Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 17:24
Static task
static1
Behavioral task
behavioral1
Sample
2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe
Resource
win7-20241010-en
General
-
Target
2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe
-
Size
1.8MB
-
MD5
9dbcd4d4da05c8ef3fb332a213acd4fb
-
SHA1
37c1292289b343462d6c240822914c4a158fc880
-
SHA256
2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63
-
SHA512
72ab26f5efc97c1219c13c0ff40d5290b5851514c35ed3069600db41f3e735398950299ebf12df508d6e4e2a835a8842d08b1e2cd02e515a6041735bb4f7a89d
-
SSDEEP
24576:KpGGXeA3j/6ROgY130/3YUuBhWB1W64qssCoN8GylH9t6Q8Cj80QSGN4kALRfvoi:SzkOQUqjCiyldt6nU1Q3NfAVH
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" fdac42b921.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" fdac42b921.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" fdac42b921.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" fdac42b921.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection fdac42b921.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" fdac42b921.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b895cf2d42.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0c6badda10.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 53e0487eab.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fdac42b921.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ DocumentsGDBAKEGIDB.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a06488d00f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5428 chrome.exe 5244 msedge.exe 6044 msedge.exe 5236 msedge.exe 5620 msedge.exe 5628 msedge.exe 952 chrome.exe 3844 chrome.exe 3756 chrome.exe 4772 chrome.exe -
Checks BIOS information in registry 2 TTPs 26 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a06488d00f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a06488d00f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fdac42b921.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0c6badda10.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DocumentsGDBAKEGIDB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 53e0487eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fdac42b921.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 53e0487eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b895cf2d42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b895cf2d42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0c6badda10.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DocumentsGDBAKEGIDB.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation b895cf2d42.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DocumentsGDBAKEGIDB.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation axplong.exe -
Executes dropped EXE 12 IoCs
pid Process 208 axplong.exe 4740 b895cf2d42.exe 1224 0c6badda10.exe 3520 DocumentsGDBAKEGIDB.exe 5252 skotes.exe 5500 a06488d00f.exe 4012 53e0487eab.exe 5652 fdac42b921.exe 5148 skotes.exe 5168 axplong.exe 1336 axplong.exe 4884 skotes.exe -
Identifies Wine through registry keys 2 TTPs 13 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine a06488d00f.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 53e0487eab.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine b895cf2d42.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 0c6badda10.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine DocumentsGDBAKEGIDB.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine fdac42b921.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine axplong.exe -
Loads dropped DLL 3 IoCs
pid Process 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" fdac42b921.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features fdac42b921.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fdac42b921.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004655001\\fdac42b921.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b895cf2d42.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002227001\\b895cf2d42.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c6badda10.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002228001\\0c6badda10.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a06488d00f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004652001\\a06488d00f.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\53e0487eab.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004653001\\53e0487eab.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
pid Process 4956 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe 208 axplong.exe 4740 b895cf2d42.exe 1224 0c6badda10.exe 3520 DocumentsGDBAKEGIDB.exe 5252 skotes.exe 5500 a06488d00f.exe 4012 53e0487eab.exe 5652 fdac42b921.exe 5148 skotes.exe 5168 axplong.exe 4884 skotes.exe 1336 axplong.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe File created C:\Windows\Tasks\skotes.job DocumentsGDBAKEGIDB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
