Malware Analysis Report

2024-12-07 15:39

Sample ID 241113-ykymma1qbp
Target c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a
SHA256 c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a
Tags
amadey 9c9aa5 discovery evasion execution persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a

Threat Level: Known bad

The file c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a was found to be: Known bad.

Malicious Activity Summary

amadey 9c9aa5 discovery evasion execution persistence spyware stealer trojan

Amadey family

Amadey

Modifies Windows Defender Real-time Protection settings

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Identifies Wine through registry keys

Drops startup file

Loads dropped DLL

Windows security modification

Executes dropped EXE

Checks BIOS information in registry

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

Browser Information Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 19:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 19:51

Reported

2024-11-13 19:53

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mkhu.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\544e48f777.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006039001\\544e48f777.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ab27552f50.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006040001\\ab27552f50.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ee0bb02284.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006042001\\ee0bb02284.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A

Browser Information Discovery

discovery

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3544 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3544 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3544 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2076 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe
PID 2076 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe
PID 2076 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe
PID 2076 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe
PID 2076 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe
PID 2076 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe
PID 2076 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe
PID 2076 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe
PID 2076 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2076 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2076 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2076 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe
PID 2076 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe
PID 2076 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe
PID 3728 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3728 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 3036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1824 wrote to memory of 732 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe

"C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe

"C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe"

C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe

"C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe"

C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe

"C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe

"C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=544e48f777.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2b0f46f8,0x7fff2b0f4708,0x7fff2b0f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=544e48f777.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2b0f46f8,0x7fff2b0f4708,0x7fff2b0f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mkhu.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe'; $s.Save()"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3247729891146912341,8059381008971184773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
BG 87.120.125.254:80 87.120.125.254 tcp
US 8.8.8.8:53 254.125.120.87.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 133.174.67.172.in-addr.arpa udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.206:80 185.215.113.206 tcp
US 8.8.8.8:53 206.113.215.185.in-addr.arpa udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 learn.microsoft.com udp
GB 95.100.246.21:443 learn.microsoft.com tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 21.246.100.95.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
NL 13.69.109.131:443 browser.events.data.microsoft.com tcp
NL 13.69.109.131:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 131.109.69.13.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
BG 87.120.125.16:9891 tcp
US 8.8.8.8:53 16.125.120.87.in-addr.arpa udp
US 8.8.8.8:53 102.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/3544-0-0x0000000000DB0000-0x00000000010B9000-memory.dmp

memory/3544-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmp

memory/3544-2-0x0000000000DB1000-0x0000000000E19000-memory.dmp

memory/3544-3-0x0000000000DB0000-0x00000000010B9000-memory.dmp

memory/3544-4-0x0000000000DB0000-0x00000000010B9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

MD5 ed91fed1365af41a389141266378cfc8
SHA1 fdaa4dddc18c04adb903505acdd71d71eee8fc68
SHA256 c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a
SHA512 c145bad5f5946e715c6b322d5b531dc80202a8ecdbea33a53d21c3a4a4120039deecb33e3c8fb62dd28300080701c28fb1aabdc0718336abd668ee298c4cde51

memory/3544-19-0x0000000000DB1000-0x0000000000E19000-memory.dmp

memory/3544-18-0x0000000000DB0000-0x00000000010B9000-memory.dmp

memory/2076-16-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2076-20-0x0000000000F11000-0x0000000000F79000-memory.dmp

memory/2076-21-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2076-22-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2076-23-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2076-24-0x0000000000F11000-0x0000000000F79000-memory.dmp

memory/2076-25-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2076-26-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2076-27-0x0000000000F10000-0x0000000001219000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe

MD5 b56761ad16c0e1cdd4765a130123dbc2
SHA1 fc50b4fd56335d85bbaaf2d6f998aad037428009
SHA256 095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd
SHA512 26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

C:\Users\Admin\AppData\Local\Temp\1006039001\544e48f777.exe

MD5 2eb7dd5fc174ea7ce691ba15a1e34ba4
SHA1 4287676addcd538c2f5f975b6f2a9e8a415f2b37
SHA256 6094e39d84c42971e1efba0875fa34052dc3d2cd24f8b884b383aaaf32fe3cec
SHA512 b98cde63c0678552966025db56a15cf211d8d79513bd9a928bfee11909490aba53ceb1135cf88647196e079430bbd878828091840ebf822251f01f4c776a4e4a

memory/3728-61-0x0000000000860000-0x0000000000B6C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006040001\ab27552f50.exe

