Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 02:32
Static task
static1
Behavioral task
behavioral1
Sample
3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe
Resource
win7-20241010-en
General
-
Target
3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe
-
Size
3.1MB
-
MD5
a19f8447cc5cc3bd266c8e1098c5ffff
-
SHA1
0f2afa44f46aab7cdeaaf5ca6d7a32a2541fdf62
-
SHA256
3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42
-
SHA512
d7e7b44479f9252ada8a5a8cad9a111b973142e664c4d6884109e6b93c1c309af961316fc8ea0f1817e35edababc1bbf626983e60e3919c1a966f2d91c60431e
-
SSDEEP
98304:zzupfV2d3Tosj77+wHkl26vg7pSNXuoX:/upfV2A26vgyXtX
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Gcleaner family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection f293999935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" f293999935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" f293999935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" f293999935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" f293999935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" f293999935.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ab874c52f0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f293999935.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b064225619.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ab874c52f0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f293999935.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b064225619.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b064225619.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ab874c52f0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f293999935.exe -
Executes dropped EXE 5 IoCs
pid Process 2932 skotes.exe 2748 ab874c52f0.exe 2140 0d19e6f4c1.exe 668 f293999935.exe 3164 b064225619.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine f293999935.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine b064225619.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine ab874c52f0.exe -
Loads dropped DLL 10 IoCs
pid Process 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 2932 skotes.exe 2932 skotes.exe 2932 skotes.exe 2932 skotes.exe 2932 skotes.exe 2932 skotes.exe 2932 skotes.exe 3164 b064225619.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" f293999935.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features f293999935.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\f293999935.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013589001\\f293999935.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ab874c52f0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013587001\\ab874c52f0.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\0d19e6f4c1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013588001\\0d19e6f4c1.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00050000000195ff-60.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 2932 skotes.exe 2748 ab874c52f0.exe 668 f293999935.exe 3164 b064225619.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d19e6f4c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 0d19e6f4c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f293999935.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab874c52f0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 0d19e6f4c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b064225619.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 2332 taskkill.exe 3020 taskkill.exe 740 taskkill.exe 2196 taskkill.exe 804 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 2932 skotes.exe 2748 ab874c52f0.exe 2140 0d19e6f4c1.exe 668 f293999935.exe 2140 0d19e6f4c1.exe 668 f293999935.exe 668 f293999935.exe 3164 b064225619.exe 3164 b064225619.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2196 taskkill.exe Token: SeDebugPrivilege 804 taskkill.exe Token: SeDebugPrivilege 2332 taskkill.exe Token: SeDebugPrivilege 3020 taskkill.exe Token: SeDebugPrivilege 740 taskkill.exe Token: SeDebugPrivilege 1260 firefox.exe Token: SeDebugPrivilege 1260 firefox.exe Token: SeDebugPrivilege 668 f293999935.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 1260 firefox.exe 1260 firefox.exe 1260 firefox.exe 1260 firefox.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 1260 firefox.exe 1260 firefox.exe 1260 firefox.