amadey | 7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3

Analysis

max time kernel
126s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe
Size

1019KB
MD5

8bd211326bb4b0b0babed3b87d0f410a
SHA1

b40821721583c1e91bf0ae6dfac7b8e3ea0be17a
SHA256

7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3
SHA512

826d7334167af2efbfd55b5ef9b05f89290c9b8622b5a700a08d2b9200349c0caeec1824381dd7fc1da57ab1c115881645892dc067c00703180b9d1b5a7e8f8b
SSDEEP

12288:gMrFy90ncUSnai6eWpNeFFsIokKNrZoWdW/nExlDBNu4Hlh3TRXoSMtz85k9EIr:Vy0aR6esCKNrZBW/nExlpPqz8GE0

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz7318.exev0743yv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz7318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz7318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v0743yv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v0743yv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v0743yv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz7318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz7318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz7318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz7318.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v0743yv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v0743yv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v0743yv.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3640-210-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-211-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-213-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-215-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-217-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-219-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-221-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-223-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-225-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-227-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-229-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-231-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-233-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-235-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-237-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-239-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-241-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline
behavioral1/memory/3640-243-0x0000000004E10000-0x0000000004E4E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y79pS93.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y79pS93.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 11 IoCs

Processes:

zap8145.exezap1455.exezap7945.exetz7318.exev0743yv.exew09dK38.exexlwAo76.exey79pS93.exelegenda.exelegenda.exelegenda.exe

pid	process
2348	zap8145.exe
4904	zap1455.exe
4488	zap7945.exe
4588	tz7318.exe
2616	v0743yv.exe
3640	w09dK38.exe
2428	xlwAo76.exe
4164	y79pS93.exe
2592	legenda.exe
4100	legenda.exe
2420	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4208 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4208	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz7318.exev0743yv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz7318.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v0743yv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v0743yv.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap8145.exezap1455.exezap7945.exe7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8145.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap8145.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1455.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1455.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap7945.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap7945.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3368 2616 WerFault.exe v0743yv.exe
3392 3640 WerFault.exe w09dK38.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4720 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz7318.exev0743yv.exew09dK38.exexlwAo76.exe

pid process

4588 tz7318.exe
4588 tz7318.exe
2616 v0743yv.exe
2616 v0743yv.exe
3640 w09dK38.exe
3640 w09dK38.exe
2428 xlwAo76.exe
2428 xlwAo76.exe

pid	pid_target	process	target process
3368	2616	WerFault.exe	v0743yv.exe
3392	3640	WerFault.exe	w09dK38.exe

pid	process
4720	schtasks.exe

pid	process
4588	tz7318.exe
4588	tz7318.exe
2616	v0743yv.exe
2616	v0743yv.exe
3640	w09dK38.exe
3640	w09dK38.exe
2428	xlwAo76.exe
2428	xlwAo76.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz7318.exev0743yv.exew09dK38.exexlwAo76.exe

description	pid	process
Token: SeDebugPrivilege	4588	tz7318.exe
Token: SeDebugPrivilege	2616	v0743yv.exe
Token: SeDebugPrivilege	3640	w09dK38.exe
Token: SeDebugPrivilege	2428	xlwAo76.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exezap8145.exezap1455.exezap7945.exey79pS93.exelegenda.execmd.exe