MD5 f8d1d73a4b017ae508ee5172f7601906
SHA1 6feb8b7fa058b1f818ea2b2485b8435d87b218c6
SHA256 4688b875a5efc11c995747658f96f517bf06631e4ab4a1c05d0718abdc33e5fe
SHA512 1365b7dda13edae170c5022828edcfd708f5378d8fc83ba07433a2094e7137c1fdf47e18bf387d481ae2610b3ce13eacd8e6e9fcb63b4423f39536c4bd631e7a

memory/2076-70-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/3656-78-0x0000000000370000-0x00000000009FF000-memory.dmp

memory/3656-79-0x0000000000370000-0x00000000009FF000-memory.dmp

memory/3980-80-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/3728-83-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-82-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-107-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-111-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-113-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-112-0x0000000000860000-0x0000000000B6C000-memory.dmp

memory/3728-110-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-109-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-108-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-106-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-104-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-103-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-102-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-101-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-99-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-97-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-96-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-95-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-94-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-92-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-91-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-90-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-105-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-100-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-114-0x0000000000860000-0x0000000000B6C000-memory.dmp

memory/3728-98-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-93-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-89-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-115-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-116-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-117-0x0000000006660000-0x000000000691A000-memory.dmp

memory/3728-118-0x0000000006660000-0x000000000691A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006042001\ee0bb02284.exe

MD5 39307db79b786d76d1b6070fec77bc0b
SHA1 54546d19873479cff3fc1ba00a77c9433612c8d6
SHA256 c6051a76f472b570bf9eb2a80faa638d370e415f0c7904ba4c4c044d673db69b
SHA512 0da1eee41b9dd08c85f8809427e30bff86da2f811f5be29d0aefb951b377408b0a4899b25efd6d9f24d3c69be193a8adc465d18590d6f81a8df865fc68a75125

memory/1116-137-0x0000000000070000-0x000000000032A000-memory.dmp

memory/1116-138-0x0000000000070000-0x000000000032A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

\??\pipe\LOCAL\crashpad_1824_OHWGTMJEQRGGDICN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

memory/2076-156-0x0000000000F10000-0x0000000001219000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 408766c3c7e3ceb5e7ad116951f6943e
SHA1 c8c3c084a203c8d8c41ea3cf1a9772673bd6ae8f
SHA256 cb3df97c94164dbd2a93f1261ef0ed777344412afa4a1cbad46805a069346a39
SHA512 88c867a89e21793fee3870824b9e55d6c547ae13e84b6ad8585b02c5ef8b1411a3fb02aba41e47eebe8dcdf216ebaac77fd8a591182ac5f85ce442a7b92c56de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3728-202-0x0000000000860000-0x0000000000B6C000-memory.dmp

memory/1596-203-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/1596-204-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/1116-205-0x0000000000070000-0x000000000032A000-memory.dmp

memory/1116-213-0x0000000000070000-0x000000000032A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e72a6c33989483a8b8f8b630ee6faf77
SHA1 cc338ec2dff3614c91575c949a9d356fcb9847a7
SHA256 6357821c655728cd390d873d0ce4fd72aaf35bbcfb9d5193df91c3bfb68b80f1
SHA512 d9abf03c82a760823d10bd6c5a2325ee7f3671f2e156be2da9a16496cb3ec3326bb92dfb56a6a4f843d6af1fbe0970d3a2aba31a0b552a8de93b7538c6c890f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 38da8925d976a421e740fd5164d4d207
SHA1 16387344cfa7d61c56e95f01b05ede9ebf99adf9
SHA256 0fa777aca2e313f684bece5a2fd3767e9f3caf8974e8dce396c4f3e1fb0e9a94
SHA512 61f70aa2df15fb1e056d15bd74f1392c9ca11027b450f90ded85751cdec9ef6e20e0a55a3d7be011d947d8710993ade0de30fc600c896c494784ab0924170f5b

memory/2076-228-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/3980-235-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/3728-269-0x0000000000860000-0x0000000000B6C000-memory.dmp

