Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 15:44
Static task
static1
Behavioral task
behavioral1
Sample
cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe
Resource
win7-20240903-en
General
-
Target
cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe
-
Size
1.8MB
-
MD5
d9bf05f3bf682e7c95d0136e4216e6cc
-
SHA1
5eb0cabe2885edab4a013910bb99050fc4da44e5
-
SHA256
cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092
-
SHA512
8058ef00561a519006b29919f13ec33c40778bb597dbdc7c50883098121bb60fba5d057dbe8c2256781cdeca4eb1f3f2eb9b87a77a90cd0f926bab4b3997bdc5
-
SSDEEP
49152:E1iCrKHOhnumz+5Ag5ItMm9lM+cIPCkuCnkBJC:Zru5umz7AItMmPekuCyw
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
lumma
https://scriptyprefej.store
https://navygenerayk.store
https://founpiuer.store
https://necklacedmny.store
https://thumbystriw.store
https://fadehairucw.store
https://crisiwarny.store
https://presticitpo.store
Signatures
-
Amadey family
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 317f477c78.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 39ce341609.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 317f477c78.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 317f477c78.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 39ce341609.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 39ce341609.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation axplong.exe -
Executes dropped EXE 5 IoCs
pid Process 3668 axplong.exe 4624 317f477c78.exe 3692 39ce341609.exe 2880 axplong.exe 752 axplong.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 317f477c78.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine 39ce341609.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine axplong.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\39ce341609.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002682001\\39ce341609.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\317f477c78.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002681001\\317f477c78.exe" axplong.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe 3668 axplong.exe 4624 317f477c78.exe 3692 39ce341609.exe 2880 axplong.exe 752 axplong.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 317f477c78.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39ce341609.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe 3668 axplong.exe 3668 axplong.exe 4624 317f477c78.exe 4624 317f477c78.exe 3692 39ce341609.exe 3692 39ce341609.exe 2880 axplong.exe 2880 axplong.exe 752 axplong.exe 752 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3668 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe 85 PID 3492 wrote to memory of 3668 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe 85 PID 3492 wrote to memory of 3668 3492 cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe 85 PID 3668 wrote to memory of 4624 3668 axplong.exe 89 PID 3668 wrote to memory of 4624 3668 axplong.exe 89 PID 3668 wrote to memory of 4624 3668 axplong.exe 89 PID 3668 wrote to memory of 3692 3668 axplong.exe 95 PID 3668 wrote to memory of 3692 3668 axplong.exe 95 PID 3668 wrote to memory of 3692 3668 axplong.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe"C:\Users\Admin\AppData\Local\Temp\cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\1002681001\317f477c78.exe"C:\Users\Admin\AppData\Local\Temp\1002681001\317f477c78.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\1002682001\39ce341609.exe"C:\Users\Admin\AppData\Local\Temp\1002682001\39ce341609.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3692
-
-
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2880
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5fe83cbc9270910772b2028f38444bb7f
SHA1b9a3fd9e948b88a25c4c588c6e01fb3bd129902b
SHA256d541c198374d012b7c58b1231b78818194dda9f43e8758df7b2a2e723f97b86b
SHA512d1e3dbae8dfef1dd0689e37471277de47a35c8e102bf44b7be931231e94b1faa6f5803f9cb1fc8ada2792531f48c761375bd2199b267a0ad97bcfef7adf3e06b
-
Filesize
3.0MB
MD5fad8a273ed15c30e16c4ba0c776a9727
SHA1eedf4978cb6cfb020c1f0cc552c2ad2cf238c72c
SHA256e38cb6ed4b58f8b2f61d3ca1f11385dbcc184b948c88ada6b68c0763a2ef31c9
SHA5126c6f034c5b2541999be44d6c85edc0babfef513300ef223238691cd9c0f66f035db41016429db7df67fc9e2a1fae0be9afd8bcf3cebdb5fe2f5fc308497013e4
-
Filesize
1.8MB
MD5d9bf05f3bf682e7c95d0136e4216e6cc
SHA15eb0cabe2885edab4a013910bb99050fc4da44e5
SHA256cf7d6b41b9462dbdffdeaaa8fabe978cb6beb4ef7c99e21cd863c5c6edd49092
SHA5128058ef00561a519006b29919f13ec33c40778bb597dbdc7c50883098121bb60fba5d057dbe8c2256781cdeca4eb1f3f2eb9b87a77a90cd0f926bab4b3997bdc5