Analysis
-
max time kernel
114s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe
Resource
win7-20240903-en
General
-
Target
3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe
-
Size
1.8MB
-
MD5
79acf7954716778b95bce5d7892c2ab3
-
SHA1
434c6dd4b4a6edaadc58e2dcdd0e7011c0735a92
-
SHA256
3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366
-
SHA512
57fd7a9e16bb501ade78a7ddec9ff786d40800e055cba7d0830c7f33f504f32deba9c23a1c0aae7ac64419ffda2d8ea4446af85c2e6eef0e7359799b119c8ebe
-
SSDEEP
24576:9bUrK9XjlfMDRJ0sJ2h7EbPAoGl4UXN47WeG4W8jm4goiI1tLxM2mbDzznPE3U3P:9bpdBMDDlJA+TRmejLxPmbPcuL1lBbr
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
mars
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral2/memory/5820-671-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 69ef8805d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 69ef8805d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 69ef8805d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 69ef8805d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 69ef8805d7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 69ef8805d7.exe -
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4332 created 2852 4332 rh.exe 49 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rh.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2b1a83f255.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8c1efd131a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 69ef8805d7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ baec90ac70.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5816 chrome.exe 736 chrome.exe 5380 chrome.exe 5828 chrome.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2b1a83f255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8c1efd131a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 69ef8805d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion baec90ac70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion baec90ac70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2b1a83f255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 69ef8805d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8c1efd131a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rh.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation baec90ac70.exe -
Executes dropped EXE 13 IoCs
pid Process 1076 skotes.exe 1516 5468191780.exe 4332 rh.exe 380 2b1a83f255.exe 2360 8c1efd131a.exe 4136 8bc5824b0e.exe 2248 skotes.exe 5096 69ef8805d7.exe 5216 Pftmzoi.exe 5820 baec90ac70.exe 5344 bDHVlW2.exe 1652 skotes.exe 5444 service123.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 2b1a83f255.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 8c1efd131a.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 69ef8805d7.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine rh.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine baec90ac70.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine skotes.exe -
Loads dropped DLL 2 IoCs
pid Process 1516 5468191780.exe 5444 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 69ef8805d7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 69ef8805d7.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2b1a83f255.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008575001\\2b1a83f255.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8c1efd131a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008576001\\8c1efd131a.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8bc5824b0e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008577001\\8bc5824b0e.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\69ef8805d7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008578001\\69ef8805d7.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0009000000023bcd-132.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 1076 skotes.exe 4332 rh.exe 380 2b1a83f255.exe 2360 8c1efd131a.exe 2248 skotes.exe 5096 69ef8805d7.exe 5820 baec90ac70.exe 1652 skotes.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1516 set thread context of 4464 1516 5468191780.exe 93 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe -
