amadey | e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

3.1MB
MD5

5cc43c13e14113d07197871708ba3d6a
SHA1

3fd30c8b2df49f949086aa654ca67e67bc963a08
SHA256

e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2
SHA512

515ca57618a4e09eaafe432e8a345f712d29488b97cc3b88299179694c1facb0a61c5bbc019e14481ee6b2258b531a0d5d4eff9ae187404e01451ed12ef5bb02
SSDEEP

49152:rvlYcKpLjavBk95yL7Po+Yamr9EuBlKJUqq/yNXlxwPw:rv6vgv295yL7Po+w9EuBIuqr5w

Score

10^/10

amadey lumma 397a17 9c9aa5 discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

5.04

Botnet

397a17

http://89.110.69.103

http://94.156.177.33

Attributes

install_dir
0efeaab28d
install_file
Gxtuum.exe
strings_key
6dea7a0890c1d404d1b67c90aea6ece4
url_paths
/Lv2D7fGdopb/index.php

/b9kdj3s3C0/index.php

rc4.plain

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://infect-crackle.cyou/api

Extracted

Family

lumma

https://infect-crackle.cyou/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	word.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	word.exe

Executes dropped EXE 10 IoCs

pid	Process
3520	skotes.exe
632	skotes.exe
2892	qtmPs7h.exe
4460	word.exe
1532	skotes.exe
3228	word.exe
392	word.exe
4720	vector.exe
2328	skotes.exe
4492	vector.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\word.exe"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4812	file.exe
3520	skotes.exe
632	skotes.exe
1532	skotes.exe
2328	skotes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 3792	4460	word.exe	112
PID 4720 set thread context of 4492	4720	vector.exe	120

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qtmPs7h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3608	PING.EXE
332	cmd.exe
4672	PING.EXE
4704	PING.EXE
832	cmd.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3608	PING.EXE
4672	PING.EXE
4704	PING.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4812	file.exe
4812	file.exe
3520	skotes.exe
3520	skotes.exe
632	skotes.exe
632	skotes.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
2892	qtmPs7h.exe
4460	word.exe
4460	word.exe
4460	word.exe
4460	word.exe
4460	word.exe
1532	skotes.exe
1532	skotes.exe
4460	word.exe
3228	word.exe
392	word.exe
392	word.exe
392	word.exe
4460	word.exe
4460	word.exe
2328	skotes.exe
2328	skotes.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	qtmPs7h.exe
Token: SeDebugPrivilege	4460	word.exe
Token: SeDebugPrivilege	3228	word.exe
Token: SeDebugPrivilege	392	word.exe
Token: SeDebugPrivilege	4720	vector.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4812	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3520	4812	file.exe	83
PID 4812 wrote to memory of 3520	4812	file.exe	83
PID 4812 wrote to memory of 3520	4812	file.exe	83
PID 3520 wrote to memory of 2892	3520	skotes.exe	98
PID 3520 wrote to memory of 2892	3520	skotes.exe	98
PID 3520 wrote to memory of 2892	3520	skotes.exe	98
PID 2892 wrote to memory of 832	2892	qtmPs7h.exe	99
PID 2892 wrote to memory of 832	2892	qtmPs7h.exe	99
PID 2892 wrote to memory of 832	2892	qtmPs7h.exe	99
PID 832 wrote to memory of 3608	832	cmd.exe	101
PID 832 wrote to memory of 3608	832	cmd.exe	101
PID 832 wrote to memory of 3608	832	cmd.exe	101
PID 2892 wrote to memory of 332	2892	qtmPs7h.exe	102
PID 2892 wrote to memory of 332	2892	qtmPs7h.exe	102
PID 2892 wrote to memory of 332	2892	qtmPs7h.exe	102
PID 332 wrote to memory of 4672	332	cmd.exe	104
PID 332 wrote to memory of 4672	332	cmd.exe	104
PID 332 wrote to memory of 4672	332	cmd.exe	104
PID 832 wrote to memory of 4412	832	cmd.exe	105
PID 832 wrote to memory of 4412	832	cmd.exe	105
PID 832 wrote to memory of 4412	832	cmd.exe	105
PID 332 wrote to memory of 4704	332	cmd.exe	109
PID 332 wrote to memory of 4704	332	cmd.exe	109
PID 332 wrote to memory of 4704	332	cmd.exe	109
PID 332 wrote to memory of 4460	332	cmd.exe	110
PID 332 wrote to memory of 4460	332	cmd.exe	110
PID 332 wrote to memory of 4460	332	cmd.exe	110
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 1080	4460	word.exe	111
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3792	4460	word.exe	112
PID 4460 wrote to memory of 3228	4460	word.exe	115
PID 4460 wrote to memory of 3228	4460	word.exe	115
PID 4460 wrote to memory of 3228	4460	word.exe	115
PID 3228 wrote to memory of 392	3228	word.exe	116
PID 3228 wrote to memory of 392	3228	word.exe	116
PID 3228 wrote to memory of 392	3228	word.exe	116
PID 3792 wrote to memory of 4720	3792	AddInProcess32.exe	118
PID 3792 wrote to memory of 4720	3792	AddInProcess32.exe	118
PID 3792 wrote to memory of 4720	3792	AddInProcess32.exe	118
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120
PID 4720 wrote to memory of 4492	4720	vector.exe	120

