amadey | ebb0f6f813ac2adbae62bb646656a190523504505fe1f18acee25593300e38b9

Analysis

max time kernel
299s
max time network
279s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21/10/2024, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
♡☞Satup#/Setup.exe
Size 5.4MB
Sample241021-j63fdayamn
SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
MD5 ad2735f096925010a53450cb4178c89e
SHA1 c6d65163c6315a642664f4eaec0fae9528549bfe
SHA512 1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9
SSDEEP 98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey lumma 41da8a discovery spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://snailyeductyi.sbs
https://ferrycheatyk.sbs
https://deepymouthi.sbs
https://wrigglesight.sbs
https://captaitwik.sbs
https://sidercotay.sbs
https://heroicmint.sbs
https://monstourtu.sbs

Extracted

Family

amadey

Version

5.03

Botnet

41da8a

http://sportszone-financefocus.com
http://sportszone-financefocus2.com
http://sportszone-financefocus3.com

Attributes

strings_key
d7c1288e89ebe71872174bb1aa9f53de
url_paths
/8vjeh73hdjrFs/index.php

/KFdjj3Cajf4/index.php

/t7hdh39vjhs/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 3 IoCs

pid	Process
3608	StrCmp.exe
4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe

Loads dropped DLL 1 IoCs

pid	Process
3804	AutoIt3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 2724	2072	Setup.exe	78
PID 4104 set thread context of 3676	4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe	84
PID 4048 set thread context of 2720	4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe	86

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Acronis Scheduler Service.job	more.com
File created	C:\Windows\Tasks\Window Manager.job	more.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StrCmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Programmable	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Ebx\\VSBXXPUYIRU\\StrCmp.exe"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ProgID	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\Ebx\\VSBXXPUYIRU"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\ = "BtDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward\ = "{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward\ = "{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS\ = "0"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Ebx\\VSBXXPUYIRU\\StrCmp.exe"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid\ = "{4F7FA487-8CC1-493E-AF0A-E7A294474F25}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION\ = "2.1"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ = "cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ProgID\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32	StrCmp.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2072	Setup.exe
2072	Setup.exe
2724	more.com
2724	more.com
3804	AutoIt3.exe
3804	AutoIt3.exe
3804	AutoIt3.exe
3804	AutoIt3.exe
4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
3676	more.com
3676	more.com
2720	more.com
2720	more.com

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2072	Setup.exe
2724	more.com
4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
3676	more.com
2720	more.com

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3608	StrCmp.exe
4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3608	2072	Setup.exe	77
PID 2072 wrote to memory of 3608	2072	Setup.exe	77
PID 2072 wrote to memory of 3608	2072	Setup.exe	77
PID 2072 wrote to memory of 2724	2072	Setup.exe	78
PID 2072 wrote to memory of 2724	2072	Setup.exe	78
PID 2072 wrote to memory of 2724	2072	Setup.exe	78
PID 2072 wrote to memory of 2724	2072	Setup.exe	78
PID 2724 wrote to memory of 3804	2724	more.com	80
PID 2724 wrote to memory of 3804	2724	more.com	80
PID 2724 wrote to memory of 3804	2724	more.com	80
PID 2724 wrote to memory of 3804	2724	more.com	80
PID 2724 wrote to memory of 3804	2724	more.com	80
PID 3804 wrote to memory of 4104	3804	AutoIt3.exe	82
PID 3804 wrote to memory of 4104	3804	AutoIt3.exe	82
PID 3804 wrote to memory of 4104	3804	AutoIt3.exe	82
PID 3804 wrote to memory of 4048	3804	AutoIt3.exe	83
PID 3804 wrote to memory of 4048	3804	AutoIt3.exe	83
PID 3804 wrote to memory of 4048	3804	AutoIt3.exe	83
PID 4104 wrote to memory of 3676	4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe	84
PID 4104 wrote to memory of 3676	4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe	84
PID 4104 wrote to memory of 3676	4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe	84
PID 4048 wrote to memory of 2720	4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe	86
PID 4048 wrote to memory of 2720	4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe	86
PID 4048 wrote to memory of 2720	4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe	86
PID 4104 wrote to memory of 3676	4104	3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe	84
PID 4048 wrote to memory of 2720	4048	GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe	86
PID 3676 wrote to memory of 4100	3676	more.com	90
PID 3676 wrote to memory of 4100	3676	more.com	90
PID 3676 wrote to memory of 4100	3676	more.com	90
PID 2720 wrote to memory of 2984	2720	more.com	91
PID 2720 wrote to memory of 2984	2720	more.com	91
PID 2720 wrote to memory of 2984	2720	more.com	91
PID 3676 wrote to memory of 4100	3676	more.com	90
PID 2720 wrote to memory of 2984	2720	more.com	91