memory/3728-243-0x0000000006660000-0x000000000691A000-memory.dmp

memory/5732-305-0x0000028BD46C0000-0x0000028BD46E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4i3gxadu.5c3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 aadde1665dc74296822790cf5fcd80e7
SHA1 dccebd987bd8971f63f4746197e44a9a9092c059
SHA256 7e0fb32c7ec1530fcce9bff490ce0c1b2122babab8264a9a8cc8e5ee35bd934f
SHA512 266fb92d59e2f63c879f79dd1b53b4e50e0c35879c5289606ddc89e3460292f09dc4f397389fbb79208e27465023848be4d5f2444304b38d12ee4b7786ee1caf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 95b8484415812b080354550acbfa6632
SHA1 7831b37ce6ec994aeb18f1115b0ed5d185b1803e
SHA256 8e89a2533d5197e0c66584f3cdaa361b9af9bd2ad34fa342ea1a8c06b351b2cd
SHA512 9286701f9be787b35df8b16d54e72a6246eb8a94846d4a9f4b888ad2ca38af4f3c6db926df8dcc5397086b4bb5b428575e3e4721a120b69daa7d2160d81eb19e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5887d8.TMP

MD5 f72e32de4938a9a02fbe782e5ddf0fcf
SHA1 78a19d82035ffa6e455be134e6874fd64e3e9a1d
SHA256 f28267624dafe18b43fd64b4b56646cfcabf80cfe7c2a6cf915a191f854966a8
SHA512 e0cc42205b0a50b7c85c9fa026fb4f744f144584120fd2ca5942c6fb1c0e410ea49bb06c8c5501bfdc627ab1f5d45e35eddc07b59ce301e0383b73f7794bb494

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dc1d9ec92ec1944d047555d87fba2dc9
SHA1 76a4e166963e214526a1623a3f31f1b3b7773dbf
SHA256 5bfe82b4092906a859038d76cad8ccf525e47708a9cbf22620412eb42f397f34
SHA512 958a4218736d192dfda0efb54713dee5a8e49a4d6c5af6f06616f4480ec7f80f106e0ecf05f2cc158d104bb3c2a76dad181e3062d217c36ebae3d2db69d0d40a

memory/2092-379-0x0000000000F10000-0x0000000001219000-memory.dmp

memory/2092-381-0x0000000000F10000-0x0000000001219000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 19:51

Reported

2024-11-13 19:53

Platform

win7-20240729-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\95e66e336f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006039001\\95e66e336f.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\f30658ca88.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006040001\\f30658ca88.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\f9f2fe77e6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006042001\\f9f2fe77e6.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2604 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2604 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2604 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2668 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe
PID 2668 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe
PID 2668 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe
PID 2668 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe
PID 2668 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe
PID 2668 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe
PID 2668 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe
PID 2668 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe
PID 2668 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe
PID 2668 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe
PID 2668 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe
PID 2668 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe
PID 2668 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2668 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2668 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2668 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2668 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe
PID 2668 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe
PID 2668 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe
PID 2668 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe

"C:\Users\Admin\AppData\Local\Temp\c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe

"C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe"

C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe

"C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe"

C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe

"C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe

"C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe"

Network

Country Destination Domain Proto
RU 185.215.113.43:80 185.215.113.43 tcp
BG 87.120.125.254:80 87.120.125.254 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
RU 185.215.113.206:80 185.215.113.206 tcp

Files

memory/2604-0-0x0000000000F30000-0x0000000001239000-memory.dmp

memory/2604-1-0x00000000770D0000-0x00000000770D2000-memory.dmp

memory/2604-2-0x0000000000F31000-0x0000000000F99000-memory.dmp

memory/2604-3-0x0000000000F30000-0x0000000001239000-memory.dmp

memory/2604-5-0x0000000000F30000-0x0000000001239000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

MD5 ed91fed1365af41a389141266378cfc8
SHA1 fdaa4dddc18c04adb903505acdd71d71eee8fc68
SHA256 c399da828c92ddf5858f839b584084927f5576ab15f842f3acbd840a89df638a
SHA512 c145bad5f5946e715c6b322d5b531dc80202a8ecdbea33a53d21c3a4a4120039deecb33e3c8fb62dd28300080701c28fb1aabdc0718336abd668ee298c4cde51

memory/2668-18-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2604-17-0x0000000007180000-0x0000000007489000-memory.dmp

memory/2604-14-0x0000000000F30000-0x0000000001239000-memory.dmp

memory/2604-16-0x0000000000F31000-0x0000000000F99000-memory.dmp

memory/2668-19-0x0000000000A51000-0x0000000000AB9000-memory.dmp

memory/2668-20-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-22-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-23-0x0000000000A50000-0x0000000000D59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006034001\mk.exe

