amadey | 7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0

Analysis

max time kernel
108s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe
Size

243KB
MD5

db7542c94faff2eed46d3c9170cd2786
SHA1

b812d37f28b23a95bfacd0c7801c0b769a3e5577
SHA256

7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0
SHA512

b181653585d4898193e33d3059a74d4ba734e71fc504c2435158f136467892b933dfc62ac565272c1766b7666687332a5995e65c485d4c195b0fe3209fb4e240
SSDEEP

3072:9zM917QS3AMgMn5Fl8LWyiBgYdIEF3S+fRNMeo/44krKRw+627nNM:pM73AMJExOIxcNMeo8r+M27N

Score

10^/10

amadey redline smokeloader vidar 909 @redlinevip cloud (tg: @fatherofcarders)lege backdoor collection discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.50

62.204.41.252/nB8cWack3/index.php

Extracted

Family

vidar

Version

55.9

Botnet

909

https://t.me/headshotsonly

https://steamcommunity.com/profiles/76561199436777531

Attributes

profile_id
909

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

151.80.89.233:13553

Attributes

auth_value
fbee175162920530e6bf470c8003fa1a

Extracted

Family

redline

Botnet

Lege

31.41.244.14:4694

Attributes

auth_value
096090aaf3ba0872338140cec5689868

Extracted

Family

smokeloader

Version

2017

http://dogewareservice.ru/

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll	amadey_cred_module
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll	amadey_cred_module

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe	family_redline
behavioral1/memory/2124-157-0x00000000004D0000-0x00000000004F8000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe	family_redline
behavioral1/memory/4456-190-0x00000000004C0000-0x00000000004E8000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

58 2708 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 9 IoCs

Processes:

gntuud.exe123.exe123.exe40K.exeLege.exelinda5.exeHJhAAXumFIiXscP.exegntuud.exegntuud.exe

pid process

3032 gntuud.exe
3216 123.exe
952 123.exe
2124 40K.exe
4456 Lege.exe
5084 linda5.exe
1652 HJhAAXumFIiXscP.exe
572 gntuud.exe
4940 gntuud.exe

flow	pid	process
58	2708	rundll32.exe

pid	process
3032	gntuud.exe
3216	123.exe
952	123.exe
2124	40K.exe
4456	Lege.exe
5084	linda5.exe
1652	HJhAAXumFIiXscP.exe
572	gntuud.exe
4940	gntuud.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exegntuud.exe123.exelinda5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	gntuud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	123.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	linda5.exe

Loads dropped DLL 4 IoCs

Processes:

123.exerundll32.exerundll32.exe

pid process

952 123.exe
952 123.exe
1312 rundll32.exe
2708 rundll32.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

gntuud.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lege.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000026001\\Lege.exe"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000027001\\linda5.exe"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HJhAAXumFIiXscP.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000029001\\HJhAAXumFIiXscP.exe"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\123.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000024001\\123.exe"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40K.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000025001\\40K.exe"	gntuud.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

123.exeHJhAAXumFIiXscP.exe

description	pid	process	target process
PID 3216 set thread context of 952	3216	123.exe	123.exe
PID 1652 set thread context of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4712	1592	WerFault.exe	7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe
4888	572	WerFault.exe	gntuud.exe
4592	1592	WerFault.exe	explorer.exe
4948	4940	WerFault.exe	gntuud.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

123.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	123.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	123.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3984 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3308 timeout.exe
Modifies registry class 1 IoCs

Processes:

linda5.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings linda5.exe

pid	process
3984	schtasks.exe

pid	process
3308	timeout.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	linda5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

123.exe40K.exeLege.exerundll32.exeRegSvcs.exe

pid	process
952	123.exe
952	123.exe
2124	40K.exe
4456	Lege.exe
2124	40K.exe
4456	Lege.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2708	rundll32.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe
2872	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

RegSvcs.exe

pid process

2872 RegSvcs.exe
2872 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

40K.exeLege.exe

description pid process

Token: SeDebugPrivilege 2124 40K.exe
Token: SeDebugPrivilege 4456 Lege.exe

pid	process
2872	RegSvcs.exe
2872	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2124	40K.exe
Token: SeDebugPrivilege	4456	Lege.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exegntuud.exe123.exe123.execmd.exelinda5.execontrol.exeHJhAAXumFIiXscP.exeRegSvcs.exe

