0000000000498000-memory.dmp
memory/908-154-0x000000001F390000-0x000000001F8B8000-memory.dmp
memory/908-153-0x000000001EC90000-0x000000001EE52000-memory.dmp
memory/908-134-0x000000001B3B0000-0x000000001B3CE000-memory.dmp
memory/908-112-0x000000001BE20000-0x000000001BE32000-memory.dmp
memory/908-111-0x000000001D640000-0x000000001D74A000-memory.dmp
memory/1052-110-0x0000000000380000-0x0000000000834000-memory.dmp
memory/1052-108-0x0000000000380000-0x0000000000834000-memory.dmp
memory/1400-323-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1404-4-0x0000000000470000-0x0000000000924000-memory.dmp
memory/1404-0-0x0000000000470000-0x0000000000924000-memory.dmp
memory/1404-18-0x0000000000470000-0x0000000000924000-memory.dmp
memory/1404-1-0x0000000077194000-0x0000000077196000-memory.dmp
memory/1404-2-0x0000000000471000-0x000000000049F000-memory.dmp
memory/1404-3-0x0000000000470000-0x0000000000924000-memory.dmp
memory/1420-228-0x0000000000D80000-0x0000000000DD4000-memory.dmp
memory/1420-229-0x0000000005CB0000-0x0000000006254000-memory.dmp
memory/1820-404-0x0000000000730000-0x0000000000991000-memory.dmp
memory/1820-344-0x0000000000730000-0x0000000000991000-memory.dmp
memory/1912-349-0x00000000007C0000-0x0000000000E5D000-memory.dmp
memory/1912-348-0x00000000007C0000-0x0000000000E5D000-memory.dmp
memory/1912-400-0x00000000007C0000-0x0000000000E5D000-memory.dmp
memory/1912-131-0x00000000007C0000-0x0000000000E5D000-memory.dmp
memory/2732-233-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/2732-258-0x00000000071B0000-0x00000000077C8000-memory.dmp
memory/2732-231-0x0000000000400000-0x0000000000452000-memory.dmp
memory/2732-254-0x0000000006170000-0x00000000061E6000-memory.dmp
memory/2732-270-0x0000000007140000-0x000000000718C000-memory.dmp
memory/2732-255-0x0000000006820000-0x000000000683E000-memory.dmp
memory/2732-369-0x0000000006C30000-0x0000000006C96000-memory.dmp
memory/2732-268-0x00000000070A0000-0x00000000070B2000-memory.dmp
memory/2732-373-0x0000000009370000-0x00000000093C0000-memory.dmp
memory/2732-269-0x0000000007100000-0x000000000713C000-memory.dmp
memory/2732-267-0x0000000008A30000-0x0000000008B3A000-memory.dmp
memory/2732-234-0x0000000005310000-0x000000000531A000-memory.dmp
memory/2732-397-0x000000000A530000-0x000000000A6F2000-memory.dmp
memory/2732-398-0x000000000AC30000-0x000000000B15C000-memory.dmp
memory/2856-488-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2856-478-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2856-480-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2856-479-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3264-446-0x00000000002B0000-0x000000000094D000-memory.dmp
memory/3264-420-0x00000000002B0000-0x000000000094D000-memory.dmp
memory/3488-403-0x0000000000650000-0x0000000000AFC000-memory.dmp
memory/3488-396-0x0000000000650000-0x0000000000AFC000-memory.dmp
memory/3500-524-0x00000000078A0000-0x00000000079C5000-memory.dmp
memory/3500-1594-0x0000000007A90000-0x0000000007B36000-memory.dmp
memory/3500-1669-0x0000000003E80000-0x0000000003ED4000-memory.dmp
memory/3500-518-0x00000000078A0000-0x00000000079CC000-memory.dmp
memory/3500-528-0x00000000078A0000-0x00000000079C5000-memory.dmp
memory/3500-1595-0x0000000007CA0000-0x0000000007CEC000-memory.dmp
memory/3500-526-0x00000000078A0000-0x00000000079C5000-memory.dmp
memory/3500-522-0x00000000078A0000-0x00000000079C5000-memory.dmp
