amadey | 8d60d0f19ac81c852a30662032988c9d48fb3300ae03ca9744be2a030bddcede

Analysis

max time kernel
110s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2023 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36d56d783d89fa962428e75d53fa1577.exe
Size

1.0MB
MD5

36d56d783d89fa962428e75d53fa1577
SHA1

0430b58b33993dd2738660d08fb68dd9d2e75ec6
SHA256

8d60d0f19ac81c852a30662032988c9d48fb3300ae03ca9744be2a030bddcede
SHA512

2b8dbdf6f8684818b779bff9905dd41f23ccede15d6ae2bce1b0f1cb4fc0e75d2647fc7fb513ed6f5cb8e694a2bac77a14aed3c98502a5930b423b3561f42f4c
SSDEEP

24576:XyKSVEFsRyZSbuLEcoOHuIwGlbLAPW7W:iKS+FEdAEcohIZ7

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

ns1739nd.exemx7838XH.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns1739nd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns1739nd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	mx7838XH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	mx7838XH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mx7838XH.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	ns1739nd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns1739nd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	mx7838XH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	mx7838XH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	mx7838XH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns1739nd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns1739nd.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3412-212-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-213-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-215-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-217-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-219-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-223-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-221-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-225-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-227-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-233-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-231-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-229-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-235-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-237-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-239-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-241-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-243-0x0000000007680000-0x00000000076BE000-memory.dmp	family_redline
behavioral2/memory/3412-289-0x0000000004B90000-0x0000000004BA0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ry91Vf41.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	ry91Vf41.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 10 IoCs

Processes:

will9650.exewill8347.exewill0934.exemx7838XH.exens1739nd.exepy72Or87.exeqs8999sJ.exery91Vf41.exelegenda.exelegenda.exe

pid	process
544	will9650.exe
1804	will8347.exe
3088	will0934.exe
2360	mx7838XH.exe
3808	ns1739nd.exe
3412	py72Or87.exe
5080	qs8999sJ.exe
524	ry91Vf41.exe
2652	legenda.exe
1288	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4528 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4528	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

ns1739nd.exemx7838XH.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	ns1739nd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns1739nd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	mx7838XH.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

will9650.exewill8347.exewill0934.exe36d56d783d89fa962428e75d53fa1577.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will9650.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will8347.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will8347.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0934.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	will0934.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	36d56d783d89fa962428e75d53fa1577.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	36d56d783d89fa962428e75d53fa1577.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will9650.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4600 3808 WerFault.exe ns1739nd.exe
2824 3412 WerFault.exe py72Or87.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3440 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

mx7838XH.exens1739nd.exepy72Or87.exe

pid process

2360 mx7838XH.exe
2360 mx7838XH.exe
3808 ns1739nd.exe
3808 ns1739nd.exe
3412 py72Or87.exe
3412 py72Or87.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

mx7838XH.exens1739nd.exepy72Or87.exe

description pid process

Token: SeDebugPrivilege 2360 mx7838XH.exe
Token: SeDebugPrivilege 3808 ns1739nd.exe
Token: SeDebugPrivilege 3412 py72Or87.exe

pid	pid_target	process	target process
4600	3808	WerFault.exe	ns1739nd.exe
2824	3412	WerFault.exe	py72Or87.exe

pid	process
3440	schtasks.exe

pid	process
2360	mx7838XH.exe
2360	mx7838XH.exe
3808	ns1739nd.exe
3808	ns1739nd.exe
3412	py72Or87.exe
3412	py72Or87.exe

description	pid	process
Token: SeDebugPrivilege	2360	mx7838XH.exe
Token: SeDebugPrivilege	3808	ns1739nd.exe
Token: SeDebugPrivilege	3412	py72Or87.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

