amadey | e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe
Size

961KB
MD5

645688f2e4f4c2e4b7a79bac74ce60e3
SHA1

b89042766c0c3b10177ab06a46cd0355bffe0aff
SHA256

e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62
SHA512

d65911184f4d15e08ca3be97441d25ac981eb807256abd8095c6cae75de71bff9205ae3f078aaa6dbdb8e2e5e857790e68acc43764961fb8a93b1eb1eef0178c
SSDEEP

24576:OyihxtMbvNiFrHLOtgfcFRqnFpMNxQ986VbDqdr:dihjQvQVrOtAcWFKNWSo2

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v4519oB.exetz6902.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v4519oB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz6902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz6902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz6902.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v4519oB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v4519oB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v4519oB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v4519oB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz6902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz6902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz6902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v4519oB.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3192-209-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-210-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-212-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-214-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-216-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-218-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-220-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-222-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-224-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-226-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-228-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-230-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-232-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-234-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-236-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-238-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-240-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline
behavioral1/memory/3192-242-0x0000000005040000-0x000000000507E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

legenda.exey15eo95.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legenda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y15eo95.exe

Executes dropped EXE 11 IoCs

Processes:

zap7548.exezap8999.exezap0173.exetz6902.exev4519oB.exew00sF83.exexotGO74.exey15eo95.exelegenda.exelegenda.exelegenda.exe

pid	process
3528	zap7548.exe
4476	zap8999.exe
1816	zap0173.exe
3800	tz6902.exe
380	v4519oB.exe
3192	w00sF83.exe
388	xotGO74.exe
3804	y15eo95.exe
732	legenda.exe
4432	legenda.exe
2548	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3504 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3504	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz6902.exev4519oB.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz6902.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v4519oB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v4519oB.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap8999.exezap0173.exee0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exezap7548.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap8999.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0173.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap0173.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap7548.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap7548.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8999.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4368 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2056 380 WerFault.exe v4519oB.exe
2496 3192 WerFault.exe w00sF83.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2616 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz6902.exev4519oB.exew00sF83.exexotGO74.exe

pid process

3800 tz6902.exe
3800 tz6902.exe
380 v4519oB.exe
380 v4519oB.exe
3192 w00sF83.exe
3192 w00sF83.exe
388 xotGO74.exe
388 xotGO74.exe

pid	process
4368	sc.exe

pid	pid_target	process	target process
2056	380	WerFault.exe	v4519oB.exe
2496	3192	WerFault.exe	w00sF83.exe

pid	process
2616	schtasks.exe

pid	process
3800	tz6902.exe
3800	tz6902.exe
380	v4519oB.exe
380	v4519oB.exe
3192	w00sF83.exe
3192	w00sF83.exe
388	xotGO74.exe
388	xotGO74.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz6902.exev4519oB.exew00sF83.exexotGO74.exe

description	pid	process
Token: SeDebugPrivilege	3800	tz6902.exe
Token: SeDebugPrivilege	380	v4519oB.exe
Token: SeDebugPrivilege	3192	w00sF83.exe
Token: SeDebugPrivilege	388	xotGO74.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exezap7548.exezap8999.exezap0173.exey15eo95.exelegenda.execmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 3528	4940	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe	zap7548.exe
PID 4940 wrote to memory of 3528	4940	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe	zap7548.exe
PID 4940 wrote to memory of 3528	4940	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe	zap7548.exe
PID 3528 wrote to memory of 4476	3528	zap7548.exe	zap8999.exe
PID 3528 wrote to memory of 4476	3528	zap7548.exe	zap8999.exe
PID 3528 wrote to memory of 4476	3528	zap7548.exe	zap8999.exe
PID 4476 wrote to memory of 1816	4476	zap8999.exe	zap0173.exe
PID 4476 wrote to memory of 1816	4476	zap8999.exe	zap0173.exe
PID 4476 wrote to memory of 1816	4476	zap8999.exe	zap0173.exe
PID 1816 wrote to memory of 3800	1816	zap0173.exe	tz6902.exe
PID 1816 wrote to memory of 3800	1816	zap0173.exe	tz6902.exe
PID 1816 wrote to memory of 380	1816	zap0173.exe	v4519oB.exe
PID 1816 wrote to memory of 380	1816	zap0173.exe	v4519oB.exe
PID 1816 wrote to memory of 380	1816	zap0173.exe	v4519oB.exe
PID 4476 wrote to memory of 3192	4476	zap8999.exe	w00sF83.exe
PID 4476 wrote to memory of 3192	4476	zap8999.exe	w00sF83.exe
PID 4476 wrote to memory of 3192	4476	zap8999.exe	w00sF83.exe
PID 3528 wrote to memory of 388	3528	zap7548.exe	xotGO74.exe
PID 3528 wrote to memory of 388	3528	zap7548.exe	xotGO74.exe
PID 3528 wrote to memory of 388	3528	zap7548.exe	xotGO74.exe
PID 4940 wrote to memory of 3804	4940	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe	y15eo95.exe
PID 4940 wrote to memory of 3804	4940	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe	y15eo95.exe
PID 4940 wrote to memory of 3804	4940	e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe	y15eo95.exe
PID 3804 wrote to memory of 732	3804	y15eo95.exe	legenda.exe
PID 3804 wrote to memory of 732	3804	y15eo95.exe	legenda.exe
PID 3804 wrote to memory of 732	3804	y15eo95.exe	legenda.exe
PID 732 wrote to memory of 2616	732	legenda.exe	schtasks.exe
PID 732 wrote to memory of 2616	732	legenda.exe	schtasks.exe
PID 732 wrote to memory of 2616	732	legenda.exe	schtasks.exe
PID 732 wrote to memory of 2348	732	legenda.exe	cmd.exe
PID 732 wrote to memory of 2348	732	legenda.exe	cmd.exe
PID 732 wrote to memory of 2348	732	legenda.exe	cmd.exe
PID 2348 wrote to memory of 5096	2348	cmd.exe	cmd.exe
PID 2348 wrote to memory of 5096	2348	cmd.exe	cmd.exe
PID 2348 wrote to memory of 5096	2348	cmd.exe	cmd.exe
PID 2348 wrote to memory of 2848	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 2848	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 2848	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 2056	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 2056	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 2056	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 3956	2348	cmd.exe	cmd.exe
PID 2348 wrote to memory of 3956	2348	cmd.exe	cmd.exe
PID 2348 wrote to memory of 3956	2348	cmd.exe	cmd.exe
PID 2348 wrote to memory of 4464	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 4464	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 4464	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 4412	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 4412	2348	cmd.exe	cacls.exe
PID 2348 wrote to memory of 4412	2348	cmd.exe	cacls.exe
PID 732 wrote to memory of 3504	732	legenda.exe	rundll32.exe
PID 732 wrote to memory of 3504	732	legenda.exe	rundll32.exe
PID 732 wrote to memory of 3504	732	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe
"C:\Users\Admin\AppData\Local\Temp\e0831df1efa8440e7b475f624f2e7842eef6aba6a7179fb5eabbcfb8cbcc1c62.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7548.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7548.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3528