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe 2140 0d19e6f4c1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2932 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 30 PID 2036 wrote to memory of 2932 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 30 PID 2036 wrote to memory of 2932 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 30 PID 2036 wrote to memory of 2932 2036 3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe 30 PID 2932 wrote to memory of 2748 2932 skotes.exe 33 PID 2932 wrote to memory of 2748 2932 skotes.exe 33 PID 2932 wrote to memory of 2748 2932 skotes.exe 33 PID 2932 wrote to memory of 2748 2932 skotes.exe 33 PID 2932 wrote to memory of 2140 2932 skotes.exe 34 PID 2932 wrote to memory of 2140 2932 skotes.exe 34 PID 2932 wrote to memory of 2140 2932 skotes.exe 34 PID 2932 wrote to memory of 2140 2932 skotes.exe 34 PID 2140 wrote to memory of 2196 2140 0d19e6f4c1.exe 35 PID 2140 wrote to memory of 2196 2140 0d19e6f4c1.exe 35 PID 2140 wrote to memory of 2196 2140 0d19e6f4c1.exe 35 PID 2140 wrote to memory of 2196 2140 0d19e6f4c1.exe 35 PID 2140 wrote to memory of 804 2140 0d19e6f4c1.exe 38 PID 2140 wrote to memory of 804 2140 0d19e6f4c1.exe 38 PID 2140 wrote to memory of 804 2140 0d19e6f4c1.exe 38 PID 2140 wrote to memory of 804 2140 0d19e6f4c1.exe 38 PID 2140 wrote to memory of 2332 2140 0d19e6f4c1.exe 40 PID 2140 wrote to memory of 2332 2140 0d19e6f4c1.exe 40 PID 2140 wrote to memory of 2332 2140 0d19e6f4c1.exe 40 PID 2140 wrote to memory of 2332 2140 0d19e6f4c1.exe 40 PID 2140 wrote to memory of 3020 2140 0d19e6f4c1.exe 42 PID 2140 wrote to memory of 3020 2140 0d19e6f4c1.exe 42 PID 2140 wrote to memory of 3020 2140 0d19e6f4c1.exe 42 PID 2140 wrote to memory of 3020 2140 0d19e6f4c1.exe 42 PID 2140 wrote to memory of 740 2140 0d19e6f4c1.exe 44 PID 2140 wrote to memory of 740 2140 0d19e6f4c1.exe 44 PID 2140 wrote to memory of 740 2140 0d19e6f4c1.exe 44 PID 2140 wrote to memory of 740 2140 0d19e6f4c1.exe 44 PID 2140 wrote to memory of 2868 2140 0d19e6f4c1.exe 46 PID 2140 wrote to memory of 2868 2140 0d19e6f4c1.exe 46 PID 2140 wrote to memory of 2868 2140 0d19e6f4c1.exe 46 PID 2140 wrote to memory of 2868 2140 0d19e6f4c1.exe 46 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 2868 wrote to memory of 1260 2868 firefox.exe 47 PID 1260 wrote to memory of 1800 1260 firefox.exe 48 PID 1260 wrote to memory of 1800 1260 firefox.exe 48 PID 1260 wrote to memory of 1800 1260 firefox.exe 48 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 PID 1260 wrote to memory of 1276 1260 firefox.exe 49 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe"C:\Users\Admin\AppData\Local\Temp\3b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1013587001\ab874c52f0.exe"C:\Users\Admin\AppData\Local\Temp\1013587001\ab874c52f0.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\1013588001\0d19e6f4c1.exe"C:\Users\Admin\AppData\Local\Temp\1013588001\0d19e6f4c1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:740
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.0.658384673\422578491" -parentBuildID 20221007134813 -prefsHandle 1272 -prefMapHandle 1264 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02237df6-7e51-4ad2-8353-0fce9ed728cd} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 1344 46d7d58 gpu6⤵PID:1800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.1.1246651981\1176650638" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e058c5f3-8ee4-4f2a-b3a9-178c79f141f6} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 1532 e73958 socket6⤵PID:1276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.2.1087269529\1737857276" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c50b2fce-fb0c-4c72-8c96-8db3b2ea9280} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 2104 18f67658 tab6⤵PID:2120
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.3.1900501274\1639394285" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87c3af72-fefc-454f-b759-f8389f130e3d} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 2912 1bcf0d58 tab6⤵PID:1684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.4.1805016858\1949374279" -childID 3 -isForBrowser -prefsHandle 3856 -prefMapHandle 3816 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b06ccc89-b9f4-401a-9808-f77e5adf4ff4} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 3876 20191358 tab6⤵PID:2364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.5.1698241147\1430215984" -childID 4 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {989f8579-a0f8-4752-9c3a-3d80e1ae0ea7} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 3976 2162b958 tab6⤵PID:2428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1260.6.777155896\2031154639" -childID 5 -isForBrowser -prefsHandle 4080 -prefMapHandle 4084 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 708 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6a48b78-0796-4f87-99bb-f5007ddcf504} 1260 "\\.\pipe\gecko-crash-server-pipe.1260" 3856 20192858 tab6⤵PID:1612