pid Process 5796 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 5008 1516 WerFault.exe 91 2212 4332 WerFault.exe 104 5984 5820 WerFault.exe 141 -
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1efd131a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b1a83f255.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69ef8805d7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bDHVlW2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8bc5824b0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pftmzoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language baec90ac70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5468191780.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 baec90ac70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString baec90ac70.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 4180 taskkill.exe 2268 taskkill.exe 4284 taskkill.exe 1684 taskkill.exe 736 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings firefox.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 1076 skotes.exe 1076 skotes.exe 4332 rh.exe 4332 rh.exe 4332 rh.exe 4332 rh.exe 4332 rh.exe 4332 rh.exe 3096 svchost.exe 3096 svchost.exe 3096 svchost.exe 3096 svchost.exe 380 2b1a83f255.exe 380 2b1a83f255.exe 2360 8c1efd131a.exe 2360 8c1efd131a.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 2248 skotes.exe 2248 skotes.exe 5096 69ef8805d7.exe 5096 69ef8805d7.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 5096 69ef8805d7.exe 5096 69ef8805d7.exe 5096 69ef8805d7.exe 5796 powershell.exe 5796 powershell.exe 5796 powershell.exe 5820 baec90ac70.exe 5820 baec90ac70.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 1652 skotes.exe 1652 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4180 taskkill.exe Token: SeDebugPrivilege 2268 taskkill.exe Token: SeDebugPrivilege 4284 taskkill.exe Token: SeDebugPrivilege 1684 taskkill.exe Token: SeDebugPrivilege 736 taskkill.exe Token: SeDebugPrivilege 1584 firefox.exe Token: SeDebugPrivilege 1584 firefox.exe Token: SeDebugPrivilege 5096 69ef8805d7.exe Token: SeDebugPrivilege 5796 powershell.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 4136 8bc5824b0e.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe 1584 firefox.exe 1584 firefox.exe 4136 8bc5824b0e.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 1584 firefox.exe 4136 8bc5824b0e.exe 4136 8bc5824b0e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1584 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 1076 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 83 PID 4816 wrote to memory of 1076 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 83 PID 4816 wrote to memory of 1076 4816 3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe 83 PID 1076 wrote to memory of 1516 1076 skotes.exe 91 PID 1076 wrote to memory of 1516 1076 skotes.exe 91 PID 1076 wrote to memory of 1516 1076 skotes.exe 91 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1516 wrote to memory of 4464 1516 5468191780.exe 93 PID 1076 wrote to memory of 4332 1076 skotes.exe 104 PID 1076 wrote to memory of 4332 1076 skotes.exe 104 PID 1076 wrote to memory of 4332 1076 skotes.exe 104 PID 4332 wrote to memory of 3096 4332 rh.exe 106 PID 4332 wrote to memory of 3096 4332 rh.exe 106 PID 4332 wrote to memory of 3096 4332 rh.exe 106 PID 4332 wrote to memory of 3096 4332 rh.exe 106 PID 4332 wrote to memory of 3096 4332 rh.exe 106 PID 1076 wrote to