Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 02:39
Static task
static1
General
-
Target
78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
-
Size
3.2MB
-
MD5
7446e32ee2697758d8a5ed74e79bac34
-
SHA1
1e4beba935149218af721846c82fd17ca0a6ea7d
-
SHA256
78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa
-
SHA512
e5f812d4fd08c46a838147bc6d50499080c1a992a59c8b135fae2974d01cabef509c0fe007af7e7839364cc541379b7df2936dcb8b1009732b71be73b73e87f7
-
SSDEEP
49152:Wx8HpjVwvX+RiiKOb6d0GCns5yCn2Ft0C4CkDiawVzAD2gmv:S8HDk+RiiKOb6dZCns7uH4AVcDtm
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
remcos
DPDNOW
dpdnow.duckdns.org:8452
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-A34JIZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
Remcos family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 956e7b56a5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ada753f404.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ remcos_a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ remcos.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion remcos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ada753f404.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 956e7b56a5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion remcos_a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion remcos_a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion remcos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ada753f404.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 956e7b56a5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation remcos_a.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation buildd.exe -
Executes dropped EXE 9 IoCs
pid Process 5040 skotes.exe 3644 remcos_a.exe 1172 remcos.exe 2940 buildd.exe 4600 ada753f404.exe 4484 956e7b56a5.exe 1892 skotes.exe 2760 skotes.exe 4848 skotes.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine remcos.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine remcos_a.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine ada753f404.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine 956e7b56a5.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ada753f404.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004507001\\ada753f404.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\956e7b56a5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004508001\\956e7b56a5.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos_a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos_a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe 5040 skotes.exe 3644 remcos_a.exe 1172 remcos.exe 4600 ada753f404.exe 4484 956e7b56a5.exe 1892 skotes.exe 2760 skotes.exe 4848 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4328 4600 WerFault.exe 110 372 4600 WerFault.exe 110 1364 4600 WerFault.exe 110 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ada753f404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956e7b56a5.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2256 cmd.exe 2332 netsh.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4204 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe 5040 skotes.exe 5040 skotes.exe 3644 remcos_a.exe 3644 remcos_a.exe 1172 remcos.exe 1172 remcos.exe 2940 buildd.exe 2940 buildd.exe 2940 buildd.exe 2940 buildd.exe 2940 buildd.exe 2940 buildd.exe 4600 ada753f404.exe 4600 ada753f404.exe 4484 956e7b56a5.exe 4484 956e7b56a5.exe 1892 skotes.exe 1892 skotes.exe 2760 skotes.exe 2760 skotes.exe 4848 skotes.exe 4848 skotes.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2940 buildd.exe Token: SeAssignPrimaryTokenPrivilege 2940 buildd.exe Token: SeIncreaseQuotaPrivilege 2940 buildd.exe Token: SeSecurityPrivilege 2940 buildd.exe Token: SeTakeOwnershipPrivilege 2940 buildd.exe Token: SeLoadDriverPrivilege 2940 buildd.exe Token: SeSystemtimePrivilege 2940 buildd.exe Token: SeBackupPrivilege 2940 buildd.exe Token: SeRestorePrivilege 2940 buildd.exe Token: SeShutdownPrivilege 2940 buildd.exe Token: SeSystemEnvironmentPrivilege 2940 buildd.exe Token: SeUndockPrivilege 2940 buildd.exe Token: SeManageVolumePrivilege 2940 buildd.exe Token: 31 2940 buildd.exe Token: 32 2940 buildd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1172 remcos.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4408 wrote to memory of 5040 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe 88 PID 4408 wrote to memory of 5040 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe 88 PID 4408 wrote to memory of 5040 4408 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe 88 PID 5040 wrote to memory of 3644 5040 skotes.exe 94 PID 5040 wrote to memory of 3644 5040 skotes.exe 94 PID 5040 wrote to memory of 3644 5040 skotes.exe 94 PID 3644 wrote to memory of 1172 3644 remcos_a.exe 96 PID 3644 wrote to memory of 1172 3644 remcos_a.exe 96 PID 3644 wrote to memory of 1172 3644 remcos_a.exe 96 PID 5040 wrote to memory of 2940 5040 skotes.exe 97 PID 5040 wrote to memory of 2940 5040 skotes.exe 97 PID 2940 wrote to memory of 2256 2940 buildd.exe 98 PID 2940 wrote to memory of 2256 2940 buildd.exe 98 PID 2256 wrote