pid pid_target Process procid_target 4384 1224 WerFault.exe 94 4360 1224 WerFault.exe 94 3344 5500 WerFault.exe 152 4796 5500 WerFault.exe 152 2040 5500 WerFault.exe 152 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b895cf2d42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c6badda10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DocumentsGDBAKEGIDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53e0487eab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdac42b921.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a06488d00f.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b895cf2d42.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b895cf2d42.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133754739113179982" chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4956 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe 4956 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe 208 axplong.exe 208 axplong.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 1224 0c6badda10.exe 1224 0c6badda10.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 952 chrome.exe 952 chrome.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 884 msedge.exe 884 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6044 msedge.exe 6044 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 6060 msedge.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 4740 b895cf2d42.exe 3520 DocumentsGDBAKEGIDB.exe 3520 DocumentsGDBAKEGIDB.exe 5252 skotes.exe 5252 skotes.exe 5500 a06488d00f.exe 5500 a06488d00f.exe 4012 53e0487eab.exe 4012 53e0487eab.exe 5652 fdac42b921.exe 5652 fdac42b921.exe 5652 fdac42b921.exe 5652 fdac42b921.exe 5652 fdac42b921.exe 5148 skotes.exe 5148 skotes.exe 5168 axplong.exe 5168 axplong.exe 4884 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeDebugPrivilege 5652 fdac42b921.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 3520 DocumentsGDBAKEGIDB.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 208 4956 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe 86 PID 4956 wrote to memory of 208 4956 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe 86 PID 4956 wrote to memory of 208 4956 2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe 86 PID 208 wrote to memory of 4740 208 axplong.exe 90 PID 208 wrote to memory of 4740 208 axplong.exe 90 PID 208 wrote to memory of 4740 208 axplong.exe 90 PID 208 wrote to memory of 1224 208 axplong.exe 94 PID 208 wrote to memory of 1224 208 axplong.exe 94 PID 208 wrote to memory of 1224 208 axplong.exe 94 PID 4740 wrote to memory of 952 4740 b895cf2d42.exe 104 PID 4740 wrote to memory of 952 4740 b895cf2d42.exe 104 PID 952 wrote to memory of 4204 952 chrome.exe 105 PID 952 wrote to memory of 4204 952 chrome.exe 105 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 3768 952 chrome.exe 106 PID 952 wrote to memory of 992 952 chrome.exe 107 PID 952 wrote to memory of 992 952 chrome.exe 107 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108 PID 952 wrote to memory of 2432 952 chrome.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe"C:\Users\Admin\AppData\Local\Temp\2b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\1002227001\b895cf2d42.exe"C:\Users\Admin\AppData\Local\Temp\1002227001\b895cf2d42.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98b5acc40,0x7ff98b5acc4c,0x7ff98b5acc585⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:25⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:35⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2316 /prefetch:85⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:15⤵
- Uses browser remote debugging
PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3456,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3468 /prefetch:15⤵
- Uses browser remote debugging
PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4436,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4580 /prefetch:15⤵
- Uses browser remote debugging
PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4760,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4716 /prefetch:85⤵PID:1016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:85⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4896,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:85⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:85⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:85⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3656 /prefetch:85⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:85⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4848,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4856 /prefetch:85⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4708,i,10037489991806705638,7298243652422089825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5308 /prefetch:25⤵
- Uses browser remote debugging
PID:5428
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:6044 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98b5b46f8,0x7ff98b5b4708,0x7ff98b5b47185⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:25⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:85⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:15⤵
- Uses browser remote debugging
PID:5236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:15⤵
- Uses browser remote debugging
PID:5244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:15⤵
- Uses browser remote debugging
PID:5620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:15⤵
- Uses browser remote debugging
PID:5628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:25⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,5071974692042039057,10505274282691146820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:25⤵PID:732
