Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/11/2024, 09:24
General
- Target 94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe
- Size 1.8MB
- Sample241124-lc6xtatmay
- SHA256 94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7
Malware Config
Extracted
-
amadey
-
5.04
-
4bee07
-
http://185.215.113.209
-
install_dir
fc9e0aaab7
-
install_file
defnur.exe
-
strings_key
191655f008adc880f91bfc85bc56db54
-
url_paths
/Fru7Nk9/index.php
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
-
stealc
-
mars
-
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Cryptbot family
- Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Checks BIOS information in registry 2 TTPs 30 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 22 IoCs
- Identifies Wine through registry keys 2 TTPs 15 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 5 IoCs
- Modifies registry class 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 59 IoCs
- Suspicious use of SendNotifyMessage 31 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe"C:\Users\Admin\AppData\Local\Temp\94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10006070101\game.exe"C:\Users\Admin\AppData\Local\Temp\10006070101\game.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O1M08.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O1M08.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\M9m81.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\M9m81.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1U37p9.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1U37p9.exe6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1008713001\2b7a1bac6d.exe"C:\Users\Admin\AppData\Local\Temp\1008713001\2b7a1bac6d.exe"8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"9⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe6e11cc40,0x7ffe6e11cc4c,0x7ffe6e11cc5810⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,9526122418059354389,1572185710656601101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1800 /prefetch:210⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1908,i,9526122418059354389,1572185710656601101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2060 /prefetch:310⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,9526122418059354389,1572185710656601101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:810⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,9526122418059354389,1572185710656601101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:110⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3256,i,9526122418059354389,1572185710656601101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3444 /prefetch:110⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4444,i,9526122418059354389,1572185710656601101,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3732 /prefetch:110⤵
- Uses browser remote debugging
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f9⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 18049⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008718001\59f6892333.exe"C:\Users\Admin\AppData\Local\Temp\1008718001\59f6892333.exe"8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1008719001\49c0bec9e0.exe"C:\Users\Admin\AppData\Local\Temp\1008719001\49c0bec9e0.exe"8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1008720001\aec07fb7ab.exe"C:\Users\Admin\AppData\Local\Temp\1008720001\aec07fb7ab.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking9⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking10⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04f6ff72-17d7-404a-a2a8-5b0810ed3ba0} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" gpu11⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef2b5b4d-b712-49e4-afa9-a0c38ffb0913} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" socket11⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3204 -childID 1 -isForBrowser -prefsHandle 2832 -prefMapHandle 2996 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ee938ea-4e02-4a37-8ed6-4df687465ba5} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" tab11⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -childID 2 -isForBrowser -prefsHandle 4164 -prefMapHandle 4160 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95430f69-a56b-4d3a-abfc-e3a80c635f00} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" tab11⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4748 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4028 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb9dc5e5-b945-4715-b8ae-856562bbc44d} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" utility11⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b20ff1a1-e3a2-4d2e-8a60-e318bf97f1ec} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" tab11⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50264c18-2857-44f3-abab-5196ba5cac2c} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" tab11⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4fa99ca-cb1e-4648-836a-6569e4d17d47} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" tab11⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008721001\ed7f9093fe.exe"C:\Users\Admin\AppData\Local\Temp\1008721001\ed7f9093fe.exe"8⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2y9598.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2y9598.exe6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3y27e.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3y27e.exe5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y227q.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y227q.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10006170101\6ab6ff1532.exe"C:\Users\Admin\AppData\Local\Temp\10006170101\6ab6ff1532.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\kreon.exeC:\Users\Admin\AppData\Local\kreon.exe6⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exeC:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 46561⤵
