Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 01:37
Static task
static1
Behavioral task
behavioral1
Sample
9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe
Resource
win7-20240903-en
General
-
Target
9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe
-
Size
2.8MB
-
MD5
c32d39710b13585f9608ebac9e028ea0
-
SHA1
96ce25ea1f05d91a7314e6eed4101af60259a811
-
SHA256
9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a
-
SHA512
e6222188e39d4260c8de06a4d8033ef2a4c1122e8df22fda616b4bb2de2377846c1621f3cb0d9840c81791b7a1cba3276081063875a91781972a2be0da96e3c5
-
SSDEEP
49152:GLNDk2Pu0hI2hcbYQc4Nv0PYax7Ia1uTZYs:GFk2PuWIBeOv0P1WayZYs
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
cryptbot
Signatures
-
Amadey family
-
Cryptbot family
-
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5008 created 2848 5008 ff817215da.exe 49 -
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 878085ff96.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 89b1464b94.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6dfe05f941.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ff817215da.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 878085ff96.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6dfe05f941.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ff817215da.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6dfe05f941.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ff817215da.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 89b1464b94.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 878085ff96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 878085ff96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 89b1464b94.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation axplong.exe -
Executes dropped EXE 7 IoCs
pid Process 4444 axplong.exe 3924 6dfe05f941.exe 5008 ff817215da.exe 2024 878085ff96.exe 3240 89b1464b94.exe 2732 axplong.exe 4428 axplong.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine 6dfe05f941.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine ff817215da.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine 878085ff96.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine 89b1464b94.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine axplong.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6dfe05f941.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006898001\\6dfe05f941.exe" axplong.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe 4444 axplong.exe 3924 6dfe05f941.exe 5008 ff817215da.exe 2024 878085ff96.exe 3240 89b1464b94.exe 2732 axplong.exe 4428 axplong.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3616 5008 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6dfe05f941.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff817215da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878085ff96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89b1464b94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe 4444 axplong.exe 4444 axplong.exe 3924 6dfe05f941.exe 3924 6dfe05f941.exe 5008 ff817215da.exe 5008 ff817215da.exe 5008 ff817215da.exe 5008 ff817215da.exe 5008 ff817215da.exe 5008 ff817215da.exe 2488 svchost.exe 2488 svchost.exe 2488 svchost.exe 2488 svchost.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 2024 878085ff96.exe 3240 89b1464b94.exe 3240 89b1464b94.exe 2732 axplong.exe 2732 axplong.exe 4428 axplong.exe 4428 axplong.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1184 wrote to memory of 4444 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe 82 PID 1184 wrote to memory of 4444 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe 82 PID 1184 wrote to memory of 4444 1184 9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe 82 PID 4444 wrote to memory of 3924 4444 axplong.exe 83 PID 4444 wrote to memory of 3924 4444 axplong.exe 83 PID 4444 wrote to memory of 3924 4444 axplong.exe 83 PID 4444 wrote to memory of 5008 4444 axplong.exe 84 PID 4444 wrote to memory of 5008 4444 axplong.exe 84 PID 4444 wrote to memory of 5008 4444 axplong.exe 84 PID 5008 wrote to memory of 2488 5008 ff817215da.exe 85 PID 5008 wrote to memory of 2488 5008 ff817215da.exe 85 PID 5008 wrote to memory of 2488 5008 ff817215da.exe 85 PID 5008 wrote to memory of 2488 5008 ff817215da.exe 85 PID 5008 wrote to memory of 2488 5008 ff817215da.exe 85 PID 4444 wrote to memory of 2024 4444 axplong.exe 93 PID 4444 wrote to memory of 2024 4444 axplong.exe 93 PID 4444 wrote to memory of 2024 4444 axplong.exe 93 PID 4444 wrote to memory of 3240 4444 axplong.exe 97 PID 4444 wrote to memory of 3240 4444 axplong.exe 97 PID 4444 wrote to memory of 3240 4444 axplong.exe 97
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2848
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe"C:\Users\Admin\AppData\Local\Temp\9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\1006898001\6dfe05f941.exe"C:\Users\Admin\AppData\Local\Temp\1006898001\6dfe05f941.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\1006899001\ff817215da.exe"C:\Users\Admin\AppData\Local\Temp\1006899001\ff817215da.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 5364⤵
- Program crash
PID:3616
-
-
-
C:\Users\Admin\AppData\Local\Temp\1006900001\878085ff96.exe"C:\Users\Admin\AppData\Local\Temp\1006900001\878085ff96.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\1006901001\89b1464b94.exe"C:\Users\Admin\AppData\Local\Temp\1006901001\89b1464b94.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5008 -ip 50081⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD51eb268dfe52d4541037838207c51d19f
SHA135264d064730fa9d7d4b53183a5fb9e97912a8a7
SHA256bfa216d2edc6a8b5230cf4d89231f3ee36decad422a7b8b8565fa232dc3bf89b
SHA512ed2e878a5cf58e0ec74d3bf8b20a35531cc7dea31a590737f40a6fef1aea8f7903d592fb25a870482110f10d225051e8724bcb57a9d3aca388c8bde5f0fa6146
-
Filesize
1.9MB
MD5129e9d731c27f28d25a824fecd066e54
SHA1c42fb09e9dbbb309db3a30deecf9a0edd285e7a1
SHA2560186a9725d8a17443751c82eee6683e68637fe4fd6f041f5d5855e6d8bd5ec47
SHA512a243cc3e7fd661bc37f90165f8494d45edb1a038e2e56513c256d1666d901298992d42390baed8c18f1ea68ac5400a8d2da9c25e49fc89315b6a2ae07e96f6fb
-
Filesize
4.2MB
MD5724c47eb0c466e28d03fdbbeab283448
SHA1db4ab5dedfe960b259323c49d31b5cf6a2f68c9c
SHA256f822440531c2c4690bcc6c52d4baaea3e56ca9008726cfe55c123931d27f545f
SHA5126d3059018a7b8ad358002d15de71439af3db6107396a9845e18aa7c3f9e67faa5285e1c87788b62b9ddeda24b0432c7b28432e03b6bb138b25cc9080a5347009
-
Filesize
4.2MB
MD585cea0d2fa18da07d24daa648971117a
SHA10b50f57223bef54f682715f7944267a419004cb4
SHA256845229081df392891048243c2c4b8502c10b68eacf8345d515ed5d0485c24bd0
SHA512a460a2c1552b44c5df55203c90bcba0603fc39ef106bfdd9ae95751c48788f132318fb7dc5a1d8560a33fc548ec8f5204ae4a295bea3160854773ead08b343c0
-
Filesize
2.8MB
MD5c32d39710b13585f9608ebac9e028ea0
SHA196ce25ea1f05d91a7314e6eed4101af60259a811
SHA2569ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a
SHA512e6222188e39d4260c8de06a4d8033ef2a4c1122e8df22fda616b4bb2de2377846c1621f3cb0d9840c81791b7a1cba3276081063875a91781972a2be0da96e3c5