amadey | 67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067

Analysis

max time kernel
143s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2023 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.0MB
MD5

16660f033fcaebf744365ec2f9fe79b3
SHA1

33ce6f5891fd258b82336c9a08e71ac77559cb1f
SHA256

67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067
SHA512

86dc9022a0b32b9e2cf5b3712dc0e45e8cb5b68ed89045d72bdc1b4ad4af332f733457e266cd2a62ab1be44bf46ddf8efdd75ab5b19fd6e064ffb8267ecc36c4
SSDEEP

24576:ry7e8MO34FjHHKCrnTLHFIfqHkd6cDKRidC3MkiIXzIoT:e7e8dMHH7nTxICa6cDUP3nZXEo

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

mx7407xs.exens8993bN.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mx7407xs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	mx7407xs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns8993bN.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4792-210-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-211-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-213-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-215-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-217-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-219-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-221-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-223-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-225-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-227-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-229-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-231-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-235-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-233-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-237-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-241-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-240-0x0000000007250000-0x0000000007260000-memory.dmp	family_redline
behavioral2/memory/4792-244-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral2/memory/4792-246-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ry67eJ11.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ry67eJ11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 10 IoCs

Processes:

will0157.exewill0432.exewill0507.exemx7407xs.exens8993bN.exepy07ck14.exeqs1679oq.exery67eJ11.exelegenda.exelegenda.exe

pid	process
4844	will0157.exe
3508	will0432.exe
1812	will0507.exe
3704	mx7407xs.exe
4800	ns8993bN.exe
4792	py07ck14.exe
992	qs1679oq.exe
2420	ry67eJ11.exe
4128	legenda.exe
5096	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3776 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3776	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

mx7407xs.exens8993bN.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	mx7407xs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	ns8993bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns8993bN.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

will0432.exewill0507.exesetup.exewill0157.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will0432.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0507.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	will0507.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will0157.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0432.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1412 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2156 4800 WerFault.exe ns8993bN.exe
4156 4792 WerFault.exe py07ck14.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4132 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

mx7407xs.exens8993bN.exepy07ck14.exeqs1679oq.exe

pid process

3704 mx7407xs.exe
3704 mx7407xs.exe
4800 ns8993bN.exe
4800 ns8993bN.exe
4792 py07ck14.exe
4792 py07ck14.exe
992 qs1679oq.exe
992 qs1679oq.exe

pid	process
1412	sc.exe

pid	pid_target	process	target process
2156	4800	WerFault.exe	ns8993bN.exe
4156	4792	WerFault.exe	py07ck14.exe

pid	process
4132	schtasks.exe

pid	process
3704	mx7407xs.exe
3704	mx7407xs.exe
4800	ns8993bN.exe
4800	ns8993bN.exe
4792	py07ck14.exe
4792	py07ck14.exe
992	qs1679oq.exe
992	qs1679oq.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

mx7407xs.exens8993bN.exepy07ck14.exeqs1679oq.exe

description	pid	process
Token: SeDebugPrivilege	3704	mx7407xs.exe
Token: SeDebugPrivilege	4800	ns8993bN.exe
Token: SeDebugPrivilege	4792	py07ck14.exe
Token: SeDebugPrivilege	992	qs1679oq.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