description	pid	process	target process
PID 1904 wrote to memory of 2348	1904	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe	zap8145.exe
PID 1904 wrote to memory of 2348	1904	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe	zap8145.exe
PID 1904 wrote to memory of 2348	1904	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe	zap8145.exe
PID 2348 wrote to memory of 4904	2348	zap8145.exe	zap1455.exe
PID 2348 wrote to memory of 4904	2348	zap8145.exe	zap1455.exe
PID 2348 wrote to memory of 4904	2348	zap8145.exe	zap1455.exe
PID 4904 wrote to memory of 4488	4904	zap1455.exe	zap7945.exe
PID 4904 wrote to memory of 4488	4904	zap1455.exe	zap7945.exe
PID 4904 wrote to memory of 4488	4904	zap1455.exe	zap7945.exe
PID 4488 wrote to memory of 4588	4488	zap7945.exe	tz7318.exe
PID 4488 wrote to memory of 4588	4488	zap7945.exe	tz7318.exe
PID 4488 wrote to memory of 2616	4488	zap7945.exe	v0743yv.exe
PID 4488 wrote to memory of 2616	4488	zap7945.exe	v0743yv.exe
PID 4488 wrote to memory of 2616	4488	zap7945.exe	v0743yv.exe
PID 4904 wrote to memory of 3640	4904	zap1455.exe	w09dK38.exe
PID 4904 wrote to memory of 3640	4904	zap1455.exe	w09dK38.exe
PID 4904 wrote to memory of 3640	4904	zap1455.exe	w09dK38.exe
PID 2348 wrote to memory of 2428	2348	zap8145.exe	xlwAo76.exe
PID 2348 wrote to memory of 2428	2348	zap8145.exe	xlwAo76.exe
PID 2348 wrote to memory of 2428	2348	zap8145.exe	xlwAo76.exe
PID 1904 wrote to memory of 4164	1904	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe	y79pS93.exe
PID 1904 wrote to memory of 4164	1904	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe	y79pS93.exe
PID 1904 wrote to memory of 4164	1904	7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe	y79pS93.exe
PID 4164 wrote to memory of 2592	4164	y79pS93.exe	legenda.exe
PID 4164 wrote to memory of 2592	4164	y79pS93.exe	legenda.exe
PID 4164 wrote to memory of 2592	4164	y79pS93.exe	legenda.exe
PID 2592 wrote to memory of 4720	2592	legenda.exe	schtasks.exe
PID 2592 wrote to memory of 4720	2592	legenda.exe	schtasks.exe
PID 2592 wrote to memory of 4720	2592	legenda.exe	schtasks.exe
PID 2592 wrote to memory of 228	2592	legenda.exe	cmd.exe
PID 2592 wrote to memory of 228	2592	legenda.exe	cmd.exe
PID 2592 wrote to memory of 228	2592	legenda.exe	cmd.exe
PID 228 wrote to memory of 4568	228	cmd.exe	cmd.exe
PID 228 wrote to memory of 4568	228	cmd.exe	cmd.exe
PID 228 wrote to memory of 4568	228	cmd.exe	cmd.exe
PID 228 wrote to memory of 1816	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 1816	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 1816	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 4808	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 4808	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 4808	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 3532	228	cmd.exe	cmd.exe
PID 228 wrote to memory of 3532	228	cmd.exe	cmd.exe
PID 228 wrote to memory of 3532	228	cmd.exe	cmd.exe
PID 228 wrote to memory of 4036	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 4036	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 4036	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 3024	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 3024	228	cmd.exe	cacls.exe
PID 228 wrote to memory of 3024	228	cmd.exe	cacls.exe
PID 2592 wrote to memory of 4208	2592	legenda.exe	rundll32.exe
PID 2592 wrote to memory of 4208	2592	legenda.exe	rundll32.exe
PID 2592 wrote to memory of 4208	2592	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe
"C:\Users\Admin\AppData\Local\Temp\7a9c7a71726bfd6df9bda644a8ad8d9b7fdabb7a59fb218e797461ccac281ad3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8145.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8145.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2348

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1455.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1455.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7945.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7945.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4488

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7318.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7318.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0743yv.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0743yv.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1084
6⤵
- Program crash
PID:3368

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09dK38.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09dK38.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1348
5⤵
- Program crash
PID:3392

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlwAo76.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlwAo76.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y79pS93.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y79pS93.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:4720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4568

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:1816

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3532

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4036

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3024

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2616 -ip 2616
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3640 -ip 3640
1⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y79pS93.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y79pS93.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8145.exe
Filesize
836KB

