Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 07:55
Static task
static1
Behavioral task
behavioral1
Sample
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe
Resource
win7-20241023-en
General
-
Target
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe
-
Size
1.8MB
-
MD5
6232a1aa692fe2b9f3f8e67d35c7dab7
-
SHA1
87dc7bd254cac48669668a1833c10b8aab3775be
-
SHA256
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f
-
SHA512
c29f2e3b76fe7c2ef81370990b02ee978b81f8ceebb191cc218672184ad7fd5046d8088bcc954f62b05f72255ce15d89c909c99ca3d2ab6d097725d13736300a
-
SSDEEP
49152:P2VKHlPtXQxOpYkv5bhxX84iAMEoatUvyuCy9CIwD:P2mtg4+kvBNKzatUquL9CV
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
mars
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
Processes:
resource yara_rule behavioral2/memory/3056-63-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
Processes:
e7fd92ed15.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" e7fd92ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" e7fd92ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" e7fd92ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" e7fd92ed15.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection e7fd92ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" e7fd92ed15.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe10a4315eb9.exeskotes.exeskotes.exeskotes.exe6103860804.exe930103daed.exee7fd92ed15.exeskotes.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 10a4315eb9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6103860804.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 930103daed.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e7fd92ed15.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Processes:
chrome.exechrome.exechrome.exechrome.exepid process 5776 chrome.exe 2528 chrome.exe 6036 chrome.exe 4872 chrome.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
skotes.exeskotes.exe930103daed.exe10a4315eb9.exea7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe6103860804.exee7fd92ed15.exeskotes.exeskotes.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 930103daed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 10a4315eb9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6103860804.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 930103daed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e7fd92ed15.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6103860804.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 10a4315eb9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e7fd92ed15.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exeskotes.exe6103860804.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 6103860804.exe -
Executes dropped EXE 12 IoCs
Processes:
skotes.exeskotes.exe6103860804.exe930103daed.exe10a4315eb9.exe0cee39ef5d.exee7fd92ed15.exeservice123.exeskotes.exeservice123.exeskotes.exeservice123.exepid process 2012 skotes.exe 3300 skotes.exe 3056 6103860804.exe 4200 930103daed.exe 4996 10a4315eb9.exe 4460 0cee39ef5d.exe 2212 e7fd92ed15.exe 5848 service123.exe 5204 skotes.exe 5836 service123.exe 4628 skotes.exe 3664 service123.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
e7fd92ed15.exea7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exeskotes.exe930103daed.exe10a4315eb9.exeskotes.exeskotes.exeskotes.exe6103860804.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine e7fd92ed15.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine 930103daed.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine 10a4315eb9.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine 6103860804.exe -
Loads dropped DLL 3 IoCs
Processes:
service123.exeservice123.exeservice123.exepid process 5848 service123.exe 5836 service123.exe 3664 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
e7fd92ed15.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features e7fd92ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" e7fd92ed15.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