C:\Users\Admin\AppData\Local\Temp\♡☞Satup#\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\♡☞Satup#\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Roaming\Ebx\VSBXXPUYIRU\StrCmp.exe
  C:\Users\Admin\AppData\Roaming\Ebx\VSBXXPUYIRU\StrCmp.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3608
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
      "C:\Users\Admin\AppData\Local\Temp\3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4104
    - - C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3676
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
      "C:\Users\Admin\AppData\Local\Temp\GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

153280d0

Path C:\Users\Admin\AppData\Local\Temp\153280d0
Size 6.2MB
SHA256 ab955a896dd88530e200c6af4978c8e259e6b47abe43ae3cd8b725a816cd55ee
MD5 f1490558dbea9dc33d06d9e1398e9972
SHA1 abf0043310f4d0ff5d01f9b7006d386fb3600ab5
SHA512 0f40e13b901961881bf3f2aad4ab1048b779074277dc6714d5985fd5a817f2be6bb63aa4ad6e88148ea98c62c2dd25215a9e4712d7f61e095c621448d4068fae
SSDEEP 196608:xjrWsc67AT/KUtNzAo827M14nr9XV+ujNhur:9vc6s3Hj8Z14ZXl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

1bd3933a

Path C:\Users\Admin\AppData\Local\Temp\1bd3933a
Size 2.1MB
SHA256 d1554cea4d5d2a1bbc9a87f36e6700ee0335c0710fd42da30257e65d35bc6d44
MD5 68cf885c86d64d0fb592b91ab5486718
SHA1 66215ee186427dce5b468ad87f81afba210bffde
SHA512 7934582b26972bd02e9658d7a4845eb9c6285133fa8f76e93e74a5664d5114990bd5ea53fadb78a485a1dbf4ec1405492a3aba83b9c7054105eef6783371ebdc
SSDEEP 49152:o8xiTh3lw39PF2vIVpvuSpXF8/VTKjxG6GejXDJAzzYK/kfu2M6W:oSiTh3W72v+vHSVTKjE6BT/KSu2Mt
MD5 SHA1 SHA512 SSDEEP

Submit Download

22150bc5

Path C:\Users\Admin\AppData\Local\Temp\22150bc5
Size 6.4MB
SHA256 bfec0f9a55ee2532c8c94c54a4f544be68d02be3c13a08eec279404f4352877c
MD5 0a16f7b2376eb7f30db869d416d170a0
SHA1 9086aa5d7e6d5a90f86c10c2c2f99706838efc13
SHA512 ce7d52365b262cca62b2c8f635dfbb923459c997e7226c0d4726cc8dde7a32cd8f2100625ebf0f4d91b5f96a7b9a7d9ffd9aa0e98b0514f81c3cfd1af1cd4f57
SSDEEP 98304:wSiTh3W72v+vW9TN00j/qZMjzMe6LeX7vrWOJT/L1tGgjzWA8+0CwOoKDNSKzd0A:wSiTh3W72E/ZGMGlTGgfU09aYUNNQjT
MD5 SHA1 SHA512 SSDEEP

Submit Download

22cb35a8

Path C:\Users\Admin\AppData\Local\Temp\22cb35a8
Size 1.1MB
SHA256 afd46becb1249c696a4ef7657389fc19c2e32e2972daef8dd4a57313178a790c
MD5 23bb6aa658769a7acfd8b299cf9a4267
SHA1 0003390b4c0e16d2585716eb556dca51337e74b9
SHA512 cbdd8f6269a07c5516935566493cb9ab816a30f1ad95632911c98d7dad638af74f73ca70d2648c541a7907d6a6ec519c3453a543bd3263b47779a273bb1a50f8
SSDEEP 24576:Y0wlyxwTDqkRCWLjSs+eo9ujOLrysmIO9iNCmTuGA2eTwEhrv7SKCjF:8lyaTvCWLO/LrqIFgmid2F0rv7qjF
MD5 SHA1 SHA512 SSDEEP

Submit Download

295dc575

Path C:\Users\Admin\AppData\Local\Temp\295dc575
Size 1.1MB
SHA256 eecaaa565cc0495e223b31caafd211e08d68997c025d71f9bde98bf4a88bdc08
MD5 d9cdee993821347477038d87c0d0e976
SHA1 420bde3ec149bc06fb2b8ed07a24cca7cd0629a2
SHA512 30a9abe407fde348ea9bf3ef59f24dd845072dcb718867a60b8bb65bd04ded9138448d7e9f807a19aa3eeed222bbbe42c043befb729507dce06dde53b43b8876
SSDEEP 24576:l8xiThwol1cR1Qv/aF9DznatjKk9aB2v6Ro4pv/XUL7HbtBnkpo/eQGRpF1cl0u:l8xiTh3lw39PF2vIVpv63kSWLjFKl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe

