amadey | 04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/02/2025, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
Size

2.0MB
MD5

190126600c4f0d6f6f75c7bd47081ce9
SHA1

7fce3c146cb29413dcbe133013f7bf760fb3d6d1
SHA256

04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825
SHA512

8ee42e579c04a085bca667cc797b07fe63e26d5379f95d15471c877f26e5f22fb478986c717ecb1871ccbb2758eea7f523f7ce0ab2231b358a17d41223f73384
SSDEEP

49152:vD3uuvkus0w3aGun/cPBdj4i0XP3U5IX+3VfQ:vwqGdcJJX+lfQ

Score

10^/10

amadey povertystealer 9c9aa5 defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000000b3e1-195.dat	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
Povertystealer family
povertystealer

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2376	powershell.exe
692	powershell.exe
1284	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
5	2944	skotes.exe
5	2944	skotes.exe
34	2944	skotes.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Executes dropped EXE 8 IoCs

pid	Process
2944	skotes.exe
2508	d39WgNu.exe
2784	d39WgNu.exe
1912	d39WgNu.exe
600	DpLKrVb.exe
1964	w3Xwk4R.exe
1232	w3Xwk4R.exe
1280	0LGvvQO.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	skotes.exe

Loads dropped DLL 15 IoCs

pid	Process
2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
2944	skotes.exe
2508	d39WgNu.exe
2508	d39WgNu.exe
1352	WerFault.exe
1352	WerFault.exe
1352	WerFault.exe
1352	WerFault.exe
1352	WerFault.exe
2944	skotes.exe
2944	skotes.exe
1964	w3Xwk4R.exe
2944	skotes.exe
2944	skotes.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
2944	skotes.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 1912	2508	d39WgNu.exe	34

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	2508	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0LGvvQO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d39WgNu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d39WgNu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w3Xwk4R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w3Xwk4R.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	d39WgNu.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	d39WgNu.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	d39WgNu.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	d39WgNu.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
2944	skotes.exe
2376	powershell.exe
692	powershell.exe
1284	powershell.exe
1912	d39WgNu.exe
1912	d39WgNu.exe
1912	d39WgNu.exe
1912	d39WgNu.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2944	2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe	30
PID 2976 wrote to memory of 2944	2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe	30
PID 2976 wrote to memory of 2944	2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe	30
PID 2976 wrote to memory of 2944	2976	04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe	30
PID 2944 wrote to memory of 2508	2944	skotes.exe	32
PID 2944 wrote to memory of 2508	2944	skotes.exe	32
PID 2944 wrote to memory of 2508	2944	skotes.exe	32
PID 2944 wrote to memory of 2508	2944	skotes.exe	32
PID 2508 wrote to memory of 2784	2508	d39WgNu.exe	33
PID 2508 wrote to memory of 2784	2508	d39WgNu.exe	33
PID 2508 wrote to memory of 2784	2508	d39WgNu.exe	33
PID 2508 wrote to memory of 2784	2508	d39WgNu.exe	33
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1912	2508	d39WgNu.exe	34
PID 2508 wrote to memory of 1352	2508	d39WgNu.exe	35
PID 2508 wrote to memory of 1352	2508	d39WgNu.exe	35
PID 2508 wrote to memory of 1352	2508	d39WgNu.exe	35
PID 2508 wrote to memory of 1352	2508	d39WgNu.exe	35
PID 2944 wrote to memory of 600	2944	skotes.exe	37
PID 2944 wrote to memory of 600	2944	skotes.exe	37
PID 2944 wrote to memory of 600	2944	skotes.exe	37
PID 2944 wrote to memory of 600	2944	skotes.exe	37
PID 600 wrote to memory of 2228	600	DpLKrVb.exe	39
PID 600 wrote to memory of 2228	600	DpLKrVb.exe	39
PID 600 wrote to memory of 2228	600	DpLKrVb.exe	39
PID 600 wrote to memory of 1132	600	DpLKrVb.exe	40
PID 600 wrote to memory of 1132	600	DpLKrVb.exe	40
PID 600 wrote to memory of 1132	600	DpLKrVb.exe	40
PID 600 wrote to memory of 1076	600	DpLKrVb.exe	41
PID 600 wrote to memory of 1076	600	DpLKrVb.exe	41
PID 600 wrote to memory of 1076	600	DpLKrVb.exe	41
PID 600 wrote to memory of 1624	600	DpLKrVb.exe	42
PID 600 wrote to memory of 1624	600	DpLKrVb.exe	42
PID 600 wrote to memory of 1624	600	DpLKrVb.exe	42
PID 600 wrote to memory of 1232	600	DpLKrVb.exe	43
PID 600 wrote to memory of 1232	600	DpLKrVb.exe	43
PID 600 wrote to memory of 1232	600	DpLKrVb.exe	43
PID 600 wrote to memory of 2960	600	DpLKrVb.exe	44
PID 600 wrote to memory of 2960	600	DpLKrVb.exe	44
PID 600 wrote to memory of 2960	600	DpLKrVb.exe	44
PID 600 wrote to memory of 1348	600	DpLKrVb.exe	45
PID 600 wrote to memory of 1348	600	DpLKrVb.exe	45
PID 600 wrote to memory of 1348	600	DpLKrVb.exe	45
PID 600 wrote to memory of 1612	600	DpLKrVb.exe	46
PID 600 wrote to memory of 1612	600	DpLKrVb.exe	46
PID 600 wrote to memory of 1612	600	DpLKrVb.exe	46
PID 600 wrote to memory of 800	600	DpLKrVb.exe	47
PID 600 wrote to memory of 800	600	DpLKrVb.exe	47
PID 600 wrote to memory of 800	600	DpLKrVb.exe	47
PID 600 wrote to memory of 1848	600	DpLKrVb.exe	48
PID 600 wrote to memory of 1848	600	DpLKrVb.exe	48
PID 600 wrote to memory of 1848	600	DpLKrVb.exe	48
PID 600 wrote to memory of 1696	600	DpLKrVb.exe	49
PID 600 wrote to memory of 1696	600	DpLKrVb.exe	49
PID 600 wrote to memory of 1696	600	DpLKrVb.exe	49
PID 600 wrote to memory of 2568	600	DpLKrVb.exe	50