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsGDBAKEGIDB.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\DocumentsGDBAKEGIDB.exe"C:\Users\Admin\DocumentsGDBAKEGIDB.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\1004652001\a06488d00f.exe"C:\Users\Admin\AppData\Local\Temp\1004652001\a06488d00f.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 14808⤵
- Program crash
PID:3344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 14648⤵
- Program crash
PID:4796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 14648⤵
- Program crash
PID:2040
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004653001\53e0487eab.exe"C:\Users\Admin\AppData\Local\Temp\1004653001\53e0487eab.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"7⤵PID:2320
-
-
C:\Users\Admin\AppData\Local\Temp\1004655001\fdac42b921.exe"C:\Users\Admin\AppData\Local\Temp\1004655001\fdac42b921.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1002228001\0c6badda10.exe"C:\Users\Admin\AppData\Local\Temp\1002228001\0c6badda10.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 14844⤵
- Program crash
PID:4384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 14684⤵
- Program crash
PID:4360
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1224 -ip 12241⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1224 -ip 12241⤵PID:3216
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5500 -ip 55001⤵PID:1340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5500 -ip 55001⤵PID:1756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5500 -ip 55001⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5168
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5148
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1336
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4884
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD52413cc8b93926137ee6a2eeb88b46dcc
SHA126dfeb816c96b8f04031acdd94cc385b7b98875e
SHA256484ae7d0641955ea5b8c5456f4815d0278b9e3052e2b5ad546c8a4c156ec562f
SHA512cdd80891abbbfe21a1850225064106f797076f22ae03b488dd89237c75305f248d6230ebc61bbc7ca7a06e466f7b267706e757d1bbc53fd6fb16fa66f4759d4e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ee45c4c1-fb48-4b14-bb4e-04d7032bb42c.dmp
Filesize826KB
MD5792fb39c569b7267159fb6ec1fc26106
SHA1580f42624107a2f0543e96ab5db02bdbb5f95232
SHA256eedbbe326829d8a7bb471cf4df332b653d85a306ca2920adfa0cd12f249d8c0f
SHA512de350c6b3679c34919582335c814cbefd64bbdcdadb6880a612f08a508cceb5fc186430d4121935e58ce99daba0c015fb9ea8517c4ce811e4ee164bea86972be
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\fb0c34d7-3fe7-4646-ae37-5fb1d226a6ea.dmp
Filesize826KB
MD52b7662ed1850087bda85a24b43e3d1e1
SHA1c0fb5264384f745cb36496ade073f58c77c83e1b
SHA256f5d4e0669045c27494f5f12b0c81ea86c53509c2f7af5ec79d9bb247a61c715e
SHA512738cd3cad7704cc56bfda8d04e395c4d43d571e5664f166feb52f61d627c0e3a2a3929136ab7d593df76f87622a58a2df1171c3837e96d856174277b57d14a7b
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD56a0e4dad0f6d4077062f30efb3fe9e50
SHA1a2ad7fb66eff5236381a3549d12787f7daf4dbb1
SHA25691f8d1c9bc0f17ca07bee734378eec3557cff2e6505062b715c57576e091c1f2
SHA5122a58a6676416bd1fd9425fb31e867357c31e46a3543d1a83c55d1b82f5f2767e03ac1fa1a6b06676683281c4926f521f63c7bc2f1e5f22af086989b98fe3d5d0
-
Filesize
152B
MD50c90c7d507fa42bdefa46721ccbb0bbf
SHA1616bfc9b663f13092c6d493dadf0e06e1dc0cbaa
SHA25610dc813c94f129b17512f54a2737f5f6826ea9e30c624fc5e72c145291c5bae9
SHA5124e20111269abb7eeeb33b6ea4f2746c57fe7b79896c0b175fe31d5b492de75749966e146ae650e0cee83f42f9e217a08b710fa022e201dbc3925c67d56abd91d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\293d268a-a662-4c7b-b14b-abc59e1819e1.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
5KB
MD53cb5468fd92494b9f85970e35731fadd
SHA17545024c931e5ac14fd12a22612fe4ba31cd04b7
SHA25674c041765e81177378fce2125fb5abe73bf1037334259fcf82e21694c503065d
SHA5122224f59564463b36d2393e78bcc68230109db73982fa6930ee0c3b0c4278f0717173471f07fa6fac724a4048d78d341d0df6e916fc2e995917157813cc1bfc53
-
Filesize
2.0MB
MD52bd1643c51ab40c4b17e6f15b1eaeb0c
SHA10ed83b36c8cc314690e7353a2a3631deee098331
SHA256f7536ef71a6a1df24263e5bf3b58be00674f303eff4787d70de246e481f8330e
SHA5124e5d5416d72b5d254b32b98feed4009eb321d21f520d607fdce174b3a7bfd9cab01cfa43981c0dc6f989c936c411e274e924244d31223d6ad2dcee5e7d6b5246
-
Filesize
3.0MB
MD5c641b3ee57b10edb933e1f5eddabce24
SHA1028a2826c6726e0facaf6902a4499a7697ff3e6c
SHA256845b66567bfde5a0d1959f6d6ade4cbaa063b0f13c0fde2626950a67bfb05a6f
SHA512bfd9652fc052ccc08e0856bd1e56ae8664d249c3a764a47140d42fc933532558ca135b0203bb512d2cda5a584493240c49cdebb4000c667abd13a730c7583e3e
-
Filesize
2.7MB
MD570669b852dd97b804cf2354b04c67042
SHA17b8c9c9a0f3a2814a644489de1f2ed40d6dbd68d
SHA25649afee0943251be58af102839ab22fdf420da25db77574d4c8a951d0d555529d
SHA512c6521e145ad8d614f42336103cd71afc58aeac0961a78537c3b4c9116a26daa45a376b00292956cd91715fdb71c7e9f8d3bddc2ab4f37697ac811db66612161a
-
Filesize
1.8MB
MD59dbcd4d4da05c8ef3fb332a213acd4fb
SHA137c1292289b343462d6c240822914c4a158fc880
SHA2562b315607500ef045245f7f646ec90c1c5ea47f63abe1bb96b7cfd17b61bf0b63
SHA51272ab26f5efc97c1219c13c0ff40d5290b5851514c35ed3069600db41f3e735398950299ebf12df508d6e4e2a835a8842d08b1e2cd02e515a6041735bb4f7a89d
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
3.1MB
MD5065366de9cd0ccac6b7e2dc0f2c5c8bd
SHA140a61570203bf51aa2cc995b184cc117b619ab44
SHA256295373e8416d0e053b5745f47073e17fc342de0246a930469e9cb9de6f740dd5
SHA5123f895156884dc9f9b2d1ef4a4d2162fc82fa58452b5f6cd6ac8db0d88d444854149c532793dce33c7af58f6f5eec24cce67cdb3e26e4dc2b8b59684013072a99