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8999.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8999.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0173.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0173.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6902.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6902.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4519oB.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4519oB.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 1084
6⤵
- Program crash
PID:2056

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00sF83.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00sF83.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1352
5⤵
- Program crash
PID:2496

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xotGO74.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xotGO74.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15eo95.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15eo95.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:2616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:5096

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:2848

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:2056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3956

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4464

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:4412

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 380 -ip 380
1⤵
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3192 -ip 3192
1⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4368

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15eo95.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y15eo95.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7548.exe
Filesize
777KB

MD5
16f3743248b6a7022488424da4b5fb82

SHA1
34d209503c729e290ac27dccddfc63ba0d591a95

SHA256
a12cb129e43b1f91c3b1a489a734a7cabcfca130d3dfe6cd8dbaf871f5fd40b8

SHA512
1796ba26c743f686758924b533a6151545f558fc15bc4c15293843ecd4bb318052e7ed89f3bf73c7b0055b3ed56d8c77622d2b113cddeb2767b1ca530aef5e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7548.exe
Filesize
777KB

MD5
16f3743248b6a7022488424da4b5fb82

SHA1
34d209503c729e290ac27dccddfc63ba0d591a95

SHA256
a12cb129e43b1f91c3b1a489a734a7cabcfca130d3dfe6cd8dbaf871f5fd40b8

SHA512
1796ba26c743f686758924b533a6151545f558fc15bc4c15293843ecd4bb318052e7ed89f3bf73c7b0055b3ed56d8c77622d2b113cddeb2767b1ca530aef5e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xotGO74.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xotGO74.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8999.exe
Filesize
635KB

MD5
88f067cd0eab2af9a0556ed96f7d5350

SHA1
dbb1dc60bdf106fe92350373dcf015043c654a52

SHA256
54e9b8705ff4fd8e2c3f6df53309b6a7224ae8fda38cc6c669a9d59b7a446c29

SHA512
0f0cafdb0cb77656c80e134b9471674d437a2b5fa92d76b8457f684a899825b5dcd0ab47c683da3a297a4e0971fac132b57dd47419cdaedc4f0fe9c888cc089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8999.exe
Filesize
635KB

MD5
88f067cd0eab2af9a0556ed96f7d5350

SHA1
dbb1dc60bdf106fe92350373dcf015043c654a52

SHA256
54e9b8705ff4fd8e2c3f6df53309b6a7224ae8fda38cc6c669a9d59b7a446c29

SHA512
0f0cafdb0cb77656c80e134b9471674d437a2b5fa92d76b8457f684a899825b5dcd0ab47c683da3a297a4e0971fac132b57dd47419cdaedc4f0fe9c888cc089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00sF83.exe
Filesize
287KB