C:\Users\Admin\AppData\Local\Temp\04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe
"C:\Users\Admin\AppData\Local\Temp\04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe
    "C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe
      "C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe"
      4⤵
      Executes dropped EXE
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe
      "C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 524
      4⤵
      Loads dropped DLL
      Program crash
      PID:1352
- - C:\Users\Admin\AppData\Local\Temp\1079996001\DpLKrVb.exe
    "C:\Users\Admin\AppData\Local\Temp\1079996001\DpLKrVb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:2228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:2192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\MTSNT'"
      4⤵
      PID:1652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\MTSNT'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      PID:3028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
      4⤵
      PID:1676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
- - C:\Users\Admin\AppData\Local\Temp\1080595001\w3Xwk4R.exe
    "C:\Users\Admin\AppData\Local\Temp\1080595001\w3Xwk4R.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1964
  - - C:\Windows\Temp\{FC93CC59-8DFD-4D1F-8F93-AC3E6FADCB24}\.cr\w3Xwk4R.exe
      "C:\Windows\Temp\{FC93CC59-8DFD-4D1F-8F93-AC3E6FADCB24}\.cr\w3Xwk4R.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\1080595001\w3Xwk4R.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\1081341001\0LGvvQO.exe
    "C:\Users\Admin\AppData\Local\Temp\1081341001\0LGvvQO.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f25ee49ec9877f08de0239c8fd90452e

SHA1
333119c91729e50a7a532c8f7005dd64b8306ae6

SHA256
18dae79eeb83cf777c9ce0a96c751aa805f1088feacfc06c2f687eaa7adf7451

SHA512
45d263f8e2b0967a219fe8e64fe8676abea6ffc36515f797203363e3cecbd21fa5f84af9d78e663704e6d82791ca9b5ffb0fecc16f7e42767f171381b12bbd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\1079543001\d39WgNu.exe

Filesize
350KB

MD5
33146ba1e90018714c1efd329be01e5c

SHA1
0a187fd1917718ef135cbf89ec7803f78c9ed192

SHA256
1ed00e7cc3376be1502bbd36901fc1b3a79b32a2d41ad5638b004230ba8a32ef

SHA512
1e60ddbf36bd55de676dce183aa9e68a79a8b03a6d0bf19f550bbe44f057b2f828b21710ac8a1d61aad156b9e34b079b7a2dea2cb5cf84cfdcbe0ebde988b1b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1079996001\DpLKrVb.exe

Filesize
232KB

MD5
61df5bd677361765915aeee63c6b2b32

SHA1
b95821e718908535903ae4e9aee850af22a63206

SHA256
0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480

SHA512
17e1d6860b74b159614dad61744c883469b7e8b3d4dd4c25e9ba64de5f2f1c2dcc213d581d5b1295b2d95f1e74cf89cbe96dcdec854e203a83cd173a9366c7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1080446001\qt7gC9n.exe