MD5
431571654ecd1316a40daeafacdadef6

SHA1
425f5a05d64b03693e0543e174d507afdab969fd

SHA256
7e0e2f3e94dc573dfe36b65c4322e8a98bb5522715e6ab63417aa447fc354397

SHA512
5ebdc76c0ba0f868053db025c847827a5c97fbc375405f774ec9f5828520bdb9994ed8bedd01ece7d86db72ded43de0fd8f6df0753febba6e3d8550faed314a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8145.exe
Filesize
836KB

MD5
431571654ecd1316a40daeafacdadef6

SHA1
425f5a05d64b03693e0543e174d507afdab969fd

SHA256
7e0e2f3e94dc573dfe36b65c4322e8a98bb5522715e6ab63417aa447fc354397

SHA512
5ebdc76c0ba0f868053db025c847827a5c97fbc375405f774ec9f5828520bdb9994ed8bedd01ece7d86db72ded43de0fd8f6df0753febba6e3d8550faed314a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlwAo76.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlwAo76.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1455.exe
Filesize
693KB

MD5
0b0ec248e81c615946fb0069ab076fa1

SHA1
8cc3dae61c02160f0c51bf47579c7d15318bc656

SHA256
4e28884d07d511a85b0e859abdf6f71b9f8f51750e15ef3ee79509abc026bbca

SHA512
0c6eb7a6b05e7b4f977e96919a3cf2025e6504aef5e26002bda67aed09c189746bacc5709e7e920eeffcca5af9b7fec18a2ebcae72d4646d5116c6a3f42a1ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1455.exe
Filesize
693KB

MD5
0b0ec248e81c615946fb0069ab076fa1

SHA1
8cc3dae61c02160f0c51bf47579c7d15318bc656

SHA256
4e28884d07d511a85b0e859abdf6f71b9f8f51750e15ef3ee79509abc026bbca

SHA512
0c6eb7a6b05e7b4f977e96919a3cf2025e6504aef5e26002bda67aed09c189746bacc5709e7e920eeffcca5af9b7fec18a2ebcae72d4646d5116c6a3f42a1ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09dK38.exe
Filesize
361KB

MD5
c0ddf4eda0ec27fe3b528eaa284d3fdf

SHA1
bde6376904faf850d59c3bbb5f4ff2df2a2d799e

SHA256
17f9559a20bf2ba3e95006a99e576f4ab785ebcd0f1f58db40cd36071f3ad164

SHA512
7faf57eba2011da4c97e9117827132fd8c5e354288d7f60bfe58504dbe78d7e1f88afd0c915b3061becea53698a0f15ed3317808b853170c80c1ec7bcb02f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09dK38.exe
Filesize
361KB

MD5
c0ddf4eda0ec27fe3b528eaa284d3fdf

SHA1
bde6376904faf850d59c3bbb5f4ff2df2a2d799e

SHA256
17f9559a20bf2ba3e95006a99e576f4ab785ebcd0f1f58db40cd36071f3ad164

SHA512
7faf57eba2011da4c97e9117827132fd8c5e354288d7f60bfe58504dbe78d7e1f88afd0c915b3061becea53698a0f15ed3317808b853170c80c1ec7bcb02f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7945.exe
Filesize
344KB

MD5
dd848746cd61b8a554bbe148925bd55a

SHA1
3a8bcac7ad8e5604d1e24b41a3f7828857ee8a88

SHA256
49511fd5a27a217d9e69875983b8c715966a72827f932f8993b990b233b8f0a0

SHA512
907e67d7963b0dc102faaebf388998043f1f4d8a8198f97fc0fd6479348b50fad6f59eb5deeab6fc7f82d78690ad427ab90007978c7d832f86e3a4ba7c648073