MD5 b56761ad16c0e1cdd4765a130123dbc2
SHA1 fc50b4fd56335d85bbaaf2d6f998aad037428009
SHA256 095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd
SHA512 26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

memory/2668-39-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-41-0x0000000000A51000-0x0000000000AB9000-memory.dmp

memory/2668-40-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-42-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-43-0x0000000000A50000-0x0000000000D59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006039001\95e66e336f.exe

MD5 2eb7dd5fc174ea7ce691ba15a1e34ba4
SHA1 4287676addcd538c2f5f975b6f2a9e8a415f2b37
SHA256 6094e39d84c42971e1efba0875fa34052dc3d2cd24f8b884b383aaaf32fe3cec
SHA512 b98cde63c0678552966025db56a15cf211d8d79513bd9a928bfee11909490aba53ceb1135cf88647196e079430bbd878828091840ebf822251f01f4c776a4e4a

memory/2668-60-0x00000000067D0000-0x0000000006ADC000-memory.dmp

memory/2668-59-0x00000000067D0000-0x0000000006ADC000-memory.dmp

memory/2096-62-0x00000000013B0000-0x00000000016BC000-memory.dmp

memory/2096-64-0x00000000013B0000-0x00000000016BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006040001\f30658ca88.exe

MD5 f8d1d73a4b017ae508ee5172f7601906
SHA1 6feb8b7fa058b1f818ea2b2485b8435d87b218c6
SHA256 4688b875a5efc11c995747658f96f517bf06631e4ab4a1c05d0718abdc33e5fe
SHA512 1365b7dda13edae170c5022828edcfd708f5378d8fc83ba07433a2094e7137c1fdf47e18bf387d481ae2610b3ce13eacd8e6e9fcb63b4423f39536c4bd631e7a

memory/2396-82-0x00000000012F0000-0x000000000197F000-memory.dmp

memory/2668-81-0x00000000067D0000-0x0000000006E5F000-memory.dmp

memory/2668-83-0x00000000067D0000-0x0000000006E5F000-memory.dmp

memory/2668-84-0x00000000067D0000-0x0000000006ADC000-memory.dmp

memory/2396-85-0x00000000012F0000-0x000000000197F000-memory.dmp

memory/2668-88-0x0000000006170000-0x0000000006479000-memory.dmp

memory/2668-90-0x00000000067D0000-0x0000000006ADC000-memory.dmp

memory/1876-89-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/2668-91-0x0000000000A50000-0x0000000000D59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006042001\f9f2fe77e6.exe

MD5 39307db79b786d76d1b6070fec77bc0b
SHA1 54546d19873479cff3fc1ba00a77c9433612c8d6
SHA256 c6051a76f472b570bf9eb2a80faa638d370e415f0c7904ba4c4c044d673db69b
SHA512 0da1eee41b9dd08c85f8809427e30bff86da2f811f5be29d0aefb951b377408b0a4899b25efd6d9f24d3c69be193a8adc465d18590d6f81a8df865fc68a75125

memory/2668-104-0x00000000067D0000-0x0000000006A8A000-memory.dmp

memory/2084-106-0x0000000000EC0000-0x000000000117A000-memory.dmp

memory/2084-107-0x0000000000EC0000-0x000000000117A000-memory.dmp

memory/2084-108-0x0000000000EC0000-0x000000000117A000-memory.dmp

memory/2668-109-0x00000000067D0000-0x0000000006E5F000-memory.dmp

memory/2668-110-0x00000000067D0000-0x0000000006E5F000-memory.dmp

memory/2668-111-0x0000000006170000-0x0000000006479000-memory.dmp

memory/2668-113-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-114-0x00000000067D0000-0x0000000006A8A000-memory.dmp

memory/2084-116-0x0000000000EC0000-0x000000000117A000-memory.dmp

memory/2084-118-0x0000000000EC0000-0x000000000117A000-memory.dmp

memory/1876-120-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/1876-130-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/2668-131-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-132-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-133-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-134-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-135-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-136-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-137-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-138-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-139-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-140-0x0000000000A50000-0x0000000000D59000-memory.dmp

memory/2668-141-0x0000000000A50000-0x0000000000D59000-memory.dmp