Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 04:06
Static task
static1
Behavioral task
behavioral1
Sample
24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe
Resource
win7-20240903-en
General
-
Target
24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe
-
Size
1.8MB
-
MD5
aa9f26fbbe48f6165965ff13b7aa29af
-
SHA1
89e4fb1f5f5a4327dacc25ddc78f1e08d4e683db
-
SHA256
24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899
-
SHA512
94f045c59ab8eacb13cfcc9be88eacf8f140169baabd7b3aa9554c5ce330fdd5c88f5cbc174f13b34175a633967d571830e0b8906a95f4959ed208c3197ee2e3
-
SSDEEP
24576:qgA24FMnTN+7WzsjKfRUfCAdwUuhfRonpytqbaCb3WAGm4nsyQaleIZH34/CFjRY:gF4TdzsO6wbfVe939gnFQafiCfESAzZ
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a42a72827a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0dd5aaa5bc.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0dd5aaa5bc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a42a72827a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a42a72827a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0dd5aaa5bc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation axplong.exe -
Executes dropped EXE 6 IoCs
pid Process 3360 axplong.exe 4808 0dd5aaa5bc.exe 4084 a42a72827a.exe 3928 axplong.exe 4888 axplong.exe 4036 axplong.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 0dd5aaa5bc.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine a42a72827a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0dd5aaa5bc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002162001\\0dd5aaa5bc.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a42a72827a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002163001\\a42a72827a.exe" axplong.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe 3360 axplong.exe 4808 0dd5aaa5bc.exe 4084 a42a72827a.exe 3928 axplong.exe 4888 axplong.exe 4036 axplong.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1500 4084 WerFault.exe 95 4364 4084 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0dd5aaa5bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a42a72827a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe 3360 axplong.exe 3360 axplong.exe 4808 0dd5aaa5bc.exe 4808 0dd5aaa5bc.exe 4084 a42a72827a.exe 4084 a42a72827a.exe 3928 axplong.exe 3928 axplong.exe 4888 axplong.exe 4888 axplong.exe 4036 axplong.exe 4036 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3360 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe 86 PID 4688 wrote to memory of 3360 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe 86 PID 4688 wrote to memory of 3360 4688 24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe 86 PID 3360 wrote to memory of 4808 3360 axplong.exe 91 PID 3360 wrote to memory of 4808 3360 axplong.exe 91 PID 3360 wrote to memory of 4808 3360 axplong.exe 91 PID 3360 wrote to memory of 4084 3360 axplong.exe 95 PID 3360 wrote to memory of 4084 3360 axplong.exe 95 PID 3360 wrote to memory of 4084 3360 axplong.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe"C:\Users\Admin\AppData\Local\Temp\24e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\1002162001\0dd5aaa5bc.exe"C:\Users\Admin\AppData\Local\Temp\1002162001\0dd5aaa5bc.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\1002163001\a42a72827a.exe"C:\Users\Admin\AppData\Local\Temp\1002163001\a42a72827a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 14844⤵
- Program crash
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 14844⤵
- Program crash
PID:4364
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4084 -ip 40841⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4084 -ip 40841⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD59daf9ba5572fa8bd4f0fffad181e8e7e
SHA1cbe0cddc9f6f9748b82201587d5b419e6f6dc740
SHA25670dff1225c6b572e8fedd62f2e0f5c9c8b40f16c3fb9086fa05f3b103627b4cd
SHA512868ee95a3f5baa4efd1b486f324073ee25c2f4404fe5d1861c3734e2755399115aa377a09526563e4d7f0244d913821a09c15fd0c26933a5427b19e49bb535f6
-
Filesize
3.0MB
MD55f18211741745b380ec60e069848da57
SHA140783e3d211161b3954bff21dfbf387a2fcd627f
SHA256c589795f1265a4042dc50040c70f65a69cd4bbba569edae1bb1a8b62ca937c41
SHA512bd6417e7e56565d8a96de36ed94239ca954a62758a4ed1b02b90743e897a19732fd5ac20f213cbf7a26bfb277c1a750924f5e63e3d0802ed10073c3913c0586a
-
Filesize
1.8MB
MD5aa9f26fbbe48f6165965ff13b7aa29af
SHA189e4fb1f5f5a4327dacc25ddc78f1e08d4e683db
SHA25624e06daa763531d27f7dae653e9348876b356987b18f1cdda7c2ddab4eda0899
SHA51294f045c59ab8eacb13cfcc9be88eacf8f140169baabd7b3aa9554c5ce330fdd5c88f5cbc174f13b34175a633967d571830e0b8906a95f4959ed208c3197ee2e3