description	pid	process	target process
PID 1592 wrote to memory of 3032	1592	7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe	gntuud.exe
PID 1592 wrote to memory of 3032	1592	7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe	gntuud.exe
PID 1592 wrote to memory of 3032	1592	7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe	gntuud.exe
PID 3032 wrote to memory of 3984	3032	gntuud.exe	schtasks.exe
PID 3032 wrote to memory of 3984	3032	gntuud.exe	schtasks.exe
PID 3032 wrote to memory of 3984	3032	gntuud.exe	schtasks.exe
PID 3032 wrote to memory of 3216	3032	gntuud.exe	123.exe
PID 3032 wrote to memory of 3216	3032	gntuud.exe	123.exe
PID 3032 wrote to memory of 3216	3032	gntuud.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3216 wrote to memory of 952	3216	123.exe	123.exe
PID 3032 wrote to memory of 2124	3032	gntuud.exe	40K.exe
PID 3032 wrote to memory of 2124	3032	gntuud.exe	40K.exe
PID 3032 wrote to memory of 2124	3032	gntuud.exe	40K.exe
PID 952 wrote to memory of 4584	952	123.exe	cmd.exe
PID 952 wrote to memory of 4584	952	123.exe	cmd.exe
PID 952 wrote to memory of 4584	952	123.exe	cmd.exe
PID 4584 wrote to memory of 3308	4584	cmd.exe	timeout.exe
PID 4584 wrote to memory of 3308	4584	cmd.exe	timeout.exe
PID 4584 wrote to memory of 3308	4584	cmd.exe	timeout.exe
PID 3032 wrote to memory of 4456	3032	gntuud.exe	Lege.exe
PID 3032 wrote to memory of 4456	3032	gntuud.exe	Lege.exe
PID 3032 wrote to memory of 4456	3032	gntuud.exe	Lege.exe
PID 3032 wrote to memory of 5084	3032	gntuud.exe	linda5.exe
PID 3032 wrote to memory of 5084	3032	gntuud.exe	linda5.exe
PID 3032 wrote to memory of 5084	3032	gntuud.exe	linda5.exe
PID 5084 wrote to memory of 2664	5084	linda5.exe	control.exe
PID 5084 wrote to memory of 2664	5084	linda5.exe	control.exe
PID 5084 wrote to memory of 2664	5084	linda5.exe	control.exe
PID 2664 wrote to memory of 1312	2664	control.exe	rundll32.exe
PID 2664 wrote to memory of 1312	2664	control.exe	rundll32.exe
PID 2664 wrote to memory of 1312	2664	control.exe	rundll32.exe
PID 3032 wrote to memory of 1652	3032	gntuud.exe	HJhAAXumFIiXscP.exe
PID 3032 wrote to memory of 1652	3032	gntuud.exe	HJhAAXumFIiXscP.exe
PID 3032 wrote to memory of 1652	3032	gntuud.exe	HJhAAXumFIiXscP.exe
PID 3032 wrote to memory of 2708	3032	gntuud.exe	rundll32.exe
PID 3032 wrote to memory of 2708	3032	gntuud.exe	rundll32.exe
PID 3032 wrote to memory of 2708	3032	gntuud.exe	rundll32.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 1652 wrote to memory of 2872	1652	HJhAAXumFIiXscP.exe	RegSvcs.exe
PID 2872 wrote to memory of 1592	2872	RegSvcs.exe	explorer.exe
PID 2872 wrote to memory of 1592	2872	RegSvcs.exe	explorer.exe
PID 2872 wrote to memory of 1592	2872	RegSvcs.exe	explorer.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe
"C:\Users\Admin\AppData\Local\Temp\7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
"C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe" /F
3⤵
- Creates scheduled task(s)
PID:3984

C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe
"C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3216

C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe
"C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe" & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
6⤵
- Delays execution with timeout.exe
PID:3308

C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe
"C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe
"C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe
"C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\UZ5b0X.Cpl",
4⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\UZ5b0X.Cpl",
5⤵
- Loads dropped DLL
PID:1312

C:\Users\Admin\AppData\Local\Temp\1000029001\HJhAAXumFIiXscP.exe
"C:\Users\Admin\AppData\Local\Temp\1000029001\HJhAAXumFIiXscP.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
4⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 940
6⤵
- Program crash
PID:4592

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1136
2⤵
- Program crash
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1592 -ip 1592
1⤵
PID:3776

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 420
2⤵
- Program crash
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 572 -ip 572
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1592 -ip 1592
1⤵
PID:1000

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 420
2⤵
- Program crash
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4940 -ip 4940
1⤵
PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe
Filesize
389KB