skotes.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\930103daed.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007613001\\930103daed.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\10a4315eb9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007614001\\10a4315eb9.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0cee39ef5d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007615001\\0cee39ef5d.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e7fd92ed15.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007616001\\e7fd92ed15.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1007615001\0cee39ef5d.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exeskotes.exeskotes.exe6103860804.exe930103daed.exe10a4315eb9.exee7fd92ed15.exeskotes.exeskotes.exepid process 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe 2012 skotes.exe 3300 skotes.exe 3056 6103860804.exe 4200 930103daed.exe 4996 10a4315eb9.exe 2212 e7fd92ed15.exe 5204 skotes.exe 4628 skotes.exe -
Drops file in Windows directory 1 IoCs
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exedescription ioc process File created C:\Windows\Tasks\skotes.job a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3412 3056 WerFault.exe 6103860804.exe -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6103860804.exetaskkill.exea7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exetaskkill.exetaskkill.exetaskkill.exeservice123.exe10a4315eb9.exe930103daed.exeskotes.exetaskkill.exee7fd92ed15.exeschtasks.exe0cee39ef5d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6103860804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10a4315eb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 930103daed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7fd92ed15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cee39ef5d.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6103860804.exefirefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6103860804.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6103860804.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 5 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4468 taskkill.exe 3240 taskkill.exe 760 taskkill.exe 2672 taskkill.exe 3172 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings firefox.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exeskotes.exeskotes.exe6103860804.exe930103daed.exe10a4315eb9.exe0cee39ef5d.exee7fd92ed15.exechrome.exeskotes.exeskotes.exepid process 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe 2012 skotes.exe 2012 skotes.exe 3300 skotes.exe 3300 skotes.exe 3056 6103860804.exe 3056 6103860804.exe 4200 930103daed.exe 4200 930103daed.exe 4996 10a4315eb9.exe 4996 10a4315eb9.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 2212 e7fd92ed15.exe 2212 e7fd92ed15.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 2212 e7fd92ed15.exe 2212 e7fd92ed15.exe 2212 e7fd92ed15.exe 5776 chrome.exe 5776 chrome.exe 5204 skotes.exe 5204 skotes.exe 4628 skotes.exe 4628 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exefirefox.exee7fd92ed15.exechrome.exedescription pid process Token: SeDebugPrivilege 2672 taskkill.exe Token: SeDebugPrivilege 3172 taskkill.exe Token: SeDebugPrivilege 4468 taskkill.exe Token: SeDebugPrivilege 3240 taskkill.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeDebugPrivilege 2344 firefox.exe Token: SeDebugPrivilege 2344 firefox.exe Token: SeDebugPrivilege 2212 e7fd92ed15.exe Token: SeShutdownPrivilege 5776 chrome.exe Token: SeCreatePagefilePrivilege 5776 chrome.exe Token: SeDebugPrivilege 2344 firefox.exe Token: SeDebugPrivilege 2344 firefox.exe Token: SeDebugPrivilege 2344 firefox.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe0cee39ef5d.exefirefox.exechrome.exepid process 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe 5776 chrome.exe -
Suspicious use of SendNotifyMessage 31 IoCs
Processes:
0cee39ef5d.exefirefox.exepid process 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 2344 firefox.