setup.exewill0157.exewill0432.exewill0507.exery67eJ11.exelegenda.execmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 4844	4940	setup.exe	will0157.exe
PID 4940 wrote to memory of 4844	4940	setup.exe	will0157.exe
PID 4940 wrote to memory of 4844	4940	setup.exe	will0157.exe
PID 4844 wrote to memory of 3508	4844	will0157.exe	will0432.exe
PID 4844 wrote to memory of 3508	4844	will0157.exe	will0432.exe
PID 4844 wrote to memory of 3508	4844	will0157.exe	will0432.exe
PID 3508 wrote to memory of 1812	3508	will0432.exe	will0507.exe
PID 3508 wrote to memory of 1812	3508	will0432.exe	will0507.exe
PID 3508 wrote to memory of 1812	3508	will0432.exe	will0507.exe
PID 1812 wrote to memory of 3704	1812	will0507.exe	mx7407xs.exe
PID 1812 wrote to memory of 3704	1812	will0507.exe	mx7407xs.exe
PID 1812 wrote to memory of 4800	1812	will0507.exe	ns8993bN.exe
PID 1812 wrote to memory of 4800	1812	will0507.exe	ns8993bN.exe
PID 1812 wrote to memory of 4800	1812	will0507.exe	ns8993bN.exe
PID 3508 wrote to memory of 4792	3508	will0432.exe	py07ck14.exe
PID 3508 wrote to memory of 4792	3508	will0432.exe	py07ck14.exe
PID 3508 wrote to memory of 4792	3508	will0432.exe	py07ck14.exe
PID 4844 wrote to memory of 992	4844	will0157.exe	qs1679oq.exe
PID 4844 wrote to memory of 992	4844	will0157.exe	qs1679oq.exe
PID 4844 wrote to memory of 992	4844	will0157.exe	qs1679oq.exe
PID 4940 wrote to memory of 2420	4940	setup.exe	ry67eJ11.exe
PID 4940 wrote to memory of 2420	4940	setup.exe	ry67eJ11.exe
PID 4940 wrote to memory of 2420	4940	setup.exe	ry67eJ11.exe
PID 2420 wrote to memory of 4128	2420	ry67eJ11.exe	legenda.exe
PID 2420 wrote to memory of 4128	2420	ry67eJ11.exe	legenda.exe
PID 2420 wrote to memory of 4128	2420	ry67eJ11.exe	legenda.exe
PID 4128 wrote to memory of 4132	4128	legenda.exe	schtasks.exe
PID 4128 wrote to memory of 4132	4128	legenda.exe	schtasks.exe
PID 4128 wrote to memory of 4132	4128	legenda.exe	schtasks.exe
PID 4128 wrote to memory of 2056	4128	legenda.exe	cmd.exe
PID 4128 wrote to memory of 2056	4128	legenda.exe	cmd.exe
PID 4128 wrote to memory of 2056	4128	legenda.exe	cmd.exe
PID 2056 wrote to memory of 2388	2056	cmd.exe	cmd.exe
PID 2056 wrote to memory of 2388	2056	cmd.exe	cmd.exe
PID 2056 wrote to memory of 2388	2056	cmd.exe	cmd.exe
PID 2056 wrote to memory of 4800	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 4800	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 4800	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 4148	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 4148	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 4148	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 1812	2056	cmd.exe	cmd.exe
PID 2056 wrote to memory of 1812	2056	cmd.exe	cmd.exe
PID 2056 wrote to memory of 1812	2056	cmd.exe	cmd.exe
PID 2056 wrote to memory of 3500	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 3500	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 3500	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 3656	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 3656	2056	cmd.exe	cacls.exe
PID 2056 wrote to memory of 3656	2056	cmd.exe	cacls.exe
PID 4128 wrote to memory of 3776	4128	legenda.exe	rundll32.exe
PID 4128 wrote to memory of 3776	4128	legenda.exe	rundll32.exe
PID 4128 wrote to memory of 3776	4128	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4844

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3508

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1080
6⤵
- Program crash
PID:2156

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 2052
5⤵
- Program crash
PID:4156

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:4132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2388

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:4800

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1812

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:3500

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3656

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4800 -ip 4800
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4792 -ip 4792
1⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry67eJ11.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
Filesize
851KB

MD5
ef5889763c11ca181c56e65b2f5b2a0e

SHA1
23d60bfbffeacb9958fa55dbe80d88fbd2d96a7e

SHA256
b2234873cd79f834d388fcea9ab543d6a884f5e4e5dcadf50056a556bab7e68d

SHA512
fb51ba58e24fb73ba5dfc50cf3afafbd076cc4380aa48a2719860245d1a77f37325ebb82bfb4ad8e8d52782b64b2b00a04061f5ac8b140a05987917fb55b910b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0157.exe
Filesize
851KB

MD5
ef5889763c11ca181c56e65b2f5b2a0e

SHA1
23d60bfbffeacb9958fa55dbe80d88fbd2d96a7e

SHA256
b2234873cd79f834d388fcea9ab543d6a884f5e4e5dcadf50056a556bab7e68d

SHA512
fb51ba58e24fb73ba5dfc50cf3afafbd076cc4380aa48a2719860245d1a77f37325ebb82bfb4ad8e8d52782b64b2b00a04061f5ac8b140a05987917fb55b910b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs1679oq.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
Filesize
707KB

MD5
63a2649ae317c013c51c5b875b96c7e0

SHA1
18c8397a3b61c5db1d38dcbf10cd1871941563e3

SHA256
83343d77de6bdd56694309bc4af0906418c0266227e3f531145d6edd0cbe1042

SHA512
ae98fb451158c82cafa85ae7fb3e9f776bce4d6cfd0a491851c909964fe83a82a308030e4cec34ff67b71c7f157f75d92a009464535ad0b81d9130052edd20a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will0432.exe
Filesize
707KB

MD5
63a2649ae317c013c51c5b875b96c7e0

SHA1
18c8397a3b61c5db1d38dcbf10cd1871941563e3

SHA256
83343d77de6bdd56694309bc4af0906418c0266227e3f531145d6edd0cbe1042

SHA512
ae98fb451158c82cafa85ae7fb3e9f776bce4d6cfd0a491851c909964fe83a82a308030e4cec34ff67b71c7f157f75d92a009464535ad0b81d9130052edd20a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
Filesize
391KB

MD5
324d31bcb4e62eea8a833e89ac9bd158

SHA1
9910f4606c492dbaa071321b3e69ee7d53e7836e

SHA256
f1f4076aa99a72dba7c5e722d018217ae8463176b6292157229ba4e0977dbc12

SHA512
d9a16348a2d870790f962bdcb0dc5f57ce882f62ac5749e95e76073b3eb6f840ac4ddc1fd8fcaf323f88ec77fdb9e8c441597d3d6a30f39133b581be8075c5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py07ck14.exe
Filesize
391KB