36d56d783d89fa962428e75d53fa1577.exewill9650.exewill8347.exewill0934.exery91Vf41.exelegenda.execmd.exe

description	pid	process	target process
PID 4768 wrote to memory of 544	4768	36d56d783d89fa962428e75d53fa1577.exe	will9650.exe
PID 4768 wrote to memory of 544	4768	36d56d783d89fa962428e75d53fa1577.exe	will9650.exe
PID 4768 wrote to memory of 544	4768	36d56d783d89fa962428e75d53fa1577.exe	will9650.exe
PID 544 wrote to memory of 1804	544	will9650.exe	will8347.exe
PID 544 wrote to memory of 1804	544	will9650.exe	will8347.exe
PID 544 wrote to memory of 1804	544	will9650.exe	will8347.exe
PID 1804 wrote to memory of 3088	1804	will8347.exe	will0934.exe
PID 1804 wrote to memory of 3088	1804	will8347.exe	will0934.exe
PID 1804 wrote to memory of 3088	1804	will8347.exe	will0934.exe
PID 3088 wrote to memory of 2360	3088	will0934.exe	mx7838XH.exe
PID 3088 wrote to memory of 2360	3088	will0934.exe	mx7838XH.exe
PID 3088 wrote to memory of 3808	3088	will0934.exe	ns1739nd.exe
PID 3088 wrote to memory of 3808	3088	will0934.exe	ns1739nd.exe
PID 3088 wrote to memory of 3808	3088	will0934.exe	ns1739nd.exe
PID 1804 wrote to memory of 3412	1804	will8347.exe	py72Or87.exe
PID 1804 wrote to memory of 3412	1804	will8347.exe	py72Or87.exe
PID 1804 wrote to memory of 3412	1804	will8347.exe	py72Or87.exe
PID 544 wrote to memory of 5080	544	will9650.exe	qs8999sJ.exe
PID 544 wrote to memory of 5080	544	will9650.exe	qs8999sJ.exe
PID 544 wrote to memory of 5080	544	will9650.exe	qs8999sJ.exe
PID 4768 wrote to memory of 524	4768	36d56d783d89fa962428e75d53fa1577.exe	ry91Vf41.exe
PID 4768 wrote to memory of 524	4768	36d56d783d89fa962428e75d53fa1577.exe	ry91Vf41.exe
PID 4768 wrote to memory of 524	4768	36d56d783d89fa962428e75d53fa1577.exe	ry91Vf41.exe
PID 524 wrote to memory of 2652	524	ry91Vf41.exe	legenda.exe
PID 524 wrote to memory of 2652	524	ry91Vf41.exe	legenda.exe
PID 524 wrote to memory of 2652	524	ry91Vf41.exe	legenda.exe
PID 2652 wrote to memory of 3440	2652	legenda.exe	schtasks.exe
PID 2652 wrote to memory of 3440	2652	legenda.exe	schtasks.exe
PID 2652 wrote to memory of 3440	2652	legenda.exe	schtasks.exe
PID 2652 wrote to memory of 4008	2652	legenda.exe	cmd.exe
PID 2652 wrote to memory of 4008	2652	legenda.exe	cmd.exe
PID 2652 wrote to memory of 4008	2652	legenda.exe	cmd.exe
PID 4008 wrote to memory of 4592	4008	cmd.exe	cmd.exe
PID 4008 wrote to memory of 4592	4008	cmd.exe	cmd.exe
PID 4008 wrote to memory of 4592	4008	cmd.exe	cmd.exe
PID 4008 wrote to memory of 2232	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 2232	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 2232	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 3688	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 3688	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 3688	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 1020	4008	cmd.exe	cmd.exe
PID 4008 wrote to memory of 1020	4008	cmd.exe	cmd.exe
PID 4008 wrote to memory of 1020	4008	cmd.exe	cmd.exe
PID 4008 wrote to memory of 4996	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 4996	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 4996	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 2668	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 2668	4008	cmd.exe	cacls.exe
PID 4008 wrote to memory of 2668	4008	cmd.exe	cacls.exe
PID 2652 wrote to memory of 4528	2652	legenda.exe	rundll32.exe
PID 2652 wrote to memory of 4528	2652	legenda.exe	rundll32.exe
PID 2652 wrote to memory of 4528	2652	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\36d56d783d89fa962428e75d53fa1577.exe
"C:\Users\Admin\AppData\Local\Temp\36d56d783d89fa962428e75d53fa1577.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9650.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9650.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8347.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8347.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0934.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0934.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3088

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7838XH.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7838XH.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns1739nd.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns1739nd.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1080
6⤵
- Program crash
PID:4600