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe 4460 0cee39ef5d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 2344 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exeskotes.exe0cee39ef5d.exefirefox.exefirefox.exedescription pid process target process PID 368 wrote to memory of 2012 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe skotes.exe PID 368 wrote to memory of 2012 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe skotes.exe PID 368 wrote to memory of 2012 368 a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe skotes.exe PID 2012 wrote to memory of 3056 2012 skotes.exe 6103860804.exe PID 2012 wrote to memory of 3056 2012 skotes.exe 6103860804.exe PID 2012 wrote to memory of 3056 2012 skotes.exe 6103860804.exe PID 2012 wrote to memory of 4200 2012 skotes.exe 930103daed.exe PID 2012 wrote to memory of 4200 2012 skotes.exe 930103daed.exe PID 2012 wrote to memory of 4200 2012 skotes.exe 930103daed.exe PID 2012 wrote to memory of 4996 2012 skotes.exe 10a4315eb9.exe PID 2012 wrote to memory of 4996 2012 skotes.exe 10a4315eb9.exe PID 2012 wrote to memory of 4996 2012 skotes.exe 10a4315eb9.exe PID 2012 wrote to memory of 4460 2012 skotes.exe 0cee39ef5d.exe PID 2012 wrote to memory of 4460 2012 skotes.exe 0cee39ef5d.exe PID 2012 wrote to memory of 4460 2012 skotes.exe 0cee39ef5d.exe PID 4460 wrote to memory of 2672 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 2672 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 2672 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 3172 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 3172 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 3172 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 4468 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 4468 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 4468 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 3240 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 3240 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 3240 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 760 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 760 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 760 4460 0cee39ef5d.exe taskkill.exe PID 4460 wrote to memory of 836 4460 0cee39ef5d.exe firefox.exe PID 4460 wrote to memory of 836 4460 0cee39ef5d.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 836 wrote to memory of 2344 836 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe PID 2344 wrote to memory of 2312 2344 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe"C:\Users\Admin\AppData\Local\Temp\a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1007612001\6103860804.exe"C:\Users\Admin\AppData\Local\Temp\1007612001\6103860804.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3056 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9fbbcc40,0x7ffa9fbbcc4c,0x7ffa9fbbcc585⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2468,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:25⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1764,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2508 /prefetch:35⤵PID:5384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1964,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2448 /prefetch:85⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:15⤵
- Uses browser remote debugging
PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:15⤵
- Uses browser remote debugging
PID:6036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4352 /prefetch:15⤵
- Uses browser remote debugging
PID:4872
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5848
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 13044⤵
- Program crash
PID:3412
-
-
-
C:\Users\Admin\AppData\Local\Temp\1007613001\930103daed.exe"C:\Users\Admin\AppData\Local\Temp\1007613001\930103daed.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4200
-
-
C:\Users\Admin\AppData\Local\Temp\1007614001\10a4315eb9.exe"C:\Users\Admin\AppData\Local\Temp\1007614001\10a4315eb9.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\1007615001\0cee39ef5d.exe"C:\Users\Admin\AppData\Local\Temp\1007615001\0cee39ef5d.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {725980f8-9c04-42f7-a0d9-7f6537363433} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" gpu6⤵PID:2312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2476 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6520cc39-57c7-4a6e-b7c4-c9b7c1c5c0ef} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" socket6⤵PID:1772
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 2900 -prefMapHandle 2968 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba95d0cc-08bb-4ec4-ad7e-6b6be77c78da} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab6⤵PID:4620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4140 -childID 2 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ac6cc6f-6dad-452e-8bfc-89527bd25d69} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab6⤵PID:3240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8eaa048a-2217-4177-9853-05f07487c03f} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" utility6⤵