MD5
dc25367580940e04fdbf1b41a4668dd6

SHA1
62e8ef3cfa7eb33d59e46cfe2ee1cba3600cf4a9

SHA256
71f865d049fb8a9d07c0e65fcfa174e200dc5fd1e9de3af19f5d77f8a2014305

SHA512
612f0ac06684a2662f67a68fda021287b397ebaa76c9f781d4fad14bf6e94daf12d1978e1f14c13369e3987f094382f52af90f4d6979fa9c535d2dac64db5075

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe
Filesize
389KB

MD5
dc25367580940e04fdbf1b41a4668dd6

SHA1
62e8ef3cfa7eb33d59e46cfe2ee1cba3600cf4a9

SHA256
71f865d049fb8a9d07c0e65fcfa174e200dc5fd1e9de3af19f5d77f8a2014305

SHA512
612f0ac06684a2662f67a68fda021287b397ebaa76c9f781d4fad14bf6e94daf12d1978e1f14c13369e3987f094382f52af90f4d6979fa9c535d2dac64db5075

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000024001\123.exe
Filesize
389KB

MD5
dc25367580940e04fdbf1b41a4668dd6

SHA1
62e8ef3cfa7eb33d59e46cfe2ee1cba3600cf4a9

SHA256
71f865d049fb8a9d07c0e65fcfa174e200dc5fd1e9de3af19f5d77f8a2014305

SHA512
612f0ac06684a2662f67a68fda021287b397ebaa76c9f781d4fad14bf6e94daf12d1978e1f14c13369e3987f094382f52af90f4d6979fa9c535d2dac64db5075

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe
Filesize
137KB

MD5
87ef06885fd221a86bba9e5b86a7ea7d

SHA1
6644db86f2d557167f442a5fe72a82de3fe943ba

SHA256
ab5026bf6fe5d692faaf86752b4c9fa226ec49ba54cfb625579287b498eab20f

SHA512
c65b38856d4995b01454754044ae7373363a02b8e228c249fee3c1c2222f2348473f0bba5a5f2e4a280cd183e57dc13423bb09f86919ccb8968c8229310c5ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000025001\40K.exe
Filesize
137KB

MD5
87ef06885fd221a86bba9e5b86a7ea7d

SHA1
6644db86f2d557167f442a5fe72a82de3fe943ba

SHA256
ab5026bf6fe5d692faaf86752b4c9fa226ec49ba54cfb625579287b498eab20f

SHA512
c65b38856d4995b01454754044ae7373363a02b8e228c249fee3c1c2222f2348473f0bba5a5f2e4a280cd183e57dc13423bb09f86919ccb8968c8229310c5ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe
Filesize
137KB

MD5
0a793a6b9941c49675a47a2bc91cb420

SHA1
ff051cc2d9cf081e863f5bb8c3d2449c28f12c7f

SHA256
3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60

SHA512
fd695f62ef32f79f3b4e5c57c68056b004355d5a16e6558bfb310f8ded03c837fe5f505f5a4f433a740fa0b980a71962571c3dd4ed86d95146a22f126850dc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000026001\Lege.exe
Filesize
137KB

MD5
0a793a6b9941c49675a47a2bc91cb420

SHA1
ff051cc2d9cf081e863f5bb8c3d2449c28f12c7f

SHA256
3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60

SHA512
fd695f62ef32f79f3b4e5c57c68056b004355d5a16e6558bfb310f8ded03c837fe5f505f5a4f433a740fa0b980a71962571c3dd4ed86d95146a22f126850dc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe
Filesize
1.6MB

MD5
5b80aabbc460f040e4e823df8403bed1

SHA1
cd4865a1a4713bf9d99a101c63d576b9e58b288b

SHA256
37990e99610af2bfd5e83a161821149e51f0bb33a793d7b9c36600d38dbe4654

SHA512
a9a98613e6f377402820be1a5157b6733571b42251864695cd56c0487fe982bb076dbe0d3a11b80f2b66e564af6e8c4c820b739581fb690a42c1fcd5000f14be

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe
Filesize
1.6MB

MD5
5b80aabbc460f040e4e823df8403bed1

SHA1
cd4865a1a4713bf9d99a101c63d576b9e58b288b

SHA256
37990e99610af2bfd5e83a161821149e51f0bb33a793d7b9c36600d38dbe4654

SHA512
a9a98613e6f377402820be1a5157b6733571b42251864695cd56c0487fe982bb076dbe0d3a11b80f2b66e564af6e8c4c820b739581fb690a42c1fcd5000f14be

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\HJhAAXumFIiXscP.exe
Filesize
762KB