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py72Or87.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py72Or87.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1336
5⤵
- Program crash
PID:2824

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs8999sJ.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs8999sJ.exe
3⤵
- Executes dropped EXE
PID:5080

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry91Vf41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry91Vf41.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4592

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:2232

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1020

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4996

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:2668

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3808 -ip 3808
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3412 -ip 3412
1⤵
PID:5092

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:1288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry91Vf41.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry91Vf41.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9650.exe
Filesize
851KB

MD5
562fb7a6699a72b309c38d95c1e3831d

SHA1
16dae93cd9b220acf5653bf5bbd6c4d81bd35316

SHA256
ee2bbd4a08f1d25ba0b22d6bc5e0d68696bf73e530aeb8c5d88af5d6862c19a6

SHA512
7bcfc18e60362ea4f857774275fa9e6777af0459db88848b4c6c5434f920537a6d217c2072aee323ae7da6920e8c52fc68dd1816e992852b703b552d037093f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9650.exe
Filesize
851KB

MD5
562fb7a6699a72b309c38d95c1e3831d

SHA1
16dae93cd9b220acf5653bf5bbd6c4d81bd35316

SHA256
ee2bbd4a08f1d25ba0b22d6bc5e0d68696bf73e530aeb8c5d88af5d6862c19a6

SHA512
7bcfc18e60362ea4f857774275fa9e6777af0459db88848b4c6c5434f920537a6d217c2072aee323ae7da6920e8c52fc68dd1816e992852b703b552d037093f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs8999sJ.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8347.exe
Filesize
706KB

MD5
273115a58ca529858aebc852361bc126

SHA1
cf2aeba2f2b82ed09c821fc5dda32db8454ca1d8

SHA256
db0709add0004d175ed3a82c387ff2941c658bf3e1a13baf2a159153213f3ad9

SHA512
060880cd200830266894968ff65dcc60f857af6b1d464b0efdda451773ea999628f317f560f373b89c755500215e7c52d3a803f74ffcc25ac9e0a9a09dc343c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8347.exe
Filesize
706KB

MD5
273115a58ca529858aebc852361bc126

SHA1
cf2aeba2f2b82ed09c821fc5dda32db8454ca1d8

SHA256
db0709add0004d175ed3a82c387ff2941c658bf3e1a13baf2a159153213f3ad9

SHA512
060880cd200830266894968ff65dcc60f857af6b1d464b0efdda451773ea999628f317f560f373b89c755500215e7c52d3a803f74ffcc25ac9e0a9a09dc343c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py72Or87.exe
Filesize
391KB

MD5
34852a61e6566663b4bcdaf5e248206d

SHA1
d31e05f18136aac97317d4672a6b8b2d4ce1a7de

SHA256
211e7ee40dd8791b8a413842fad6cf626a877e862b739298dc55ac307a92f9ef

SHA512
26ad36f0bd3a9c319f58f7aee8e0174ca5f528d65f20f0d79e6880a6fe9c27bcb08dba97fe51b668d0550a9841c0600396f4c496a441686228c968d224ef5359

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py72Or87.exe
Filesize
391KB

MD5
34852a61e6566663b4bcdaf5e248206d

SHA1
d31e05f18136aac97317d4672a6b8b2d4ce1a7de

SHA256
211e7ee40dd8791b8a413842fad6cf626a877e862b739298dc55ac307a92f9ef

SHA512
26ad36f0bd3a9c319f58f7aee8e0174ca5f528d65f20f0d79e6880a6fe9c27bcb08dba97fe51b668d0550a9841c0600396f4c496a441686228c968d224ef5359

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0934.exe
Filesize
353KB

MD5
dd32b5107c6fe7cf76fd8ddc795b10f4

SHA1
c3aa88665a0abf314e3185a636540bf40136b31d

SHA256
d3cb9326d4ae5876cba30ce5cd00c5bf5377cb4d619619b9c97bc1f5f2d76a80

SHA512
dbd346bd78010bed17af369aa1f7537b86858269d9073c62dc371f63c2a0a3466ff54517b0ed2de74571525b963a8e95d71a4de8640d46784d1701d5f656c895