- Checks processor information in registry
PID:5260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f341652-4448-4f55-8b9e-51b0cf8a2eaf} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab6⤵PID:5196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5588 -prefMapHandle 5584 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf17edc3-8583-4f08-bbb0-fd1bccea65f7} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab6⤵PID:5208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5372 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf5cdcea-8eec-4054-8655-0461a56d8805} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab6⤵PID:5684
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1007616001\e7fd92ed15.exe"C:\Users\Admin\AppData\Local\Temp\1007616001\e7fd92ed15.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3300
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3056 -ip 30561⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5204
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5836
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3664
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json
Filesize28KB
MD5a694679fa4c8f110247fa5c79ad98f78
SHA12cf65ccf5e250c3850dbfd235d92aaac7e360972
SHA256e0a59410de62c3c9578c18c0bd1fb06f3d12fe0472508ee6b49b4f6379503bed
SHA5128b4e606d33a1085292756c15861d962971db2d6e004578afa90e16ab366b2883f0d55e9a3606b9b4df17a788e0a2d4bf44ffd4e775a7141d300c77f4f1339a7a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Filesize13KB
MD57f128c2acb271fa3fa8986c7ec726ea7
SHA1ec16a6b10dc4ea454a4850f2f13eb12a085548d9
SHA2561516b88659f66678ea9059d4af5fc739514a60acba0037b0f2cf32651726a4e9
SHA5128019d6c997b1f9563eab921cf3a2613fea895c7fdf06e20e607cdfc39985d93d75ea4d2e04b48ec02eb58c3de2c6a7cf944d1249522452d8ecf7f930d9ae60e5
-
Filesize
4.2MB
MD586dce43872ffd26d6225323bf7f0c76f
SHA19bee03858ee62de271b3b29b0144b27892927a13
SHA2562eeba583715e37c4f8632f58d1c49a6d0ef7fdf6815d4bc7593c492a45aca663
SHA5123768ec45560096f81b6071c201a6bb52f19c294051d2399cd77a6a915e91fa4243d031856321cead807a22f8c71c7bb9c4e1cee1bae70d5d4b9c956abddaa290
-
Filesize
1.8MB
MD57a1f4e4b815b73f671f80a09012fe4f6
SHA1e6cee5745cdc3c66d619a3a9721d32884f6eb348
SHA256b5acc9bfb7c8193548ef6d69fde0e68b7645c9fb55a7d13c5fba56becb830358
SHA512f94343417608e824af93ac0e77a0a6ccaa2db0a71c338c0d9a3eff1859d90e3e53a4fdcefeabe3c7da599b0349a595a8291806d688fe0a2f8e0a211e048dd72e
-
Filesize
1.7MB
MD5c543b2872840d40556cb383bd113cb5f
SHA136a4cf336fab929637a23e5a7c541c1397e775cf
SHA2560cf722b0faacd95724ff91530727c4236da45027fe06882f7485c4ea160ebfb7
SHA512f7b57287f27a8119b1d0c8a5ec4afdc751e1b5574125a5ca3bc973108f8ba53c931708589a5c73c2afd358ef8245d30a21dcecdba7ccb6fd0bc038bb5cee853e
-
Filesize
900KB
MD58c0ecab1bfb7b72e454ccb604d9b01b1
SHA18eb0311bfd146d6c4cec42622c4d3001bef548dc
SHA2560676a41db2bebcb07161a3240c0ad432c5e34acf87c305d5fcbc9ca5bf810696
SHA51296befb3937d66841e0e58151f064e79e121429d2d34f217b47ea8e26fdbb6a54507cf23425646a972aee94c4312facbc5a4fcb170594d72c293474dd8d123c51
-
Filesize
2.7MB
MD56ac52e3a9a029fceeb211529a6c15eaa
SHA1943adba70ce4cd0fc3ccf97978da2b5b507dcfeb
SHA256c4d6ec26e110419eeefeb8121f9be4f059a798d3746e40546d32136e5a12e981
SHA5122188b93600af285097bd412b383234719b875a1b45d8246833a496cde4f06c1cc58e31cff4f441bb5b313bbe61e46b7929b2ed288b13aab99164ec4512fe71d6
-
Filesize
1.8MB
MD56232a1aa692fe2b9f3f8e67d35c7dab7
SHA187dc7bd254cac48669668a1833c10b8aab3775be
SHA256a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f
SHA512c29f2e3b76fe7c2ef81370990b02ee978b81f8ceebb191cc218672184ad7fd5046d8088bcc954f62b05f72255ce15d89c909c99ca3d2ab6d097725d13736300a
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Filesize6KB
MD5c6d53ea8c2ffedf3bc5521af9e9fd366
SHA190de8481218e1ced4a10ec2fda7eb026b211a4aa
SHA2567bce12ac5c73d465889b91e4dbfe3b6505d08feae2f25099ccbc122ccf2ca8e6
SHA5129c1f701c6baa7dce08b63e9551a85cf1ed74ffafbe60a47751ed1b8ec69e4354eb5a1a6431baddaf5e55a4d830909e70de54e872fd98dc522052d3c64b921358
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Filesize18KB
MD545e7aa868e933091c75a100feb83375c
SHA121de7dfab3dcf157449580802739af9d4700da3d
SHA256a4ca48a5883f1c8dad5f103fca0048eb359d020c050d7604160b2b1e3cd4ce8a
