Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 14:24
Static task
static1
Behavioral task
behavioral1
Sample
bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe
Resource
win7-20240903-en
General
-
Target
bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe
-
Size
1.8MB
-
MD5
0f45cf13f5cb53f19189b406384dafe8
-
SHA1
919ba539a8238659f05afc511a6f0a33c6c58a2a
-
SHA256
bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729
-
SHA512
31502bc5c595adbe0570aa48b005716da6ae0ccc88b407197c9543313cd7f5bc99bace24bb62bb6b4b6a0898c9d8dab746e31ed164e3495cf4e0b8645e5ee043
-
SSDEEP
24576:QSu8Nu9ZCvwxhSYYTvG7DzBzSkQ4YAEZaxGyjpN4RlpDBC7lRCcouvxcufoTGuwd:87okhSYYGfhSliGIpkp+jXlVCRlM
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0fc5888fa9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 713a05817c.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 713a05817c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 713a05817c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0fc5888fa9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0fc5888fa9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation axplong.exe -
Executes dropped EXE 5 IoCs
pid Process 3652 axplong.exe 2180 713a05817c.exe 4428 0fc5888fa9.exe 1872 axplong.exe 4468 axplong.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine 713a05817c.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine 0fc5888fa9.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine axplong.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\713a05817c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002211001\\713a05817c.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0fc5888fa9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002212001\\0fc5888fa9.exe" axplong.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe 3652 axplong.exe 2180 713a05817c.exe 4428 0fc5888fa9.exe 1872 axplong.exe 4468 axplong.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4904 4428 WerFault.exe 96 4716 4428 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713a05817c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0fc5888fa9.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe 3652 axplong.exe 3652 axplong.exe 2180 713a05817c.exe 2180 713a05817c.exe 4428 0fc5888fa9.exe 4428 0fc5888fa9.exe 1872 axplong.exe 1872 axplong.exe 4468 axplong.exe 4468 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3812 wrote to memory of 3652 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe 86 PID 3812 wrote to memory of 3652 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe 86 PID 3812 wrote to memory of 3652 3812 bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe 86 PID 3652 wrote to memory of 2180 3652 axplong.exe 90 PID 3652 wrote to memory of 2180 3652 axplong.exe 90 PID 3652 wrote to memory of 2180 3652 axplong.exe 90 PID 3652 wrote to memory of 4428 3652 axplong.exe 96 PID 3652 wrote to memory of 4428 3652 axplong.exe 96 PID 3652 wrote to memory of 4428 3652 axplong.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe"C:\Users\Admin\AppData\Local\Temp\bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\1002211001\713a05817c.exe"C:\Users\Admin\AppData\Local\Temp\1002211001\713a05817c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\1002212001\0fc5888fa9.exe"C:\Users\Admin\AppData\Local\Temp\1002212001\0fc5888fa9.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 14724⤵
- Program crash
PID:4904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 14884⤵
- Program crash
PID:4716
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4428 -ip 44281⤵PID:3136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4428 -ip 44281⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD52f8c72218bc8d19062c1bcfc28aac96c
SHA1ca163d6116edab9f45704e91635bf350a6fcf349
SHA256b61e6a903e387ec816cd46b72d7224caec4eac2c9837562b25e6df64a5b1c76e
SHA5122408bbf4473204b765bf860daec4ff47fb4ca34ad57559acf05ae69490564920a00a01d64899bb0eda4903442610a950bcba4105d7459a9108ca4607f71133b3
-
Filesize
3.1MB
MD54cd9e71dbd4fe83c9e2646791c93089a
SHA12107a9bc99dfc0d1fac036c9e59a786626dae7d1
SHA25692266e2506dbada2a9f94aa22c9b7b03b37771e97c58105f624748978827853e
SHA5122075c454015fa707a58f4c1a5645b6223a4c08cbaa8e9aeba79a26a050a6ab1a0f64ce4ff30c691cf31f6389dba49e1d206c5042dbc7fbb63dda0945dcab870e
-
Filesize
1.8MB
MD50f45cf13f5cb53f19189b406384dafe8
SHA1919ba539a8238659f05afc511a6f0a33c6c58a2a
SHA256bf9f951dd0f13b3a7749b2bae9beb07550abc9efb29a808154def7318a42f729
SHA51231502bc5c595adbe0570aa48b005716da6ae0ccc88b407197c9543313cd7f5bc99bace24bb62bb6b4b6a0898c9d8dab746e31ed164e3495cf4e0b8645e5ee043