Filesize
246KB

MD5
cdbda55daf59939ee8c0f909abca760f

SHA1
a7c0aefc769a496632d3d11b0e2ef1fa6a2bd605

SHA256
01aa0ae24d4f4c0b9f60406de39ad8618d3438c32a05a3ffd14564769481e196

SHA512
ed7bf641cb08b27887a1f7e0821d06c2e3919774b20149d081257ed20d9249a907e739177466fcad9b9b2bf0549e6df3ff4ed846abfa1c27282a26c48fb755a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1080595001\w3Xwk4R.exe

Filesize
1.9MB

MD5
6c3389d74cf7c9d6694befac6e2675eb

SHA1
c3ad8a55331fd2416b78c62371937de47cdc9816

SHA256
d03e1812722b8a8539d6612edabed331ea7430c536bf71c6a96fe8d2f084a5fa

SHA512
b96d68e8c2336536fa1685c159fed13e68e336b075e37806360b22bd270d85c5fba64e81c65854947109429bb0e8b662037eadaf0dfb734b8f869a7287070205

Download Submit
C:\Users\Admin\AppData\Local\Temp\1081341001\0LGvvQO.exe

Filesize
29KB

MD5
eaddae635c1b70d129d6ba1821de7b6e

SHA1
c125eb40308cf1c80a6d58b7ffacef9a7319d608

SHA256
44db542e3271319c1c7d591169335e9eed8521d564bb578f3af3d3735b3b03d3

SHA512
52ee576cae6f66b256152ad4d3acf5d11620afec4d102d1080fcce6553baedcdb8e4a50a0642a82515de5d55a1042e959edd805ffb4f6931572781f09c8e3883

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA823.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA836.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f7190a6a749f72785576d2ae4949da63

SHA1
834df2d2e0b142b16b2090c7a40fc1423cb5c842

SHA256
94992964301cece882a0972ca255396404d9bc1841478a3443076afaaf6e1c9b

SHA512
9cfe19965048db448380b14cc34f2fd7d5d43dd86f33452ba44cd4d800b5493bcabb35400116df62f39d4437e51d44eaf9175fd7e14439e5a19e8c0a33c45cfb

Download Submit
\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.0MB

MD5
190126600c4f0d6f6f75c7bd47081ce9

SHA1
7fce3c146cb29413dcbe133013f7bf760fb3d6d1

SHA256
04a56891b310acf9bb0397f078f1ac1c117754423f6ebc76bd2b0c7182cf3825

SHA512
8ee42e579c04a085bca667cc797b07fe63e26d5379f95d15471c877f26e5f22fb478986c717ecb1871ccbb2758eea7f523f7ce0ab2231b358a17d41223f73384

Download Submit
memory/692-127-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/692-128-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/1912-56-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1912-46-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1912-52-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1912-59-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1912-57-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1912-54-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1912-50-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1912-48-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2376-120-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2376-121-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2508-41-0x00000000002A0000-0x0000000000300000-memory.dmp

Filesize
384KB

Download
memory/2944-114-0x0000000000DF1000-0x0000000000E59000-memory.dmp

Filesize
416KB

Download
memory/2944-167-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-210-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-99-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-20-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-112-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-113-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-209-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-115-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-26-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-25-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-23-0x0000000000DF1000-0x0000000000E59000-memory.dmp

Filesize
416KB

Download
memory/2944-208-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-207-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-134-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-169-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-148-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-168-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-163-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-164-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-165-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2944-166-0x0000000000DF0000-0x000000000129E000-memory.dmp

Filesize
4.7MB

Download
memory/2976-18-0x0000000000A40000-0x0000000000EEE000-memory.dmp

Filesize
4.7MB

Download
memory/2976-3-0x0000000000A40000-0x0000000000EEE000-memory.dmp

Filesize
4.7MB

Download
memory/2976-4-0x0000000000A40000-0x0000000000EEE000-memory.dmp

Filesize
4.7MB

Download
memory/2976-2-0x0000000000A41000-0x0000000000AA9000-memory.dmp

Filesize
416KB

Download
memory/2976-1-0x0000000077900000-0x0000000077902000-memory.dmp

Filesize
8KB

Download
memory/2976-21-0x00000000070D0000-0x000000000757E000-memory.dmp

Filesize
4.7MB

Download
memory/2976-22-0x0000000000A41000-0x0000000000AA9000-memory.dmp

Filesize
416KB

Download
memory/2976-19-0x00000000070D0000-0x000000000757E000-memory.dmp

Filesize
4.7MB

Download
memory/2976-0-0x0000000000A40000-0x0000000000EEE000-memory.dmp

Filesize
4.7MB

Download