SHA512ae97f294241c89f0076841377a04d2c5badd867e9a9f6774e3ae6ed0fc3926a1dddeb6076618fbb1aba35654268b1904d46ea2fcc775007b7482877ecc0490fb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
Filesize8KB
MD5f85007d33c83f833d79fe4ce18165d1f
SHA1afed69ff340938d6153d1bd3277874b18655c9c9
SHA256ef56417d8c32b22af7f83171201fc8476f3b4b0f43873dc11846dfbdc01f5736
SHA5121b4b0dba757f77892d29a44833fcfaca1a83c5b6ef62a220035669c0d7b82602a8279e212c37a60e1fc8099f13e9697291368c61bc65676c9b1a74efa231ea0e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5a90ce90014be95d74b23945b2524bd32
SHA12e501aae2dbaa15c80d0e7efe9bef97bcf4f7d21
SHA2561c4e96775c1e7c38d3605cb01c1629f22ee6382183d6e4e387c88f0e217e0d77
SHA5127d0761714e98479cc5775b28263ff14946543f0c51952988eb655537b1fb5c5829015eab1c65d4d601b97488adadcb827c5a4478aa981d17dca8b30b01bfe7f8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5bed4e8f12357dc3a9c0fa5d4efa5f8f4
SHA1ca526b90e45f2340833e589cd2b96196c7167198
SHA256a2db19cd0cfc1bef30f90281b23700628880058ca8f1ab066ba51c46347effad
SHA51292a530e0a0f9930a4575946300c6600356554dd60a430373a19ea6064f124c4e1ad9e877694b199b56770b719f7b9cfe1bcaa5f56e743822bf3aa1d41b8dce4f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD566dd346af2eff336f438445ecdcad289
SHA100a0a3ec1200e37d0cad761cae75145c754a4aa0
SHA256f4f09fb5d602bd1fddc7807e374b37ff18d4094d725537c8835e248cde55cab7
SHA5129d2f020246bb61a37ea75cd762398a5e9be4d7f788a9b99237d6fed3641c0ae06e78a2127b2b2c0f0929ce4d1465c2f20e41a589e9d52bc346bee6f30946674b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\ad17851a-f5ba-4e18-a325-1cc94911fcb1
Filesize671B
MD546a5e10f0d854847a92d02d3f51970bc
SHA14efc35db364c1536dde5bc7d887968d9d7707632
SHA25686c14325a55672607bfe21a440e96430f47c44b40f8a519e84738cf6844502dd
SHA512b7707168bfc007a889bedda5be85313e53a2b6f148055d6be1ef14b36921f4080dc4890b15a1d796c207a6a9fb6b12a474960ac731d8fd854dc0686d0fb2a221
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\cdf0f5b3-7fba-416b-a2da-2fe57636c0db
Filesize27KB
MD5638e19b1b944ee5a0f364a1b67d49c53
SHA16d00afd8f820875519ecd4fa9a0bdda51b63fe1a
SHA256bfbccdc8106d1f42863df9152cee00aad6eb4c8a466c600fed7b1ab4d9e48b22
SHA512844f333953a65bc1c7e1c452cdbe6fc2d54ae60d54613e350a9346b2e410576457c698aed6e430ebfc9d3902be76658da4b6ac2624ac24c2ee255af18155478a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\d7f1ff8e-7fad-435f-a182-a758af696080
Filesize982B
MD579d75f6ebb65d6d1cc13f8a0ebc38cff
SHA1a3dd28e726cdffcb71a2700bb3278dabc3be12a4
SHA2566691c4de0ace219fefe2a5a4068d407f785341b67250de3a36d3af427fcee459
SHA5129aecf59dedb70874ee06ce0a54c9302aa6657cc6a7fe520896a51e5a29cbfbf50de184eb5b5731c3a5aa224feb6c624353804a6ff9bc9d4087bda2640b65a06a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD5e307dbae1440f08c04e98bf05e50fd14
SHA172c7b8bad49debb0546c3c8a04db9b16fd100c91
SHA256acb3210737f4b7606f19dec46223b130bf8a1f86225bf51cd021afc7e3ecb8ee
SHA5120f2e2f50ac9ecf0cb86f5c649f7b93dc78a1ca0e6e269cf7ab2983c859b0fbdc0c434663b76bbe0b310b8f08f9cb14b6068b492975c16dc0c50dd59db1bfd4ee
-
Filesize
15KB
MD51ce8addaff4be2165bed0ccbbfcfb79f
SHA18e8d4e7f815675e21614755bc800b8c5f53e23b2
SHA25636f496d94e3d753b6d995852d58f65a186fffaff68f100d7d822b6bdafdb9c75
SHA512ac7cb861f9e7aa7384dc94c6cfcdff7cc466e8451c93fd193e0032b1e4633fb70b118b731cba750523a1870fb4b82c2004a28d60d6cbce040d43bc5c8c4b9255
-
Filesize
10KB
MD567d67436266e77b1a72099cf39af33ee
SHA108809e0dd61c727589b1647c3c1449f0e24479e8
SHA256e979c04a63d9a93cd0dcb3ecbc0b53fab20176b29831287aa9cc8883b115fddb
SHA5126bb728c17266021750bb60708b1521dd806a905137853fdfc38933f3b14b5c0b7c711def46fe6a0255c2dd48c464a23338bcdd550e7626b26de4b9f9d37616d1
-
Filesize
12KB
MD540bfe356cdb4e388c8f925bb45776213
SHA13571b4e6c5031ea4c3b770a8e3f350325774746e
SHA25694751615df509cc0b020bdca29e64e60ef922c43012aafeb96396364a79032b4
SHA512b60ea35d720c66af617b7cabc07911a89291b9f6e537320d83f2554a73637c858efecb9a75045bdf7c614223852f463b74d5790406923cb517a249d3ac9af8d9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize3.0MB
MD5d905aedeb12af7c414d547b1360c90a6
SHA1a23f3846f07b3e8b38041d596be88181b0778973
SHA2565675b283b39eb9476e4112ab74037841e1bd7320f0228732187bceeacd8fcaf7
SHA5127d7f8d8c9c6fd9f8da6397cc0319907b82120fa8dd7895d457808371efaf4b1583b451136da973815daab61d0b5e849fe949530ee4ac65698ee3b713f15fcf91
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e