memory of 380 1076 skotes.exe 109 PID 1076 wrote to memory of 380 1076 skotes.exe 109 PID 1076 wrote to memory of 380 1076 skotes.exe 109 PID 1076 wrote to memory of 2360 1076 skotes.exe 111 PID 1076 wrote to memory of 2360 1076 skotes.exe 111 PID 1076 wrote to memory of 2360 1076 skotes.exe 111 PID 1076 wrote to memory of 4136 1076 skotes.exe 112 PID 1076 wrote to memory of 4136 1076 skotes.exe 112 PID 1076 wrote to memory of 4136 1076 skotes.exe 112 PID 4136 wrote to memory of 4180 4136 8bc5824b0e.exe 113 PID 4136 wrote to memory of 4180 4136 8bc5824b0e.exe 113 PID 4136 wrote to memory of 4180 4136 8bc5824b0e.exe 113 PID 4136 wrote to memory of 2268 4136 8bc5824b0e.exe 116 PID 4136 wrote to memory of 2268 4136 8bc5824b0e.exe 116 PID 4136 wrote to memory of 2268 4136 8bc5824b0e.exe 116 PID 4136 wrote to memory of 4284 4136 8bc5824b0e.exe 118 PID 4136 wrote to memory of 4284 4136 8bc5824b0e.exe 118 PID 4136 wrote to memory of 4284 4136 8bc5824b0e.exe 118 PID 4136 wrote to memory of 1684 4136 8bc5824b0e.exe 120 PID 4136 wrote to memory of 1684 4136 8bc5824b0e.exe 120 PID 4136 wrote to memory of 1684 4136 8bc5824b0e.exe 120 PID 4136 wrote to memory of 736 4136 8bc5824b0e.exe 122 PID 4136 wrote to memory of 736 4136 8bc5824b0e.exe 122 PID 4136 wrote to memory of 736 4136 8bc5824b0e.exe 122 PID 4136 wrote to memory of 3404 4136 8bc5824b0e.exe 124 PID 4136 wrote to memory of 3404 4136 8bc5824b0e.exe 124 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 PID 3404 wrote to memory of 1584 3404 firefox.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2852
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
C:\Users\Admin\AppData\Local\Temp\3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe"C:\Users\Admin\AppData\Local\Temp\3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe"C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 10124⤵
- Program crash
PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe"C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 5364⤵
- Program crash
PID:2212
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008575001\2b1a83f255.exe"C:\Users\Admin\AppData\Local\Temp\1008575001\2b1a83f255.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:380
-
-
C:\Users\Admin\AppData\Local\Temp\1008576001\8c1efd131a.exe"C:\Users\Admin\AppData\Local\Temp\1008576001\8c1efd131a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2360
-
-
C:\Users\Admin\AppData\Local\Temp\1008577001\8bc5824b0e.exe"C:\Users\Admin\AppData\Local\Temp\1008577001\8bc5824b0e.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1584 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fc6d938-baee-4bdb-b19c-5777e39eca6c} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" gpu6⤵PID:916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac24e794-ec8a-4cbf-b229-290f74981536} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" socket6⤵PID:3312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2968 -childID 1 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7175724-5410-4d34-a727-a0208cb49077} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab6⤵PID:4772
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3516 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cda1bf25-41cc-4582-a506-79544b06e349} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab6⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4596 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f01223c5-07d1-4444-ba60-4497a72a1389} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" utility6⤵
- Checks processor information in registry