memory/3500-520-0x00000000078A0000-0x00000000079C5000-memory.dmp
memory/3500-516-0x00000000008A0000-0x0000000001D06000-memory.dmp
memory/3500-519-0x00000000078A0000-0x00000000079C5000-memory.dmp
memory/3676-436-0x0000000069CC0000-0x000000006A377000-memory.dmp
memory/3676-450-0x0000000000F60000-0x00000000015E5000-memory.dmp
memory/4172-368-0x0000000000610000-0x0000000000728000-memory.dmp
memory/4172-372-0x000000000B3A0000-0x000000000B424000-memory.dmp
memory/4200-346-0x0000000000E40000-0x00000000010A1000-memory.dmp
memory/4200-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4200-105-0x0000000000E40000-0x00000000010A1000-memory.dmp
memory/4400-201-0x0000000000BF0000-0x00000000010B8000-memory.dmp
memory/4400-179-0x0000000000BF0000-0x00000000010B8000-memory.dmp
memory/4716-395-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/4716-489-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/4716-203-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/4716-517-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/4716-402-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/4716-449-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/4820-113-0x000000001DE90000-0x000000001DECC000-memory.dmp
memory/4820-133-0x000000001EBB0000-0x000000001EC26000-memory.dmp
memory/4820-88-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5072-85-0x0000000000400000-0x0000000000531000-memory.dmp
memory/5072-64-0x0000000000400000-0x0000000000531000-memory.dmp
memory/5072-62-0x0000000000400000-0x0000000000531000-memory.dmp
memory/5072-63-0x0000000000400000-0x0000000000531000-memory.dmp
memory/5376-1599-0x0000000002F80000-0x0000000002FB6000-memory.dmp
memory/5376-1647-0x0000000007DD0000-0x0000000007DE1000-memory.dmp
memory/5376-1613-0x0000000006890000-0x00000000068AE000-memory.dmp
memory/5376-1614-0x00000000068F0000-0x000000000693C000-memory.dmp
memory/5376-1616-0x000000006F280000-0x000000006F2CC000-memory.dmp
memory/5376-1615-0x0000000007840000-0x0000000007872000-memory.dmp
memory/5376-1627-0x0000000006E70000-0x0000000006E8E000-memory.dmp
memory/5376-1628-0x0000000007A90000-0x0000000007B33000-memory.dmp
memory/5376-1635-0x0000000008210000-0x000000000888A000-memory.dmp
memory/5376-1636-0x0000000007BD0000-0x0000000007BEA000-memory.dmp
memory/5376-1607-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/5376-1640-0x0000000007C40000-0x0000000007C4A000-memory.dmp
memory/5376-1646-0x0000000007E50000-0x0000000007EE6000-memory.dmp
memory/5376-1612-0x0000000006420000-0x0000000006774000-memory.dmp
memory/5376-1649-0x0000000007E00000-0x0000000007E0E000-memory.dmp
memory/5376-1655-0x0000000007E10000-0x0000000007E24000-memory.dmp
memory/5376-1656-0x0000000007F10000-0x0000000007F2A000-memory.dmp
memory/5376-1657-0x0000000007EF0000-0x0000000007EF8000-memory.dmp
memory/5376-1601-0x00000000059E0000-0x0000000005A02000-memory.dmp
memory/5376-1600-0x0000000005B50000-0x0000000006178000-memory.dmp
memory/5424-1679-0x0000000000380000-0x0000000000834000-memory.dmp
memory/5424-1683-0x0000000000380000-0x0000000000834000-memory.dmp
memory/5464-1677-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/5464-1681-0x00000000001C0000-0x0000000000688000-memory.dmp
memory/5668-1674-0x0000000005120000-0x00000000051DC000-memory.dmp
memory/5668-1692-0x0000000006A20000-0x0000000006B0A000-memory.dmp
memory/5668-1673-0x0000000000400000-0x000000000045E000-memory.dmp