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exeC:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
SCT Auditing Pending Reports
activity-stream.discovery_stream.json
39DB9E847E680B765D7B04FCCE6BF5BC0225F878
game.exe
6ab6ff1532.exe
2b7a1bac6d.exe
59f6892333.exe
49c0bec9e0.exe
aec07fb7ab.exe
ed7f9093fe.exe
4y227q.exe
O1M08.exe
3y27e.exe
M9m81.exe
1U37p9.exe
2y9598.exe
defnur.exe
tmpaddon
tmpaddon-1
AlternateServices.bin
data.safe.bin
data.safe.bin
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
1da2fad8-2c34-417d-aa65-833a087c9eee
44791e0b-bbde-4878-9e3f-47b7c298cbed
d8484d2b-056d-401a-9dfd-2d33701ac6c9
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
clip64.dll
memory/500-84-0x0000000000E40000-0x00000000012CB000-memory.dmp
memory/500-82-0x0000000000E40000-0x00000000012CB000-memory.dmp
memory/644-138-0x00000000009E0000-0x0000000000E5D000-memory.dmp
memory/644-211-0x00000000009E0000-0x0000000000E5D000-memory.dmp
memory/952-3431-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-222-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-24-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-18-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-22-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-3436-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-122-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-83-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-21-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-3440-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-20-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-23-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-1070-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-19-0x0000000000241000-0x000000000026F000-memory.dmp
memory/952-1291-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-3422-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-1046-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-25-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-3024-0x0000000000240000-0x0000000000701000-memory.dmp
memory/952-2109-0x0000000000240000-0x0000000000701000-memory.dmp
memory/1000-64-0x00000000009F0000-0x0000000000E8E000-memory.dmp
memory/1000-77-0x00000000009F0000-0x0000000000E8E000-memory.dmp
memory/1164-213-0x0000000000C80000-0x00000000012FC000-memory.dmp
memory/1164-207-0x0000000000C80000-0x00000000012FC000-memory.dmp
memory/2616-2-0x00000000007F1000-0x000000000081F000-memory.dmp
memory/2616-17-0x00000000007F0000-0x0000000000CB1000-memory.dmp
memory/2616-0-0x00000000007F0000-0x0000000000CB1000-memory.dmp
memory/2616-4-0x00000000007F0000-0x0000000000CB1000-memory.dmp
memory/2616-3-0x00000000007F0000-0x0000000000CB1000-memory.dmp
memory/2616-1-0x0000000077A24000-0x0000000077A26000-memory.dmp
memory/3220-174-0x0000000000240000-0x0000000000701000-memory.dmp
memory/3220-176-0x0000000000240000-0x0000000000701000-memory.dmp
memory/4448-88-0x00000000003C0000-0x0000000000A42000-memory.dmp
memory/4448-90-0x00000000003C0000-0x0000000000A42000-memory.dmp
memory/4656-270-0x0000000000B70000-0x00000000017A5000-memory.dmp
memory/4656-173-0x0000000000B70000-0x00000000017A5000-memory.dmp
memory/4656-1061-0x0000000000B70000-0x00000000017A5000-memory.dmp
memory/4656-112-0x0000000000B70000-0x00000000017A5000-memory.dmp
memory/4656-1085-0x0000000000B70000-0x00000000017A5000-memory.dmp
memory/4656-139-0x0000000069CC0000-0x000000006A71B000-memory.dmp
memory/4656-1112-0x0000000000B70000-0x00000000017A5000-memory.dmp
memory/4860-111-0x0000000000760000-0x0000000000A12000-memory.dmp
memory/4860-186-0x0000000000760000-0x0000000000A12000-memory.dmp
memory/4860-110-0x0000000000760000-0x0000000000A12000-memory.dmp
memory/4860-94-0x0000000000760000-0x0000000000A12000-memory.dmp
memory/4860-166-0x0000000000760000-0x0000000000A12000-memory.dmp
memory/5008-1062-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-3421-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-3443-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-3439-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-190-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-3435-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-113-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-3428-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-277-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-1515-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-1091-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-78-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-2559-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5008-89-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5088-165-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5088-149-0x0000000000370000-0x000000000080E000-memory.dmp
memory/5764-1049-0x0000000000710000-0x00000000009CE000-memory.dmp
memory/5764-1075-0x0000000000710000-0x00000000009CE000-memory.dmp
memory/5764-1072-0x0000000000710000-0x00000000009CE000-memory.dmp
memory/5764-1047-0x0000000000710000-0x00000000009CE000-memory.dmp
memory/5764-1048-0x0000000000710000-0x00000000009CE000-memory.dmp
memory/6204-1423-0x0000000072F90000-0x00000000730C4000-memory.dmp
memory/6204-1422-0x0000000000C50000-0x0000000000C62000-memory.dmp
memory/6408-3202-0x0000000000370000-0x000000000080E000-memory.dmp
memory/6408-3227-0x0000000000370000-0x000000000080E000-memory.dmp
memory/6612-3282-0x0000000000240000-0x0000000000701000-memory.dmp
memory/6612-3245-0x0000000000240000-0x0000000000701000-memory.dmp
memory/6960-3294-0x0000000000C50000-0x0000000000C62000-memory.dmp