PID:5480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5140 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5236 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b85551b-7b77-4f1a-835b-405084b814f2} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab6⤵PID:5992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61ad1b2c-9f79-432a-9442-be0811cb59ae} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab6⤵PID:6004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {226026d7-c327-4402-84f5-eb3df6cfdfb0} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab6⤵PID:6016
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008578001\69ef8805d7.exe"C:\Users\Admin\AppData\Local\Temp\1008578001\69ef8805d7.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1008579041\x0xqqzB.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
C:\Users\Admin\AppData\Local\Temp\1008581001\Pftmzoi.exe"C:\Users\Admin\AppData\Local\Temp\1008581001\Pftmzoi.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5216
-
-
C:\Users\Admin\AppData\Local\Temp\1008582001\baec90ac70.exe"C:\Users\Admin\AppData\Local\Temp\1008582001\baec90ac70.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5820 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5380 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa047dcc40,0x7ffa047dcc4c,0x7ffa047dcc585⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:25⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1852,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2000 /prefetch:35⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:85⤵PID:5716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:15⤵
- Uses browser remote debugging
PID:5816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:15⤵
- Uses browser remote debugging
PID:5828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4556 /prefetch:15⤵
- Uses browser remote debugging
PID:736
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5444
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 18164⤵
- Program crash
PID:5984
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008583001\bDHVlW2.exe"C:\Users\Admin\AppData\Local\Temp\1008583001\bDHVlW2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1516 -ip 15161⤵PID:528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4332 -ip 43321⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2248
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5820 -ip 58201⤵PID:2272
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
Filesize13KB
MD56623a60b0acdb5fb2ce5e7be21fe87aa
SHA11264cfd75b2f18dd5d184e7734d6f8525ce0fc1c
SHA256838e436e1c2be50025486aab443fef2f169c60ad88eaeaacac0d28fca294f021
SHA5121e56cc85a9f35ebebe5cec200055720cb9f09539b5291bbcffe4f1491b8ae15919abcbd26a3f1dfa4bde482f24f6abf893366a9c01e2c49b00a20bce12cadff2
-
Filesize
649KB
MD5e7aa83909ace3906ec75144cc33e024c
SHA1333ee9d7f4c683d8e0ed05bdadfbd2baade379e3
SHA25624443cd457177eeed9c584e5d5ad194303fd94269fdb0d72e0db598215a5c826
SHA512508fd7984ea8b9d8c8b2cd3c7c3587941a6ee4627c7cf54fe56db7db75dbff0abdaf0db1b0c46876dc6ad0cc21735bd7a2f0351d5edeb735b2de796beef2ea72
-
Filesize
1.9MB
MD54cecb04d97630cc2d5cce80368b87fdd
SHA14f693736497e06c820b91597af84c6fece13408b
SHA25651698570a9c637ec0c9bc2b3ca6acb7edf3d7804c49b8eed33e82573950877dd
SHA512acdf93d12791a6a11b307fbbdc6df2b27a6e8de6b8cc015c4892304d4653e79ac58351600b53c7ea78d285d69df8e8f2e270cf9a168b187d372a3de17e84ec66
-
Filesize
1.8MB
MD589a84eb8a83e3072365849af60f40dcc
SHA10d22977f6a49a60619e8fca8297ef92cab0ce52c
SHA2566e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6
SHA51224c2151099b4bcd7b20c56d6e2267551b58b92714ccdae10163f611987d06bca9049c2154412943b42f7d758fe83179b357846fcde382dd6c3e066828bcb4b42
-
Filesize
1.7MB
MD5f5634fe84a0d50da553341dd8b70f55b
SHA1ee0ce0583edd4b0093709fb1be3aba975e4f7780
SHA25633ec7d97e387a484ca822a25143b5d01ddce8ab813200719537702f0931f9e87
SHA5122211675f740494a7f34971a475281608aeccda6615ec5b709711be3b5e079fa6f64608680ff9ee483c1b2e1a8270c3510c2940a5af4a2563ef12c764ef72dc6c