Path C:\Users\Admin\AppData\Local\Temp\3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
Size 13.2MB
SHA256 190ecfadbb3b3bb9400f9f27f2db55c0978cb51ef9569f1cd6636e5523acb4ae
MD5 c13aa2a232a5023b77dfaa4772409b0f
SHA1 f00b458bf0899de09f688c04c21fbff8a5fc147c
SHA512 67605e2b6ff63a33d1133e1972a93dcae1303f1afaf704c14d73ec9a5b58525cb860ce55de9f3995cfbd58be7fcbb7adf7eca45678c11f80768666e88a2368a7
SSDEEP 196608:O+NmNxAMKZ9jrWsc67AT/KUtNzAo827M14nr9XV+ujNhuoPj13a:O+gNx0vvc6s3Hj8Z14ZXln3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
Size 921KB
SHA256 1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48
MD5 3f58a517f1f4796225137e7659ad2adb
SHA1 e264ba0e9987b0ad0812e5dd4dd3075531cfe269
SHA512 acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634
SSDEEP 24576:MghN1a6pzWZ12+f+Qa7N4nEIRQ1hOOLkF6av8uh:vhN1aQzJD4BuTxavfh
MD5 SHA1 SHA512 SSDEEP

Submit Download

GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe

Path C:\Users\Admin\AppData\Local\Temp\GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
Size 9.1MB
SHA256 102dc63d733c2b78c2a4a72c6709675bd62121cfd38460be6805bca60b5eaa69
MD5 de559fd217e239c23c2c6da8a73ba3de
SHA1 e499ff1ae6da50e17723bcd0d90b2f8fc663a709
SHA512 1824012ca5e17765256a4834ac229a04eda74f1d954ecbc89ae4d1fe2ab79d2d3d7d0328030734a5f703c51b14e51e710d4804300f42c5dfb8caf02d4b99def7
SSDEEP 98304:Hmds20n1vwGonYi+vP0kgBdatR9fHeO1/YoVeKOZ/KAACWLILrNy60repa0QZg3r:HeL01bogkkCMR6GRjAAUrN6i
MD5 SHA1 SHA512 SSDEEP

Submit Download

StrCmp.exe

Path C:\Users\Admin\AppData\Roaming\Ebx\VSBXXPUYIRU\StrCmp.exe
Size 47KB
SHA256 118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35
MD5 916d7425a559aaa77f640710a65f9182
SHA1 23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13
SHA512 d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc
SSDEEP 384:UIJpPkn2VDVdOQe7vB4LN9tntl4crAlRcDuy1Tyk6K/uLvVWuFRNV1VF0hXHMGBJ:UQ35YtUIbERx/6jjVTbV1VaXLkjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-0-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

Download

memory/2072-23-0x00007FFB2AAF9000-0x00007FFB2AAFA000-memory.dmp

Download

memory/2072-12-0x00007FFB2AAF9000-0x00007FFB2AAFA000-memory.dmp

Download

memory/2072-16-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

Download

memory/2072-20-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

Download

memory/2072-22-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

Download

memory/2720-102-0x0000000003D50000-0x0000000004352000-memory.dmp

Download

memory/2720-84-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/2720-87-0x0000000003D50000-0x0000000004352000-memory.dmp

Download

memory/2720-88-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/2720-96-0x0000000003D50000-0x0000000004352000-memory.dmp

Download

memory/2724-27-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/2724-29-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/2724-30-0x000000007658E000-0x0000000076590000-memory.dmp

Download

memory/2724-36-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/2724-37-0x000000007658E000-0x0000000076590000-memory.dmp

Download

memory/2724-32-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/2984-111-0x0000000000350000-0x00000000003C3000-memory.dmp

Download

memory/2984-104-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/2984-105-0x0000000000350000-0x00000000003C3000-memory.dmp

Download

memory/3676-100-0x0000000003760000-0x0000000003D62000-memory.dmp

Download

memory/3676-83-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/3676-94-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/3676-95-0x0000000003760000-0x0000000003D62000-memory.dmp

Download

memory/3804-39-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/3804-41-0x00000000009A0000-0x0000000000A18000-memory.dmp

Download

memory/3804-56-0x00000000009A0000-0x0000000000A18000-memory.dmp

Download

memory/4048-79-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/4048-66-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/4048-65-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/4048-58-0x0000000000ED0000-0x0000000001976000-memory.dmp

Download

memory/4100-101-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/4100-103-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-109-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-112-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-114-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-116-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-118-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-120-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4100-122-0x00000000012B0000-0x0000000001884000-memory.dmp

Download

memory/4104-53-0x0000000076580000-0x0000000076B82000-memory.dmp

Download

memory/4104-46-0x0000000000400000-0x0000000001163000-memory.dmp

Download

memory/4104-57-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

Download

memory/4104-74-0x0000000076580000-0x0000000076B82000-memory.dmp

Download