MD5
324d31bcb4e62eea8a833e89ac9bd158

SHA1
9910f4606c492dbaa071321b3e69ee7d53e7836e

SHA256
f1f4076aa99a72dba7c5e722d018217ae8463176b6292157229ba4e0977dbc12

SHA512
d9a16348a2d870790f962bdcb0dc5f57ce882f62ac5749e95e76073b3eb6f840ac4ddc1fd8fcaf323f88ec77fdb9e8c441597d3d6a30f39133b581be8075c5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
Filesize
353KB

MD5
2c1d2d8088f4064e1fb0ef5d6c4cbb91

SHA1
7824674546f86e63db81ca7c6f33990154f81493

SHA256
c18dd165b2688f9afb6e723a4da90d42a85943471aacfd4b1c84d3742166d178

SHA512
c281ae614fc85753e736804d1dfdeae91a880b8e8e56216a3082a7c1ca0c46d16618bea992796b28da171fe9be4cca91c82061c52ec40f5d8029a5c4e1bc8a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0507.exe
Filesize
353KB

MD5
2c1d2d8088f4064e1fb0ef5d6c4cbb91

SHA1
7824674546f86e63db81ca7c6f33990154f81493

SHA256
c18dd165b2688f9afb6e723a4da90d42a85943471aacfd4b1c84d3742166d178

SHA512
c281ae614fc85753e736804d1dfdeae91a880b8e8e56216a3082a7c1ca0c46d16618bea992796b28da171fe9be4cca91c82061c52ec40f5d8029a5c4e1bc8a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx7407xs.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
Filesize
333KB

MD5
ac0c7b7b2f53a198c9a3ce08ad47d2ae

SHA1
2636d0f8bfe5cdac7977f55f51b19d87a4e901fa

SHA256
6bebaf5dbdcaebca0bf98f08b0a2da800c22010f51b647c2014c865f66cabbfd

SHA512
91080422faa7119ed7777e3f66ff2c5a489481abeb18792d1b2b9e30c69f085df6bdf7dd59befac5d286db1037c070dacf9504b7cadd0d3e8df725dfc103287f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns8993bN.exe
Filesize
333KB

MD5
ac0c7b7b2f53a198c9a3ce08ad47d2ae

SHA1
2636d0f8bfe5cdac7977f55f51b19d87a4e901fa

SHA256
6bebaf5dbdcaebca0bf98f08b0a2da800c22010f51b647c2014c865f66cabbfd

SHA512
91080422faa7119ed7777e3f66ff2c5a489481abeb18792d1b2b9e30c69f085df6bdf7dd59befac5d286db1037c070dacf9504b7cadd0d3e8df725dfc103287f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/992-1141-0x0000000005850000-0x0000000005860000-memory.dmp

Filesize
64KB

Download
memory/992-1140-0x0000000000B50000-0x0000000000B82000-memory.dmp

Filesize
200KB

Download
memory/3704-161-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/4792-1128-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-246-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-1135-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-1133-0x0000000009100000-0x000000000962C000-memory.dmp

Filesize
5.2MB

Download
memory/4792-1132-0x0000000008F30000-0x00000000090F2000-memory.dmp

Filesize
1.8MB

Download
memory/4792-1131-0x0000000008CA0000-0x0000000008CF0000-memory.dmp

Filesize
320KB

Download
memory/4792-1130-0x0000000008C10000-0x0000000008C86000-memory.dmp

Filesize
472KB

Download
memory/4792-1129-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-1127-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-1126-0x00000000083F0000-0x0000000008456000-memory.dmp

Filesize
408KB

Download
memory/4792-1125-0x0000000008350000-0x00000000083E2000-memory.dmp

Filesize
584KB

Download
memory/4792-210-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-211-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-213-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-215-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-217-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-219-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-221-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-223-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-225-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-227-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-229-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-231-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-235-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-233-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-239-0x0000000002DC0000-0x0000000002E0B000-memory.dmp

Filesize
300KB

Download
memory/4792-237-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-241-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-240-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-242-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-244-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4792-1123-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/4792-1119-0x0000000007910000-0x0000000007F28000-memory.dmp

Filesize
6.1MB

Download
memory/4792-1120-0x0000000007F30000-0x000000000803A000-memory.dmp

Filesize
1.0MB

Download
memory/4792-1121-0x0000000008040000-0x0000000008052000-memory.dmp

Filesize
72KB

Download
memory/4792-1122-0x0000000008060000-0x000000000809C000-memory.dmp

Filesize
240KB

Download
memory/4800-185-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-205-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/4800-195-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-189-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-183-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-203-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4800-204-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4800-181-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-200-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/4800-199-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-197-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-187-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-193-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-191-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-202-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4800-179-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-177-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-175-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-173-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-171-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/4800-172-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4800-170-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4800-169-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/4800-168-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

Filesize
180KB

Download
memory/4800-167-0x0000000007130000-0x00000000076D4000-memory.dmp

Filesize
5.6MB

Download