MD5
a95c873bf2193d161b9453ad722ca9fc

SHA1
bb33695aed9ee2a10f1478150fa90defb66cab25

SHA256
122ea6a4e034592aadf95a264fb4cfa6d2767d90fa67205926f87b106f8f736a

SHA512
71f218b2e267e4ce1b4dffb51f85abf44ce4e3017c26c41263399f6909598f772376d596525b9f694af045ab57ea97cc86fc92f080fa2c7dfebe4e1a78e73475

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\HJhAAXumFIiXscP.exe
Filesize
762KB

MD5
a95c873bf2193d161b9453ad722ca9fc

SHA1
bb33695aed9ee2a10f1478150fa90defb66cab25

SHA256
122ea6a4e034592aadf95a264fb4cfa6d2767d90fa67205926f87b106f8f736a

SHA512
71f218b2e267e4ce1b4dffb51f85abf44ce4e3017c26c41263399f6909598f772376d596525b9f694af045ab57ea97cc86fc92f080fa2c7dfebe4e1a78e73475

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Filesize
243KB

MD5
db7542c94faff2eed46d3c9170cd2786

SHA1
b812d37f28b23a95bfacd0c7801c0b769a3e5577

SHA256
7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0

SHA512
b181653585d4898193e33d3059a74d4ba734e71fc504c2435158f136467892b933dfc62ac565272c1766b7666687332a5995e65c485d4c195b0fe3209fb4e240

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Filesize
243KB

MD5
db7542c94faff2eed46d3c9170cd2786

SHA1
b812d37f28b23a95bfacd0c7801c0b769a3e5577

SHA256
7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0

SHA512
b181653585d4898193e33d3059a74d4ba734e71fc504c2435158f136467892b933dfc62ac565272c1766b7666687332a5995e65c485d4c195b0fe3209fb4e240

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Filesize
243KB

MD5
db7542c94faff2eed46d3c9170cd2786

SHA1
b812d37f28b23a95bfacd0c7801c0b769a3e5577

SHA256
7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0

SHA512
b181653585d4898193e33d3059a74d4ba734e71fc504c2435158f136467892b933dfc62ac565272c1766b7666687332a5995e65c485d4c195b0fe3209fb4e240

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Filesize
243KB

MD5
db7542c94faff2eed46d3c9170cd2786

SHA1
b812d37f28b23a95bfacd0c7801c0b769a3e5577

SHA256
7a1d1a3b4b6be14cad57a03f92d8e66b5d911fd7315981fac9626b8b64ee5ce0

SHA512
b181653585d4898193e33d3059a74d4ba734e71fc504c2435158f136467892b933dfc62ac565272c1766b7666687332a5995e65c485d4c195b0fe3209fb4e240

Download Submit
C:\Users\Admin\AppData\Local\Temp\UZ5b0X.Cpl
Filesize
1.6MB

MD5
a163f92317d991ac288fee15031d2a6a

SHA1
4c8c6b24e4d0f33565761f44af6febd66b5a6c60

SHA256
2401da973948ec2efe77b365ce0f9eab6476eda80705b7da6ca13f952816cfed

SHA512
9d4624635eaefe611ae062cf1b2e887b12460ef1e53267218db13a9500625d68d2b386e7af1a94e5bde131b256d458448338bf5fee1d3a64f27cb2e537e898ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\UZ5b0X.cpl
Filesize
1.6MB

MD5
a163f92317d991ac288fee15031d2a6a

SHA1
4c8c6b24e4d0f33565761f44af6febd66b5a6c60

SHA256
2401da973948ec2efe77b365ce0f9eab6476eda80705b7da6ca13f952816cfed

SHA512
9d4624635eaefe611ae062cf1b2e887b12460ef1e53267218db13a9500625d68d2b386e7af1a94e5bde131b256d458448338bf5fee1d3a64f27cb2e537e898ef

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
126KB

MD5
d3cb6267ee9076d5aef4a2dbe0d815c8

SHA1
840218680463914d50509ed6d7858e328fc8a54c

SHA256
fea6ecd2a63044cc6be256142021fc91564c2ae1705620efc2fe6a3f4e265689

SHA512
4c10709ae5288dae7d297beecca29b7700e2926787941139e81c61eb4ad0790152991d7447c4243891c51115f5a9dd43b4c0e7dd0f9dfdbe1cc466fbe9f3841a

