Overview

overview

10

Static

static

10

Armageddon...ty.exe

windows7-x64

8

Armageddon...ty.exe

windows10-2004-x64

8

Armageddon...ht.dll

windows7-x64

1

Armageddon...ht.dll

windows10-2004-x64

1

Armageddon...ax.dll

windows10-2004-x64

7

Armageddon...ub.exe

windows7-x64

1

Armageddon...ub.exe

windows10-2004-x64

1

Armageddon...ip.dll

windows7-x64

1

Armageddon...ip.dll

windows10-2004-x64

1

Armageddon...er.exe

windows7-x64

8

Armageddon...er.exe

windows10-2004-x64

8

Armageddon...k1.exe

windows7-x64

1

Armageddon...k1.exe

windows10-2004-x64

1

Armageddon...ub.exe

windows7-x64

1

Armageddon...ub.exe

windows10-2004-x64

1

AttWorm/AT...ed.exe

windows7-x64

8

AttWorm/AT...ed.exe

windows10-2004-x64

8

AttWorm/Jint.dll

windows7-x64

1

AttWorm/Jint.dll

windows10-2004-x64

1

AttWorm/js.exe

windows7-x64

1

AttWorm/js.exe

windows10-2004-x64

3

AttWorm/sk...et.dll

windows7-x64

1

AttWorm/sk...et.dll

windows10-2004-x64

1

AttWorm/sk...ip.dll

windows7-x64

1

AttWorm/sk...ip.dll

windows10-2004-x64

1

AttWorm/sk...er.exe

windows7-x64

8

AttWorm/sk...er.exe

windows10-2004-x64

8

AttWorm/skci/att.exe

windows7-x64

3

AttWorm/skci/att.exe

windows10-2004-x64

3

Aurora Wor...1N.exe

windows7-x64

8

Aurora Wor...1N.exe

windows10-2004-x64

8

Aurora Wor...ip.dll

windows7-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-01-2025 16:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Armageddon Stealer 1.0 by Krusty/Armageddon Stealer 1.0 by Krusty.exe

  • Size

    436KB

  • MD5

    30b064d68ff6227419e29ddf0f5a81f3

  • SHA1

    f8e9b737b0350e93bf8b2d41479c0c9d00249cca

  • SHA256

    2c76e53d24f76b91c33a3cafefaa7100e590f433305f954f3233c56a8edaf9bd

  • SHA512

    579a9b5a8be8fb65fa3c34d2ac7c6e7e4943a2053897cf223419ea4936f0bc7a6469e2c57998a7b1ddd61f8b63dff0ed078ba993b6822b5c3d34c1c96e9d9bcc

  • SSDEEP

    3072:04lCFLQ666C66G666i666o666y666B66c666G66f666+666u6669p666366o6663:06CFgXtwJ3xjpfVKWMy

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 55 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\Armageddon Stealer 1.0 by Krusty.exe
    "C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\Armageddon Stealer 1.0 by Krusty.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\viewsource\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\viewsource\Launcher.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1352
      • C:\Windows\IMF\Windows Services.exe
        "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\IMF\Secure System Shell.exe
          "C:\Windows\IMF\Secure System Shell.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1260
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2852
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2012
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2868
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2592
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1660
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1936
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1100
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1736
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3016
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:564
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1556
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:604
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2204
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1504
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1592
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2972
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2676
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2608
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2576
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2956
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2664
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1680
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2424
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2852
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2768
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:776
    • C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\viewsource\ak1.exe
      "C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\viewsource\ak1.exe"
      2⤵
        PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\Send.php
      Filesize

      101B

      MD5

      d0fb983b03f4ffa027c51dab7544c259

      SHA1

      dcfe29534ab26129188506e4e80aceb9f9c9e166

      SHA256

      c10db787797dc1a2c6b092b10174695990d471c593f56599f2db076a56a507f3

      SHA512

      5025a8c2a797b4c14ff0b9ed22c66873094d02203b62dd50f59c68e54f780765858d1ffec74575b717055727292d105792a63bf87c91a43817ea2e0974312fc5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Armageddon Stealer 1.0 by Krusty\Send.php
      Filesize

      88B

      MD5

      2cf0925c2ad295d8c07760fa26108596

      SHA1

      ca25244b44bf670c9acc84903e857be0ac8dedf7

      SHA256

      e6b83e1f946a57dc10a3ef452d65c9c4d38beec6ccbf4e069836c38448a894c3

      SHA512

      fbb94c85f5fbb42b69362189dc29caa6ca46d05dde5a6407f73424a2cbb054b92edb368a171998fd440ed9d5c28692013874aa3d9b1aa1336bb0dd8ef3ef0832

      Download Submit

    • C:\Windows\IMF\Runtime Explorer.exe
      Filesize

      152KB

      MD5

      03f5e0141f4519f0c5ac26ce0b036a0f

      SHA1

      4f7a2a230e7a194a898cc9f2d563ac8777fe99c0

      SHA256

      78a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef

      SHA512

      86a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7

      Download Submit

    • C:\Windows\IMF\Secure System Shell.exe
      Filesize

      45KB

      MD5

      7d0c7359e5b2daa5665d01afdc98cc00

      SHA1

      c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

      SHA256

      f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

      SHA512

      a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

      Download Submit

    • C:\Windows\IMF\Windows Services.exe
      Filesize

      46KB

      MD5

      ad0ce1302147fbdfecaec58480eb9cf9

      SHA1

      874efbc76e5f91bc1425a43ea19400340f98d42b

      SHA256

      2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

      SHA512

      adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

      Download Submit

    • memory/1260-52-0x0000000000B10000-0x0000000000B22000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2676-10-0x0000000074130000-0x000000007481E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2676-0-0x000000007413E000-0x000000007413F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2676-2-0x0000000074130000-0x000000007481E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2676-1-0x0000000001160000-0x00000000011D4000-memory.dmp

      Filesize

      464KB

      Download

    • memory/2684-7-0x0000000074130000-0x000000007481E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2684-3-0x0000000001210000-0x0000000001224000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2684-5-0x00000000009F0000-0x0000000000A6E000-memory.dmp

      Filesize

      504KB

      Download

    • memory/2684-6-0x0000000074130000-0x000000007481E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2684-44-0x0000000074130000-0x000000007481E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2684-4-0x0000000074130000-0x000000007481E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2728-11-0x0000000000860000-0x00000000008C0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2928-43-0x0000000000990000-0x00000000009A2000-memory.dmp

      Filesize

      72KB

      Download