-
Filesize
900KB
MD5163c161c40d81abcf7762b5fe1e069f9
SHA169abfd5ffb416aba8ec059fd0b10b90a15f1d6e2
SHA256e18eabddf7ffd031c8d469f61ef79a69c7ed5fc4c0b0b083f352306c19a53b1d
SHA512d7aeed672a002d87bc8776e3cbc574e0f336b8152f199cdeeeba845054239f57c3468758205abcd29716e6c4f35a23cbec8a57d93e372b1c9b258d80623e2669
-
Filesize
2.7MB
MD5f2742a9288b543dfd082fe555fc135e7
SHA13324370e94527fcf80ef571f9c1819d59b0b2f23
SHA256dace3504559fca2ba342fa83836e916775514060f4772cdeb263b91906a23d46
SHA5128bcd629e3d52f6f89b068169717d060be2a2fad5230d86e5b1844a3c55d8e0830bf331a92d7f6e1e88f2f8b876823f0d9dfcc77f98f6db1ed86fd8daa1c8ad23
-
Filesize
612B
MD5e3eb0a1df437f3f97a64aca5952c8ea0
SHA17dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA25638ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA51243573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf
-
Filesize
307KB
MD52699448f43fe2a97c2cf07bf56fe92f3
SHA1672e4bdd08082c99ed7adba3799288c22f50338e
SHA256a4ac352fe49d6162961007d64b2ac23413cc5575ea17b61a91f6d808795e994b
SHA5128cb00120efae52c666235edbc33412cbac8e731fd247340ed76b4ca10602532bbf97bb9b81e8af7d348e65598f4847dc59db761afc470c0ee10f1426a564aa9d
-
Filesize
4.2MB
MD5ce1c81d721906475fc878ebd26d09ad4
SHA12fd29c1c343af0ffc67441b448e8a101b7f7854e
SHA256a80ca2e11b0eaa75711ca4b8a002d95f45e8dbaf41101e4dfc52b32ab5d9ddae
SHA512af61993252d78e5da18d4826ba22e3496aebf9a14af715ff7034d9972b577b5ca4d75dfa0fab515e384dec5f74a27a53d4d25d9423500580f74dcd2c1b5be5ff
-
Filesize
243KB
MD5b73ecb016b35d5b7acb91125924525e5
SHA137fe45c0a85900d869a41f996dd19949f78c4ec4
SHA256b3982e67820abc7b41818a7236232ce6de92689b76b6f152fab9ef302528566d
SHA5120bea9890dbcd3afd2889d0e7c0f2746995169e7b424f58d4998c50bc49d2b37d30f5bd1845d3079b25f9963af2b71f136719cbd9fda37f7b85874992096b3e1d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.8MB
MD579acf7954716778b95bce5d7892c2ab3
SHA1434c6dd4b4a6edaadc58e2dcdd0e7011c0735a92
SHA2563bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366
SHA51257fd7a9e16bb501ade78a7ddec9ff786d40800e055cba7d0830c7f33f504f32deba9c23a1c0aae7ac64419ffda2d8ea4446af85c2e6eef0e7359799b119c8ebe
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize6KB
MD5c0d2831bebcdd3e970ffaa1698aaeabd
SHA1367d0865afe75910dc10c5ddb867b881d92febf8
SHA2562a02c72f3b5a1668a8879de9e147683a0a2507a6a0b07a910fdb538d3ff4bc5e
SHA512f324ddf5f51a9cf9adc1e61930493969c47b3f4e5e92250f44c7a097b1a7c01852985671740488999b87b3e86b205f23d07b87e71f7166c5efdacc092c31294d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
Filesize6KB
MD5453dc57ff540ce6696e80c295a19af43
SHA100deb4b71228bddd6dd13dfb1cd58ac0adf10ad2
SHA2567b25015c02eed19a0d0391dc47b88e0c735e6a201b20a2fc8959efd88ed63740
SHA51243811f72bc2b233cc0c9e083f8207f105c464382d703d0c9c271566e43513b032104206c9848e5a8b6e9c39aa7a19f4ba37c1c4c23a87335c73fa34d1c054c1e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5c89ae25bbd5bf468dcc262217714caa5
SHA12ca42d4962c7734665fcea4452a299ebab4fee9f
SHA256c94add620161a4d2edcbfec108352c1bc23ee8625181bdf8a5c3f6d1c8ca01d2
SHA5123b6888133598329723b3b59119c31faeeab61792dfd595e2f5c927ab45aba245df9196e8dc78ed4b6454886bbe805e553a0ed7ef3fd1e7709ce8302b062f1a9f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5186601dabd95e19c42dbbce3875ec0fa
SHA188f31940c9115fe544992c13e5ea4c28c1508ad0
SHA256585caa5393ddefc649a43bd7c85b8177bc80ee192837214bb94b9d1e04ff481b
SHA512f409d9b4877475c61d0a68bfefa6ebfa085934529d7914d560ba3d2b2d1e433c8c99ca9aa78c0435f24a654757b69d37d3ddcc23061b87b65844a219645ebb61
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize25KB
MD57d7a7fdcf333c63c8f77d61cee93669e
SHA146900646d7c52152c82c06ba57fa1ebbc052ab1e
SHA256f03626aa33fd49dbccfa6f9642b43357d9289574615433e61c8b50ff09b4ebad