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
126KB

MD5
d3cb6267ee9076d5aef4a2dbe0d815c8

SHA1
840218680463914d50509ed6d7858e328fc8a54c

SHA256
fea6ecd2a63044cc6be256142021fc91564c2ae1705620efc2fe6a3f4e265689

SHA512
4c10709ae5288dae7d297beecca29b7700e2926787941139e81c61eb4ad0790152991d7447c4243891c51115f5a9dd43b4c0e7dd0f9dfdbe1cc466fbe9f3841a

Download Submit
memory/572-211-0x000000000060F000-0x000000000062E000-memory.dmp

Filesize
124KB

Download
memory/572-212-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/952-185-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/952-152-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/952-151-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/952-158-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/952-149-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/952-148-0x0000000000000000-mapping.dmp

Download
memory/952-153-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1312-197-0x0000000000000000-mapping.dmp

Download
memory/1592-220-0x0000000000000000-mapping.dmp

Download
memory/1592-147-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1592-132-0x000000000054D000-0x000000000056C000-memory.dmp

Filesize
124KB

Download
memory/1592-221-0x0000000000EC0000-0x00000000012F3000-memory.dmp

Filesize
4.2MB

Download
memory/1592-222-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/1592-223-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/1592-134-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1592-146-0x000000000054D000-0x000000000056C000-memory.dmp

Filesize
124KB

Download
memory/1592-133-0x00000000020A0000-0x00000000020DE000-memory.dmp

Filesize
248KB

Download
memory/1652-204-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/1652-203-0x0000000000740000-0x0000000000804000-memory.dmp

Filesize
784KB

Download
memory/1652-200-0x0000000000000000-mapping.dmp

Download
memory/1652-205-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/2124-206-0x0000000007E70000-0x0000000007EE6000-memory.dmp

Filesize
472KB

Download
memory/2124-179-0x0000000007380000-0x000000000748A000-memory.dmp

Filesize
1.0MB

Download
memory/2124-195-0x0000000007F10000-0x0000000007FA2000-memory.dmp

Filesize
584KB

Download
memory/2124-154-0x0000000000000000-mapping.dmp

Download
memory/2124-178-0x00000000059F0000-0x0000000006008000-memory.dmp

Filesize
6.1MB

Download
memory/2124-207-0x00000000083C0000-0x0000000008410000-memory.dmp

Filesize
320KB

Download
memory/2124-157-0x00000000004D0000-0x00000000004F8000-memory.dmp

Filesize
160KB

Download
memory/2124-180-0x00000000072B0000-0x00000000072C2000-memory.dmp

Filesize
72KB

Download
memory/2124-182-0x0000000007310000-0x000000000734C000-memory.dmp

Filesize
240KB

Download
memory/2124-194-0x0000000007E00000-0x0000000007E66000-memory.dmp

Filesize
408KB

Download
memory/2664-196-0x0000000000000000-mapping.dmp

Download
memory/2708-213-0x0000000000000000-mapping.dmp

Download
memory/2872-216-0x0000000000000000-mapping.dmp

Download
memory/2872-217-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2872-218-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2872-219-0x0000000000D10000-0x0000000000D1A000-memory.dmp

Filesize
40KB

Download
memory/2872-224-0x0000000000D10000-0x0000000000D1A000-memory.dmp

Filesize
40KB

Download
memory/3032-181-0x000000000068C000-0x00000000006AB000-memory.dmp

Filesize
124KB

Download
memory/3032-139-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3032-135-0x0000000000000000-mapping.dmp

Download
memory/3032-183-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3032-138-0x000000000068C000-0x00000000006AB000-memory.dmp

Filesize
124KB

Download
memory/3216-144-0x00000000004F0000-0x0000000000558000-memory.dmp

Filesize
416KB

Download
memory/3216-141-0x0000000000000000-mapping.dmp

Download
memory/3216-145-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/3308-186-0x0000000000000000-mapping.dmp

Download
memory/3984-140-0x0000000000000000-mapping.dmp

Download
memory/4456-187-0x0000000000000000-mapping.dmp

Download
memory/4456-190-0x00000000004C0000-0x00000000004E8000-memory.dmp

Filesize
160KB

Download
memory/4456-210-0x0000000009400000-0x000000000992C000-memory.dmp

Filesize
5.2MB

Download
memory/4456-209-0x0000000008D00000-0x0000000008EC2000-memory.dmp

Filesize
1.8MB

Download
memory/4584-184-0x0000000000000000-mapping.dmp

Download
memory/4940-227-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-226-0x000000000065F000-0x000000000067E000-memory.dmp

Filesize
124KB

Download
memory/5084-191-0x0000000000000000-mapping.dmp

Download