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
    "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3608
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4412
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:332
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4672
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4704
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        6⤵
        
        PID:1080
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\word.exe
        
        "C:\Users\Admin\AppData\Local\Temp\word.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\word.exe
        
        "C:\Users\Admin\AppData\Local\Temp\word.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:392

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:632

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1532

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\word.exe.log

Filesize
1KB

MD5
7dca233df92b3884663fa5a40db8d49c

SHA1
208b8f27b708c4e06ac37f974471cc7b29c29b60

SHA256
90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c

SHA512
d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe

Filesize
5.0MB

MD5
b183e5ff29a1532a84e5a38983ab9e4e

SHA1
230c9cbd2e14598aaf73ae78c85c998a6b923a51

SHA256
81a45f430c102365b46c663203ae5708b6befe2848f01efc7b702aff7170c901

SHA512
31be2761821fb6bc81a010a3f68fa6901aa5e9768e9c57db53b52e0495c7340abccc9191500aa39540fef159578403e78d2af31ac364b89774d5f359b54c6c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe

Filesize
2.5MB

MD5
d1e3f88d0caf949d5f1b4bf4efbb95a4

SHA1
61ffd2589a1965bf9cb874833c4c9b106b3e43e8

SHA256
c505f3b2f40b8a68e7cacfe2a9925498ab0f7ef29aa7023bb472597021066b2e

SHA512
5d4c43e858371f24ebafb56388a586c081d7b0289a3b039dbb2b011e9864e8e9f5dc7037fcb3e88f4bec4259a09ce5f3ccdae3161b43dff140e0e4ca7bff96c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe

Filesize
799KB

MD5
89bd66e4285cb7295300a941964af529

SHA1
232d9fee67a3c3652a80e1c1a258f0d789c6a6cf

SHA256
a46bf8412717f75bf098966cb1f5074836e78f5699bb5073dcc45d59ca790047

SHA512
72d1c8c4b74bacca619a58062441203c6cfea81d064dc1933af7a3cb9758d924b011a6935e8d255aad58159a4ecbb3677cc6a6e80f6daa8b135711195a5c8498

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.1MB

MD5
5cc43c13e14113d07197871708ba3d6a

SHA1
3fd30c8b2df49f949086aa654ca67e67bc963a08

SHA256
e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2

SHA512
515ca57618a4e09eaafe432e8a345f712d29488b97cc3b88299179694c1facb0a61c5bbc019e14481ee6b2258b531a0d5d4eff9ae187404e01451ed12ef5bb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\word.exe

