Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 17:10
Static task
static1
Behavioral task
behavioral1
Sample
8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe
Resource
win7-20241023-en
General
-
Target
8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe
-
Size
1.7MB
-
MD5
af00fae5bf606001c0c6ef0b98fb54d0
-
SHA1
a24fe73ec0b2d0190d3f6f068ca3c13a6cde4fd3
-
SHA256
8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881
-
SHA512
e08d6691ed7092e2f569391ef89c6b3528630ff449372b064e06ebde2e7de482517e7407c81ce75a190d74936c64a0c31f5acc23efeffe6f54622184f780a5bc
-
SSDEEP
24576:fVIhhuGqyQIrSITgOIubNQb6KAnOMK0HKKEfbULhQmo1936905EnoK5RLSEzqt9v:uh8IrZhrO2KAnOMg5fbULhQmo19Cnqb
Malware Config
Extracted
stealc
mars
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ DocumentsCBAKEBGIID.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ L.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f41a9f7f21.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e37a8cbe0c.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2840 chrome.exe 1720 chrome.exe 2148 chrome.exe 1992 chrome.exe -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DocumentsCBAKEBGIID.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion L.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DocumentsCBAKEBGIID.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion L.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f41a9f7f21.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f41a9f7f21.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e37a8cbe0c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e37a8cbe0c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Executes dropped EXE 6 IoCs
pid Process 2044 DocumentsCBAKEBGIID.exe 304 skotes.exe 972 L.exe 2944 f41a9f7f21.exe 3020 e37a8cbe0c.exe 2968 e596fca876.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine DocumentsCBAKEBGIID.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine L.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine f41a9f7f21.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine e37a8cbe0c.exe -
Loads dropped DLL 9 IoCs
pid Process 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 1392 cmd.exe 2044 DocumentsCBAKEBGIID.exe 304 skotes.exe 304 skotes.exe 304 skotes.exe 304 skotes.exe 304 skotes.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\f41a9f7f21.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007977001\\f41a9f7f21.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\e37a8cbe0c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007978001\\e37a8cbe0c.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000018744-256.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2044 DocumentsCBAKEBGIID.exe 304 skotes.exe 972 L.exe 2944 f41a9f7f21.exe 3020 e37a8cbe0c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job DocumentsCBAKEBGIID.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DocumentsCBAKEBGIID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language L.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f41a9f7f21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e37a8cbe0c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e596fca876.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
pid Process 1528 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 L.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a L.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a L.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 f41a9f7f21.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a f41a9f7f21.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2840 chrome.exe 2840 chrome.exe 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 2044 DocumentsCBAKEBGIID.exe 304 skotes.exe 972 L.exe 2944 f41a9f7f21.exe 3020 e37a8cbe0c.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeShutdownPrivilege 2840 chrome.exe Token: SeDebugPrivilege 1528 taskkill.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2840 chrome.exe 2044 DocumentsCBAKEBGIID.exe 2968 e596fca876.exe 2968 e596fca876.exe 2968 e596fca876.exe 2968 e596fca876.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2968 e596fca876.exe 2968 e596fca876.exe 2968 e596fca876.exe 2968 e596fca876.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2840 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 31 PID 2596 wrote to memory of 2840 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 31 PID 2596 wrote to memory of 2840 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 31 PID 2596 wrote to memory of 2840 2596 8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe 31 PID 2840 wrote to memory of 2716 2840 chrome.exe 32 PID 2840 wrote to memory of 2716 2840 chrome.exe 32 PID 2840 wrote to memory of 2716 2840 chrome.exe 32 PID 2840 wrote to memory of 2724 2840 chrome.exe 33 PID 2840 wrote to memory of 2724 2840 chrome.exe 33 PID 2840 wrote to memory of 2724 2840 chrome.exe 33 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1712 2840 chrome.exe 35 PID 2840 wrote to memory of 1060 2840 chrome.exe 36 PID 2840 wrote to memory of 1060 2840 chrome.exe 36 PID 2840 wrote to memory of 1060 2840 chrome.exe 36 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37 PID 2840 wrote to memory of 1664 2840 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe"C:\Users\Admin\AppData\Local\Temp\8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7399758,0x7fef7399768,0x7fef73997783⤵PID:2716
-
-
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:23⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:83⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:83⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1716 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:23⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3300 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1364,i,8889634613395827153,4151293459216280605,131072 /prefetch:83⤵PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsCBAKEBGIID.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Users\Admin\DocumentsCBAKEBGIID.exe"C:\Users\Admin\DocumentsCBAKEBGIID.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:304 -
C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe"C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\1007977001\f41a9f7f21.exe"C:\Users\Admin\AppData\Local\Temp\1007977001\f41a9f7f21.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\1007978001\e37a8cbe0c.exe"C:\Users\Admin\AppData\Local\Temp\1007978001\e37a8cbe0c.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\1007979001\e596fca876.exe"C:\Users\Admin\AppData\Local\Temp\1007979001\e596fca876.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2968 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1764
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Authentication Process
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
1.8MB
MD5fa351b72ffb13bfc332a25a57a7f075f
SHA15af49613c179bed23dd43d76aedbe3d1b63004a3
SHA256d2c90431f09fc7818c5afb43bbec077fc29544ddcb786bc655a82d1c33e20cdc
SHA512de49eeaa695f9d6252bd3b547689b0e648999c7ee68d2e16a3d073d88505a1c6b0a4da538db7ce52653bfc2dc89a13dd07c894f8e28f9227f1d1c92df67216f9
-
Filesize
1.8MB
MD5bb5bd15bd6fcfcbfa94ebdb27f489f48
SHA12f4d12e5ae29e43bbb2c7e6ce0c6348634ef891d
SHA2565b2589c815563a4ec9032d33073e2d899b6773889f61b6dacf9a3f84e000c29c
SHA5122555d35677599be6cc6e427250c3024344f2f2d4cb5153fa1ebe4d62d6594ab750251e66cc5458ee9c5694eea87b2f9f9ae308b32cd7c7c080d5db94bd7017ae
-
Filesize
1.7MB
MD570c58ce5ae24e8f18ea008f6d533b24e
SHA175a22fe28d864d32c5cd6c76dde6ab1c268830fd
SHA256a42c422324648c42f01725b9c5b20472d731c8df713f015cc815c6be67cf2d21
SHA51251793b5545da639cfc1b89b605276a8cdefa0164505e34c910dfb487f07c3c1c6450e2b722dc9c7576ed7720e096e3bd590ad0d7c4df607fc4ee56e6e0b994ec
-
Filesize
900KB
MD5da0d65dda08f1df2f4bbc6482b792fb2
SHA1ea5ce8044060cd1dd16b3978bfadc787a67d363d
SHA2564e27a5bd4a0789adcf14a62b7aa06281d38b6efe653cb22f3e16902ad5af21e9
SHA51294d67284f99de4962bda71c4e39354ef169f8dd810628a5b82474ce47b2d083eb94d85ddfa34f725272579178a819e9724391baad2a97732d16561309c75dfd2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.9MB
MD53204e7adeb4d554e74b4aeb310cc5939
SHA18a2a99bd088af5024c5b18f6cec3e7ec6cb460bc
SHA2565e25eba0727eb361d518125ef6bad9f834d4c7d91d35edb4b93ee0decaca6c12
SHA512699307161af2ce71c6ad91f7347383cd45872e0de2492db2586a09fe7d2bb5bbca7757b7f2b2c4b89a30a1023d1812b29e937d7ebb606b43b502047b030a8f43
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571