to memory of 2976 2256 cmd.exe 100 PID 2256 wrote to memory of 2976 2256 cmd.exe 100 PID 2256 wrote to memory of 2332 2256 cmd.exe 101 PID 2256 wrote to memory of 2332 2256 cmd.exe 101 PID 2256 wrote to memory of 556 2256 cmd.exe 102 PID 2256 wrote to memory of 556 2256 cmd.exe 102 PID 2940 wrote to memory of 3500 2940 buildd.exe 103 PID 2940 wrote to memory of 3500 2940 buildd.exe 103 PID 3500 wrote to memory of 756 3500 cmd.exe 105 PID 3500 wrote to memory of 756 3500 cmd.exe 105 PID 3500 wrote to memory of 1348 3500 cmd.exe 106 PID 3500 wrote to memory of 1348 3500 cmd.exe 106 PID 3500 wrote to memory of 2388 3500 cmd.exe 107 PID 3500 wrote to memory of 2388 3500 cmd.exe 107 PID 5040 wrote to memory of 4600 5040 skotes.exe 110 PID 5040 wrote to memory of 4600 5040 skotes.exe 110 PID 5040 wrote to memory of 4600 5040 skotes.exe 110 PID 2940 wrote to memory of 4180 2940 buildd.exe 111 PID 2940 wrote to memory of 4180 2940 buildd.exe 111 PID 4180 wrote to memory of 1116 4180 cmd.exe 113 PID 4180 wrote to memory of 1116 4180 cmd.exe 113 PID 4180 wrote to memory of 4204 4180 cmd.exe 114 PID 4180 wrote to memory of 4204 4180 cmd.exe 114 PID 5040 wrote to memory of 4484 5040 skotes.exe 122 PID 5040 wrote to memory of 4484 5040 skotes.exe 122 PID 5040 wrote to memory of 4484 5040 skotes.exe 122 PID 5040 wrote to memory of 4764 5040 skotes.exe 123 PID 5040 wrote to memory of 4764 5040 skotes.exe 123 PID 5040 wrote to memory of 4764 5040 skotes.exe 123 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe"C:\Users\Admin\AppData\Local\Temp\78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1172
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2940 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:2976
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2332
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵PID:556
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:756
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1348
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵PID:2388
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:1116
-
-
C:\Windows\system32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
PID:4204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004507001\ada753f404.exe"C:\Users\Admin\AppData\Local\Temp\1004507001\ada753f404.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 15124⤵
- Program crash
PID:4328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 14684⤵
- Program crash
PID:372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 15004⤵
- Program crash
PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004508001\956e7b56a5.exe"C:\Users\Admin\AppData\Local\Temp\1004508001\956e7b56a5.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵PID:4764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4600 -ip 46001⤵PID:3564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4600 -ip 46001⤵PID:1572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4600 -ip 46001⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4848
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD52fd0ae47d647bd7d4f00ca6e7dcc3db5
SHA173a68ed4dbedd7b1b4d7107e49aca91e38e45939
SHA256054b00cb6ca4e35e1ec39cd3950eb45a1ba6877808a97ade61753a66dbd96e84
SHA5120e14517ea4acbe531e4d1f899765519eb2b5b39cfc98c7606d5b117601f860c8e00a1f76915fc18dd325880d9f527c3a58cfe713bb13b955abc3ef5fcef59cca
-
Filesize
1.9MB
MD5b85c47881ba0eb0b556b83827f8e75c8
SHA1dccdf0daee468f9e9bed3edf928f0839d26b47cb
SHA2569d577624acca69f5b4097a6882e934b026a344757cf5cf31f3341e643ed2ba20
SHA512ca158aff36e4eeff5d1c263a79972dfa0aa7584132f12a3d301a5cc5c47b57309fe71b4837c7b8caa5022cb18529b565d6a0849acdabd1af939b76b48284a605
-
Filesize
154KB
MD5c426f46f2c074eda8c903f9868be046d
SHA1d0352482370beff107eb2b2f13e2de275fbc91c7
SHA2567cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e
SHA51297eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05
-
Filesize
3.0MB
MD58cf8b11e1553e2381b0c2376d013e951
SHA133d8bc52fe1fc709ee086a5a84d39024b6e2db92
SHA256d3ea3d360b4e4c6bc1da5adbd8c8bbe689b0541166e2a77dac821517be81de98
SHA512a876d770734998f8397efea36c94bf7b61d14aa317f4b9e62b95333171068b626ebe2336c6fefc3a0f02f16b454df5c852b9fe4cbb3af59fe1d11ae2f77303a4
-
Filesize
2.0MB
MD55c656fca21313b706060727ffe93f6bb
SHA1481b192814532355b6e2045091ee300f307349e8
SHA256bfcf6c46d64eb87be63df45a15ff9c2a89bd66af62942756ec4dbd45cdfe6ebd
SHA512a7035a9bfb230ed1621dfabcfa43ee07b62e95b82858f2cac1bdaba16c5654574f5af0f445082d5ba6695bc5734a8e0d99d05a810ba27344ec0fe709e20cd589
-
Filesize
32KB
MD5e1c1caff464b2c9fcc4d6b2dcfdd3e09
SHA1a9c7b611dd66633ee8cb63814345b547ba165ed2
SHA256f3706b04ce8d4d1c10053c43e1ff502fec5a7add0c775fae8d6c336fb5c6145f
SHA51294a180fec46920a431766e504e69666f3401e7faacdad6380a4a714731a4c82352a89945a3b040059c040e4d0ed4febd2fa04d90e8906c93295be0747fc1d5ca
-
Filesize
3.2MB
MD57446e32ee2697758d8a5ed74e79bac34
SHA11e4beba935149218af721846c82fd17ca0a6ea7d
SHA25678616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa
SHA512e5f812d4fd08c46a838147bc6d50499080c1a992a59c8b135fae2974d01cabef509c0fe007af7e7839364cc541379b7df2936dcb8b1009732b71be73b73e87f7