Filesize
76KB

MD5
0e362e7005823d0bec3719b902ed6d62

SHA1
590d860b909804349e0cdc2f1662b37bd62f7463

SHA256
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

SHA512
518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\word.txt

Filesize
91B

MD5
75c9d4081f90a161c01274a67b25231e

SHA1
e2f4cbbb6d2ca1f9b15232e307f69500ab57ae37

SHA256
7a3aba005d78ddbe38c2b6e8796d1f874a706269b0e1c086dca50335bfef914b

SHA512
156a8e68f393b4fe12976f273281cf1b24f696d594221bb5b4004d0025c9d2f81f1caca5393556ff59e92475b4a34c9e9dc9ebbd64349cec926f49e08c938eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\word.txt

Filesize
90B

MD5
2b66cdfcd847bd893e3d57e4ab115e5f

SHA1
0109bee865339cc72ac14c2e489fc0d0056c69d7

SHA256
ef7c0c23bf94e5ca215b2011c25ebf539cadb6b23eb202e8924ccac95f5524d9

SHA512
0ec313d82c55ecc55605a06b52a8edde6d3870e9eb091c9699b9c7982deaa08cf2f03c0abb69b288ec8d940ea024ac4ac33638d71f3f5f6c3e9ffd23e2fbf177

Download Submit
memory/632-28-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/632-26-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/632-24-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/632-25-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/1532-74-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/1532-73-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/2328-138-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/2892-58-0x0000000005860000-0x000000000586A000-memory.dmp

Filesize
40KB

Download
memory/2892-57-0x00000000053B0000-0x00000000053D6000-memory.dmp

Filesize
152KB

Download
memory/2892-56-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/2892-55-0x0000000005920000-0x0000000005EC4000-memory.dmp

Filesize
5.6MB

Download
memory/2892-54-0x00000000052B0000-0x000000000534C000-memory.dmp

Filesize
624KB

Download
memory/2892-53-0x0000000000E40000-0x0000000000F0E000-memory.dmp

Filesize
824KB

Download
memory/3228-93-0x0000000000E70000-0x0000000000E8A000-memory.dmp

Filesize
104KB

Download
memory/3520-102-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-71-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-33-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-32-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-31-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-30-0x0000000000A61000-0x0000000000AC9000-memory.dmp

Filesize
416KB

Download
memory/3520-29-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-60-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-63-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-140-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-139-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-34-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-70-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-112-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-22-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-21-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-75-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-76-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-113-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-16-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-135-0x0000000000A60000-0x0000000000D73000-memory.dmp

Filesize
3.1MB

Download
memory/3520-20-0x0000000000A61000-0x0000000000AC9000-memory.dmp

Filesize
416KB

Download
memory/3792-81-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3792-132-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3792-80-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3792-122-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3792-77-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4460-69-0x0000000007340000-0x0000000007346000-memory.dmp

Filesize
24KB

Download
memory/4460-68-0x0000000007320000-0x000000000733A000-memory.dmp

Filesize
104KB

Download
memory/4460-67-0x0000000000BE0000-0x0000000000CAE000-memory.dmp

Filesize
824KB

Download
memory/4492-146-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4492-143-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4720-142-0x00000000057F0000-0x0000000005812000-memory.dmp

Filesize
136KB

Download
memory/4720-141-0x0000000005BA0000-0x0000000005D30000-memory.dmp

Filesize
1.6MB

Download
memory/4720-134-0x0000000000D10000-0x0000000000F92000-memory.dmp

Filesize
2.5MB

Download
memory/4812-2-0x00000000005D1000-0x0000000000639000-memory.dmp

Filesize
416KB

Download
memory/4812-1-0x00000000778F4000-0x00000000778F6000-memory.dmp

Filesize
8KB

Download
memory/4812-19-0x00000000005D1000-0x0000000000639000-memory.dmp

Filesize
416KB

Download
memory/4812-18-0x00000000005D0000-0x00000000008E3000-memory.dmp

Filesize
3.1MB

Download
memory/4812-0-0x00000000005D0000-0x00000000008E3000-memory.dmp

Filesize
3.1MB

Download
memory/4812-4-0x00000000005D0000-0x00000000008E3000-memory.dmp

Filesize
3.1MB

Download
memory/4812-3-0x00000000005D0000-0x00000000008E3000-memory.dmp

Filesize
3.1MB

Download