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0934.exe
Filesize
353KB

MD5
dd32b5107c6fe7cf76fd8ddc795b10f4

SHA1
c3aa88665a0abf314e3185a636540bf40136b31d

SHA256
d3cb9326d4ae5876cba30ce5cd00c5bf5377cb4d619619b9c97bc1f5f2d76a80

SHA512
dbd346bd78010bed17af369aa1f7537b86858269d9073c62dc371f63c2a0a3466ff54517b0ed2de74571525b963a8e95d71a4de8640d46784d1701d5f656c895

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7838XH.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7838XH.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns1739nd.exe
Filesize
333KB

MD5
66d4817a82cbd67f1777abd575ac3458

SHA1
dc74149ee8c0d1c34e318bee6e149116bc8ac28a

SHA256
f0f23af9d25368adc3c3fd2f699aa12029253d71e56033c8ef1e85dcc3726d64

SHA512
e87a246d45e913080ce19f5102890dd74b397c1b8092fbc23bc248f044a194dae22fa390e62630cc66cbdd0f44471293579c3fe5e17667b8364a916278d14975

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns1739nd.exe
Filesize
333KB

MD5
66d4817a82cbd67f1777abd575ac3458

SHA1
dc74149ee8c0d1c34e318bee6e149116bc8ac28a

SHA256
f0f23af9d25368adc3c3fd2f699aa12029253d71e56033c8ef1e85dcc3726d64

SHA512
e87a246d45e913080ce19f5102890dd74b397c1b8092fbc23bc248f044a194dae22fa390e62630cc66cbdd0f44471293579c3fe5e17667b8364a916278d14975

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/2360-164-0x000000001CE00000-0x000000001CF4E000-memory.dmp

Filesize
1.3MB

Download
memory/2360-162-0x000000001CE00000-0x000000001CF4E000-memory.dmp

Filesize
1.3MB

Download
memory/2360-161-0x0000000000D20000-0x0000000000D2A000-memory.dmp

Filesize
40KB

Download
memory/3412-1124-0x0000000008060000-0x000000000809C000-memory.dmp

Filesize
240KB

Download
memory/3412-241-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-1134-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/3412-1133-0x000000000A6B0000-0x000000000A700000-memory.dmp

Filesize
320KB

Download
memory/3412-1132-0x000000000A620000-0x000000000A696000-memory.dmp

Filesize
472KB

Download
memory/3412-1131-0x0000000008E30000-0x000000000935C000-memory.dmp

Filesize
5.2MB

Download
memory/3412-1130-0x0000000008C50000-0x0000000008E12000-memory.dmp

Filesize
1.8MB

Download
memory/3412-1129-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/3412-1127-0x00000000083F0000-0x0000000008456000-memory.dmp

Filesize
408KB

Download
memory/3412-1126-0x0000000008350000-0x00000000083E2000-memory.dmp

Filesize
584KB

Download
memory/3412-1125-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/3412-1123-0x0000000008040000-0x0000000008052000-memory.dmp

Filesize
72KB

Download
memory/3412-1122-0x0000000007F00000-0x000000000800A000-memory.dmp

Filesize
1.0MB

Download
memory/3412-1121-0x0000000007860000-0x0000000007E78000-memory.dmp

Filesize
6.1MB

Download
memory/3412-212-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-213-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-215-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-217-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-219-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-223-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-221-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-225-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-227-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-233-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-231-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-229-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-235-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-237-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-239-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-289-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/3412-243-0x0000000007680000-0x00000000076BE000-memory.dmp

Filesize
248KB

Download
memory/3412-287-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/3412-285-0x0000000004770000-0x00000000047BB000-memory.dmp

Filesize
300KB

Download
memory/3808-198-0x0000000004640000-0x000000000466D000-memory.dmp

Filesize
180KB

Download
memory/3808-189-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-193-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-207-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/3808-191-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-206-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3808-205-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3808-187-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-202-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/3808-201-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3808-200-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3808-199-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3808-195-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-197-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-204-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/3808-183-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-185-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-175-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-181-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-177-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-179-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-173-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-171-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-170-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3808-169-0x0000000007180000-0x0000000007724000-memory.dmp

Filesize
5.6MB

Download