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013589001\f293999935.exe"C:\Users\Admin\AppData\Local\Temp\1013589001\f293999935.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Users\Admin\AppData\Local\Temp\1013590001\b064225619.exe"C:\Users\Admin\AppData\Local\Temp\1013590001\b064225619.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp
Filesize32KB
MD5dfa4c21cfccf9ed4a70892d2955df049
SHA16f8beec14311421675e41705d0972d17624319a3
SHA256cb9167317b26fa0141064b70c7ed079cfd47d7ed558750cc415c8853554cdc79
SHA51260dfd1a7715943a0ed7446ed0f83516bb1b32fb03b0c2e23bd52caa6ac475186f9d2e79a148b8e53d699d35e9e5bce23c2edb7e081dbaa51ee67c6797aa9faec
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.7MB
MD59083cdf00ff3295432676d6ee4c6c9f4
SHA12f83025aaf303478fb07cf9fd9630ca3874e6163
SHA25622a7b5fc61cf54485bd374a221386b1c2675f7eb4b1428677ff86b3add14238e
SHA512b1a3bd15d30dc60e6aa3bd027e39be463a7f026815f66b84a44bc93cb1b89e42211b5352b5cc44e2e46c7fa9f43f6d888c9678fa6cbe7679e2d8f1be35d8d942
-
Filesize
949KB
MD5b5811acb833a790513d5baab884cf1f7
SHA1a0b5690a5cbc8dfec6a0f6355ca3c4cc4890efc7
SHA25665378c55edffc59d371243cc8bb2f44def33e5f317993032189eb31b4ecf02bf
SHA5129668f726715d489acb1c57440ffa6c4bab4acb352c6f3f67115e2ec6b1e0b4d00ba4e41b062d596a872eea20e9f4702b2579c1a91c11e388fb9207b5f7c7db21
-
Filesize
2.7MB
MD554ac54d599adabb8aa9403177cdb635c
SHA1031afc5a647a7bd0379f277b819a35137a00fc79
SHA2567bd295999c86a6d00f670bee17c926ebddf85a7de84a93d9f944363bc3de96ee
SHA5120d92aa49fb0cbe67969604d8d1c09cc32d39c093d7f19a1d21cf0bd4a17cf6c8a80f28575c07995c573410e810625bdddd39e2e851aaea8b255c42dd3222d311
-
Filesize
1.9MB
MD52e19a105ae94d5cfdba8166af58f7a3e
SHA1398ec17fa4b03728c4c48c6d2e6f99e01ff78a63
SHA256c4a16bac6cdc5735e1bbb57c7f4c300e35a4c2f617c85585d17ac5a55a875383
SHA512181d6bec6fe7a93bc6ea1c5521977567a9565b1f7ef6b3a5cd8f8607ca27bdbca3c775ed6d5253ef1bb26227648d6a2d118c45b5e43af78a992135bf70b672ba
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD579166975abfbe6e1e1bae64dec705f01
SHA1ca51cf43c52098ce494467452440426805bab8a0
SHA2566580a04c2e7c45bea6ebe4ab066778eacb478dbfd2e04da055223fa60bcd92b3
SHA512d9a8ae8f2365281e52f099d529bb539775de9da3da1d5d5637c60f0f2233b7f2bf4bea8b29a4f9d1572c6d84824b7b9539d171c895c4858139e63d2d574fbe95
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\eaeb9d29-44e1-4999-b64b-ca0ae3fc11a2
Filesize733B
MD58d4028361c9314875fe318ac9e7eb267
SHA19e52b2bafddf9229868359089704445435490edd
SHA2569c632cbf31106c363edbefd73138eb11b5c2e183fa15e2feeed4a6ab80c9b20f
SHA512383eb71b9cdb114b9eecae42b2183c9456f48e0dada4b3bb77c0cb7d23961408b5211e679468fe5433a3d5d8744df835e79f9b3caa8df536bec2b2226e22e7b6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD510c49c00a4aeb96c524b329c4472cf5a
SHA1a74760089537de5d6785910eee4723cad6d2a804
SHA2564f6e27eff0871498484f173c8079f92f95d628c721e6bd6566a02a2023851536
SHA512be184cc3721dfc6cf959a7bdf399dc25916574c1be3649213bd138ae6484ce7f6d89e9ad8c438e3ef015eb9a80375637fca90e8a57f6a3b354462debf2afe858
-
Filesize
7KB
MD5d1926565c99fdd7a20799e1e949faaba
SHA17efc1de672ee10682237c8b36dc28ca7360bf392
SHA25675e22c92c2ebfed06f6dfd6229f97bee03b82c0d08b4b47176ed732239dc0c63
SHA512fd87bc3b74f7c9defb7969135be713aa04c2fd7caf62d62e58b57cd6b7a82a171fa9659dd0f7250a18da22fe3dad9e4df8609ba179fa300316dc3b5de928036d
-
Filesize
6KB
MD503a1caedff122fd6c7fbade10baf8334
SHA17cf7955a025d8a6bc13e14af4f8ef9dad9cfff2c
SHA2569860ca5bbd723632ceb48ef06ef5cd353febad62c08bc07b38d0db744fd6723f
SHA512b332694e467039dab1c26286b29f27c3c49bc065e8b2c404747adf7dddcb5bdd5db8c3cbce33eb90c7d80edcce8e31894dc1895d59caacb7ba30abeeab1f2ad6
-
Filesize
6KB
MD5af7d6f1945cc56b1d2da0ec59969566e
SHA122c50b2876d9ff3fa8bc0711fbe3c5a746c953d1
SHA2569f7bbd47c1aa71def6918351a881f4dc02b84e5d29e97596ff6a629123048d63
SHA512e8031a5722a3876aa1513f6b7fa0ab132c79fc83ce095fad0b5adc754bcdbfb30ee47edc6b850c649ca38a465ef62f24b6e658c91ccc24ae42c7da9d4476f73b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5ce84c0c337fc1d479b911db5e31d494f
SHA1b5d2a927d90a980ac9ffd9f855b19803e225dccb
SHA256d58b801e261aef1e48d2af11ab67f7bec34f638be4d9c947258442f6c0b1c1eb
SHA5129bbfe18c4324b35eb56bcb9f07a6723da71af7326374f7e4a6ad5f340ddc98e91529c10a1f67815c0570a2e6d443ff5e74698ab00c0778654283da7c7d669b1a
-
Filesize
1.4MB
MD5a8cf5621811f7fac55cfe8cb3fa6b9f6
SHA1121356839e8138a03141f5f5856936a85bd2a474
SHA256614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c
SHA5124479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd
-
Filesize
3.1MB
MD5a19f8447cc5cc3bd266c8e1098c5ffff
SHA10f2afa44f46aab7cdeaaf5ca6d7a32a2541fdf62
SHA2563b6ceb8138f8e9db307e0591ff28f45b727512215256f9b7df8b0b7cdee31b42
SHA512d7e7b44479f9252ada8a5a8cad9a111b973142e664c4d6884109e6b93c1c309af961316fc8ea0f1817e35edababc1bbf626983e60e3919c1a966f2d91c60431e