SHA512c57a9f2bd4c3c62b1bc28da45b3b76ab472af8ffd4ecfdd69dbf15735edafaa7be88c7ec8148450d1b4222c95b2d463837caca530a70a1fafa32441a657271f7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD558057185e06fd1142441fbdbb0885c84
SHA154850f10b3eb7409fbb572664196b2e54715ede7
SHA256c944a3b8896328a36a505a9a62c5f3b4c96ff66e85c1a6c43195ddde9271bff0
SHA512e71de507c25662e74e78f0a59f5d491bc892bcd7e85d6ae082761a793347c4ef44040cfe6da57a88e1a854f0f18b0d0296cbea54846d438a5fe762eed03a0b60
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5b0d99d467313e78f41fa3f988dedce22
SHA11dee575276dd52d2bb799607a8eae8e36a4cf294
SHA2561a9670031e91ff843f309e52d25b648ad038059842b7ba210329d2f69dd21cb2
SHA5129d1932ac093e874f47da7e121efd3ce0133c8c0d5b8bfbe192072313e6726af8efa6659dcf8c0719ab24c8f37bd06f57426a2cf0ffa3fbbfdea225339b30d110
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\6814b9b9-68fd-4461-86c0-1cc735c4dee7
Filesize659B
MD5adc77c5c3304b8d04c5b582e9c68d77b
SHA1fd896b3838bb0476b3bfd4c5ed694ffdb7357a04
SHA2566627cbfa6445f38580e8b14ae0b7ac7f225055c53180e87e612cfda262d51d20
SHA51293737d744d6506bd7a1aff4bbae76e207ec961e896b98b14abcdcd30ae51266fba41d0ac84f92885998ec161f94d43490ac930d6be0d56cac81c5a073b409501
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\8a7b5b5c-1e79-493b-a87c-8b5589affbb5
Filesize982B
MD50ed05981ee29c4c647e868ca23919d83
SHA1b02206584d6836f0509f86c0502134ff5436a52c
SHA2568140e5a5bb99840a2d91ee982515b703e4fc60114a292989ef65848c269a420e
SHA512240228d087e636a68aa85c954b175d442682e58a93beafaf9674a3214b5a13b77158c7c50d906f709ca18a14a7e36613741320be246e886c4c8503ad65f280d9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD5a433d713272a17669089cc0492aacd18
SHA1dd594b0fd1c06be46e5609f3df2f298daadaa01d
SHA2563bb3d016015b3beda081ed5522a6913890c4d49b7641ef6f35db4d15b22c75fe
SHA512f25155cc5dfed99bf48388b0f1cdf09c91107f75f84e8dd67beed4a6abcaed87627682c381f26dd23849bd2031995a3f6f26238eb99bb74b7cbdf4f353e19c14
-
Filesize
14KB
MD59b65e831d6c778808be0f8a64bdba940
SHA180812314fe87b8ee4984bf5253de7b44d4d1e95f
SHA25630271711ba4a7402c2b089643add3bdcf189aae9c18b0df9bdce7501ba3a583a
SHA512faec60e4b5c0890e4360116b71ffad57972359bb5eeb882acd6ad57fa6aef71d952f89e127aa5f429a77f06949202e7fac34a0049ec7cf09dbb21842abe5869e
-
Filesize
10KB
MD56ab2fbb7f446cb8e8f2cfa1a979699f4
SHA19a84173e9e6632773b52a088be43c618e88389f2
SHA2569b7cd1db78c5ff9a0a89b474445b2eedbc156dae2d04c64ac20adb721c301087
SHA512b361b8498cd228164cb9b7815809e9fe0f86c3dfa9f0ce4fc2e31e0e23f5462b88568c61c265f3421aaa13684ac81f64696c19791a228a2efee933656c8e5776
-
Filesize
10KB
MD5d6cf7c81a644dd57b682b2f512bb446a
SHA1f537cf3003e75caea618e555986d8ded09fc3c6c
SHA2562ab8c490b65f146af82fcbe1e8bd2ce94f2acf617ccaf8c5f45c74e855588ee9
SHA5129f2825b1d06f3f5700633f13ff26d5a819fc8b2fa40c5d12996518b244396c1e97d54efa804564f20c010cfc4272041b8c41fd2700ddd7400002270a3d18d3f5
-
Filesize
10KB
MD52eff18b969286db0c513981efe6d4229
SHA1b1b74fbb489ba45cd3626c3b5875dad1db2a294c
SHA2562a9db7507688d5999534a798aade495b3155a546f1d446e1e86481a7d5dbd33a
SHA512678e178076cc2151ba6c854608c912cdf63a0c77cc9e23a72b2adad5881c0a70ee357269da5892599c4cbd1f94eca0cb14479cb36b1289ae9a185830a75410f5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize912KB
MD50f1bb510579ca1a8a694b2a8bd4ee584
SHA1742905e0f3750e90be75ffc5eba3b31b5ec6e379
SHA256f91fc1932a647f0cb51420a22f51b2183abaaf5d2182ae98da1fc4eec1b1dd5f
SHA512487dcb158adc4d2b53fafe1351c7b617440970cd20f197a6df07d894e121a6e63087a1a78b748a26e8d4a08ef821694e0c03a5ac3aa4fdceff89648023670375
-
Filesize
401KB
MD53535fcd3063a2965f1dd8f9b65ca8355
SHA11f5c89caf911a08415d55ce1687101b65871b122
SHA256086057602eec63ed064bd97c1643b20c727aa4a557d16bd26a763716414620fe
SHA5129b623500ffbe25d6dc08c3c90aeb8c123e9fc2841f0962b6fe57ca1d2ab44fb1062352e1d5ab1d506b156c0b25aaf96ca6267a36fd064c97c12df965bcd66929