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7945.exe
Filesize
344KB

MD5
dd848746cd61b8a554bbe148925bd55a

SHA1
3a8bcac7ad8e5604d1e24b41a3f7828857ee8a88

SHA256
49511fd5a27a217d9e69875983b8c715966a72827f932f8993b990b233b8f0a0

SHA512
907e67d7963b0dc102faaebf388998043f1f4d8a8198f97fc0fd6479348b50fad6f59eb5deeab6fc7f82d78690ad427ab90007978c7d832f86e3a4ba7c648073

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7318.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7318.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0743yv.exe
Filesize
304KB

MD5
c0e24ae5ec61f89787b7ba1c92f5e9fd

SHA1
c6a0c3a53097d758fddbfcaa70c1bf885eefd72c

SHA256
d4756b6567c9bd0e82d971eff17741a82d9b431ae25438621e45cdfaa1a264c7

SHA512
5e249dd24a17b0442968e5270c1dac5e420066ba0f3efc498a4bd994b82d80f3622c8468cf28a18199bb21c460efab3c756d7422b8e7cb59edd069fd60ac9033

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0743yv.exe
Filesize
304KB

MD5
c0e24ae5ec61f89787b7ba1c92f5e9fd

SHA1
c6a0c3a53097d758fddbfcaa70c1bf885eefd72c

SHA256
d4756b6567c9bd0e82d971eff17741a82d9b431ae25438621e45cdfaa1a264c7

SHA512
5e249dd24a17b0442968e5270c1dac5e420066ba0f3efc498a4bd994b82d80f3622c8468cf28a18199bb21c460efab3c756d7422b8e7cb59edd069fd60ac9033

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/2428-1141-0x0000000000890000-0x00000000008C2000-memory.dmp

Filesize
200KB

Download
memory/2428-1142-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/2616-205-0x0000000000400000-0x0000000000834000-memory.dmp

Filesize
4.2MB

Download
memory/2616-187-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-191-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-193-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-195-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-197-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-199-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-200-0x0000000000400000-0x0000000000834000-memory.dmp

Filesize
4.2MB

Download
memory/2616-202-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2616-201-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2616-203-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2616-185-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-179-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-189-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-177-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-175-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-181-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-173-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-172-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/2616-171-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2616-170-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2616-169-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2616-168-0x0000000000910000-0x000000000093D000-memory.dmp

Filesize
180KB

Download
memory/2616-167-0x0000000004DE0000-0x0000000005384000-memory.dmp

Filesize
5.6MB

Download
memory/2616-183-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/3640-219-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-237-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-239-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-241-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-243-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-246-0x0000000000850000-0x000000000089B000-memory.dmp

Filesize
300KB

Download
memory/3640-247-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-249-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-250-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-1120-0x0000000005520000-0x0000000005B38000-memory.dmp

Filesize
6.1MB

Download
memory/3640-1121-0x0000000005B40000-0x0000000005C4A000-memory.dmp

Filesize
1.0MB

Download
memory/3640-1122-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3640-1123-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-1124-0x0000000005C50000-0x0000000005C8C000-memory.dmp

Filesize
240KB

Download
memory/3640-1125-0x0000000005F40000-0x0000000005FD2000-memory.dmp

Filesize
584KB

Download
memory/3640-1126-0x0000000005FE0000-0x0000000006046000-memory.dmp

Filesize
408KB

Download
memory/3640-1128-0x00000000066E0000-0x0000000006756000-memory.dmp

Filesize
472KB

Download
memory/3640-1129-0x0000000006770000-0x00000000067C0000-memory.dmp

Filesize
320KB

Download
memory/3640-1130-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-1131-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-1132-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3640-1133-0x00000000068E0000-0x0000000006AA2000-memory.dmp

Filesize
1.8MB

Download
memory/3640-235-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-233-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-231-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-229-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-227-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-225-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-223-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-221-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-217-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-215-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-213-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-211-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-210-0x0000000004E10000-0x0000000004E4E000-memory.dmp

Filesize
248KB

Download
memory/3640-1134-0x0000000006AD0000-0x0000000006FFC000-memory.dmp

Filesize
5.2MB

Download
memory/3640-1135-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/4588-161-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download