MD5
c9291e66687db94061ff0335cbbad18c

SHA1
e69e0181fa02652c0244ba3beb4f8c9689e50d0a

SHA256
fc874801c9c491101e32192a6eb23b24e9fc91bb281353e2021e971bd420ecec

SHA512
4dc5135930fce8a60dc671e399f5c8625eaaf114b210cc3a7709f23ee0c10fc9f7fc270b5522c892e9e14ab3e1310e038aa863543d05bff42c628aede36563f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00sF83.exe
Filesize
287KB

MD5
c9291e66687db94061ff0335cbbad18c

SHA1
e69e0181fa02652c0244ba3beb4f8c9689e50d0a

SHA256
fc874801c9c491101e32192a6eb23b24e9fc91bb281353e2021e971bd420ecec

SHA512
4dc5135930fce8a60dc671e399f5c8625eaaf114b210cc3a7709f23ee0c10fc9f7fc270b5522c892e9e14ab3e1310e038aa863543d05bff42c628aede36563f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0173.exe
Filesize
314KB

MD5
7994628460f9383d03ae68203f653a41

SHA1
bb1081ada11f7d265db03a8d0f2bfd74b3dab8ad

SHA256
21f716b681cae2e64986ef82e057e6adf79c9772680ac51db6bbfdc5e0579f54

SHA512
96ff495bd030ea9ff3aa9bc4cf08508805430bb61f98ec8c99858ffc247ae1165fc2d42cab0f92b441b537efb07a73479b2db6be4876d6c3d712aec12b6a69a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0173.exe
Filesize
314KB

MD5
7994628460f9383d03ae68203f653a41

SHA1
bb1081ada11f7d265db03a8d0f2bfd74b3dab8ad

SHA256
21f716b681cae2e64986ef82e057e6adf79c9772680ac51db6bbfdc5e0579f54

SHA512
96ff495bd030ea9ff3aa9bc4cf08508805430bb61f98ec8c99858ffc247ae1165fc2d42cab0f92b441b537efb07a73479b2db6be4876d6c3d712aec12b6a69a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6902.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6902.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4519oB.exe
Filesize
229KB

MD5
43a68468f5ae9ccd29a4dd6cf790043c

SHA1
e51390aa22e6f1026525d8bebd1148df4c1ed777

SHA256
34b325d707810ba8da3e3098dfa5211610040cc51da9585cbdff216d386ca501

SHA512
53204063afd3f8b1430159834ca983cea470565fec28e7ac513118a64b1ca3656cefed9731d4ab07d18dc768a725523ceb23827838052f8093bc4a74239b426d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4519oB.exe
Filesize
229KB

MD5
43a68468f5ae9ccd29a4dd6cf790043c

SHA1
e51390aa22e6f1026525d8bebd1148df4c1ed777

SHA256
34b325d707810ba8da3e3098dfa5211610040cc51da9585cbdff216d386ca501

SHA512
53204063afd3f8b1430159834ca983cea470565fec28e7ac513118a64b1ca3656cefed9731d4ab07d18dc768a725523ceb23827838052f8093bc4a74239b426d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/380-167-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/380-183-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-191-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-193-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-195-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-197-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-199-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-200-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/380-201-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/380-202-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/380-204-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/380-187-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-185-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-189-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-181-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-179-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-177-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-175-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-173-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-172-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/380-171-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/380-170-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/380-169-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/380-168-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/388-1140-0x0000000000CF0000-0x0000000000D22000-memory.dmp

Filesize
200KB

Download
memory/388-1141-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/3192-224-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-240-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-242-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-363-0x00000000005F0000-0x000000000063B000-memory.dmp

Filesize
300KB

Download
memory/3192-364-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-366-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-368-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-1119-0x0000000005210000-0x0000000005828000-memory.dmp

Filesize
6.1MB

Download
memory/3192-1120-0x00000000058B0000-0x00000000059BA000-memory.dmp

Filesize
1.0MB

Download
memory/3192-1121-0x00000000059F0000-0x0000000005A02000-memory.dmp

Filesize
72KB

Download
memory/3192-1122-0x0000000005A10000-0x0000000005A4C000-memory.dmp

Filesize
240KB

Download
memory/3192-1123-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-1124-0x0000000005D00000-0x0000000005D92000-memory.dmp

Filesize
584KB

Download
memory/3192-1125-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/3192-1127-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-1128-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-1129-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-1130-0x0000000006700000-0x00000000068C2000-memory.dmp

Filesize
1.8MB

Download
memory/3192-1131-0x00000000068E0000-0x0000000006E0C000-memory.dmp

Filesize
5.2MB

Download
memory/3192-1132-0x0000000006F50000-0x0000000006FC6000-memory.dmp

Filesize
472KB

Download
memory/3192-1133-0x0000000006FD0000-0x0000000007020000-memory.dmp

Filesize
320KB

Download
memory/3192-1134-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/3192-238-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-236-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-234-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-232-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-230-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-228-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-226-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-222-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-220-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-218-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-216-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-214-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-212-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-210-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3192-209-0x0000000005040000-0x000000000507E000-memory.dmp

Filesize
248KB

Download
memory/3800-161-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

Filesize
40KB

Download