amadey | 39f3763e35309aa55b43612ffc3113bb5d0cc7de2383dd5184a646420a47e889

Analysis

max time kernel
127s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe
Size

1.4MB
MD5

0de84a66b983d2f407390473dd1e37de
SHA1

21de93ab0f4e6706403e0bd3167be9aa8178018b
SHA256

e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969
SHA512

37fc3f31dbb2721565c56974638e483cf3700779b4bbe324c26dbf4f45721211516b041b519b63bd8feb653b8b1de6bda8c52736085f72ff597d5fcb8d839a94
SSDEEP

24576:m3Bdco8g+Jw+uIWdSNmppQIAni/mqjGYqXGkICzZ+apKOiz4GvaG/9jhNpNbWOAD:sxpxIGJppQIAni/mqjGYqXGbuZ+apKO/

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4860 2876 rundll32.exe
Downloads MZ/PE file

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2876	rundll32.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exePlayer3.exeliwen.exenbveek.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Player3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	liwen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	nbveek.exe

Executes dropped EXE 8 IoCs

Processes:

Player3.exeliwen.exess31.exenbveek.exeliwen.exenbveek.exenbveek.exenbveek.exe

pid process

232 Player3.exe
4964 liwen.exe
3288 ss31.exe
4836 nbveek.exe
2272 liwen.exe
4152 nbveek.exe
2368 nbveek.exe
728 nbveek.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

pid process

2588 rundll32.exe
3640 rundll32.exe
3608 rundll32.exe
3852 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2008 2588 WerFault.exe rundll32.exe
3724 3608 WerFault.exe rundll32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1068 schtasks.exe

pid	process
232	Player3.exe
4964	liwen.exe
3288	ss31.exe
4836	nbveek.exe
2272	liwen.exe
4152	nbveek.exe
2368	nbveek.exe
728	nbveek.exe

pid	process
2588	rundll32.exe
3640	rundll32.exe
3608	rundll32.exe
3852	rundll32.exe

pid	pid_target	process	target process
2008	2588	WerFault.exe	rundll32.exe
3724	3608	WerFault.exe	rundll32.exe

pid	process
1068	schtasks.exe

Modifies registry class 44 IoCs

Processes:

liwen.exeliwen.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ = "sqltest.Application"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\0	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\0\win32	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ = "Isqltest"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\HELPDIR\	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib\Version = "1.0"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32\ = "ole32.dll"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\ = "sqltest"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\FLAGS	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32\ = "ole32.dll"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ProxyStubClsid32	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\ = "sqltest.Application"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\FLAGS\ = "0"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liwen.exe"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\HELPDIR	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib\ = "{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ = "Isqltest"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID\ = "{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liwen.exe"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liwen.exe"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID\ = "sqltest.Application"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID\ = "{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID\ = "sqltest.Application"	liwen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ProxyStubClsid32	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib\ = "{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}"	liwen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib\Version = "1.0"	liwen.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

liwen.exeliwen.exe

pid process

4964 liwen.exe
4964 liwen.exe
2272 liwen.exe
2272 liwen.exe

description	flow	ioc
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4964	liwen.exe
4964	liwen.exe
2272	liwen.exe
2272	liwen.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exePlayer3.exeliwen.exenbveek.execmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 4048 wrote to memory of 232	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	Player3.exe
PID 4048 wrote to memory of 232	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	Player3.exe
PID 4048 wrote to memory of 232	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	Player3.exe
PID 4048 wrote to memory of 4964	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	liwen.exe
PID 4048 wrote to memory of 4964	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	liwen.exe
PID 4048 wrote to memory of 4964	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	liwen.exe
PID 4048 wrote to memory of 3288	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	ss31.exe
PID 4048 wrote to memory of 3288	4048	e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe	ss31.exe
PID 232 wrote to memory of 4836	232	Player3.exe	nbveek.exe
PID 232 wrote to memory of 4836	232	Player3.exe	nbveek.exe
PID 232 wrote to memory of 4836	232	Player3.exe	nbveek.exe
PID 4964 wrote to memory of 2272	4964	liwen.exe	liwen.exe
PID 4964 wrote to memory of 2272	4964	liwen.exe	liwen.exe
PID 4964 wrote to memory of 2272	4964	liwen.exe	liwen.exe
PID 4836 wrote to memory of 1068	4836	nbveek.exe	schtasks.exe
PID 4836 wrote to memory of 1068	4836	nbveek.exe	schtasks.exe
PID 4836 wrote to memory of 1068	4836	nbveek.exe	schtasks.exe
PID 4836 wrote to memory of 4904	4836	nbveek.exe	cmd.exe
PID 4836 wrote to memory of 4904	4836	nbveek.exe	cmd.exe
PID 4836 wrote to memory of 4904	4836	nbveek.exe	cmd.exe
PID 4904 wrote to memory of 4388	4904	cmd.exe	cmd.exe
PID 4904 wrote to memory of 4388	4904	cmd.exe	cmd.exe
PID 4904 wrote to memory of 4388	4904	cmd.exe	cmd.exe
PID 4904 wrote to memory of 3544	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 3544	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 3544	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 5092	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 5092	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 5092	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 4476	4904	cmd.exe	cmd.exe
PID 4904 wrote to memory of 4476	4904	cmd.exe	cmd.exe
PID 4904 wrote to memory of 4476	4904	cmd.exe	cmd.exe
PID 4904 wrote to memory of 956	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 956	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 956	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 1480	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 1480	4904	cmd.exe	cacls.exe
PID 4904 wrote to memory of 1480	4904	cmd.exe	cacls.exe
PID 4860 wrote to memory of 2588	4860	rundll32.exe	rundll32.exe
PID 4860 wrote to memory of 2588	4860	rundll32.exe	rundll32.exe
PID 4860 wrote to memory of 2588	4860	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 3640	4836	nbveek.exe	rundll32.exe
PID 4836 wrote to memory of 3640	4836	nbveek.exe	rundll32.exe
PID 4836 wrote to memory of 3640	4836	nbveek.exe	rundll32.exe
PID 3640 wrote to memory of 3608	3640	rundll32.exe	rundll32.exe
PID 3640 wrote to memory of 3608	3640	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 3852	4836	nbveek.exe	rundll32.exe
PID 4836 wrote to memory of 3852	4836	nbveek.exe	rundll32.exe
PID 4836 wrote to memory of 3852	4836	nbveek.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe
"C:\Users\Admin\AppData\Local\Temp\e8f0e3fe795f96909d2ce54434a20f0c87a8bde815e790a7de9fd48b7eb11969.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\Player3.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
4⤵
- Creates scheduled task(s)
PID:1068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4388

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
5⤵
PID:3544

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
5⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4476

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
5⤵
PID:956

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
5⤵
PID:1480

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
5⤵
- Loads dropped DLL
PID:3608

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3608 -s 644
6⤵
- Program crash
PID:3724

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:3852

C:\Users\Admin\AppData\Local\Temp\liwen.exe
"C:\Users\Admin\AppData\Local\Temp\liwen.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\liwen.exe
"C:\Users\Admin\AppData\Local\Temp\liwen.exe" -h
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2272

C:\Users\Admin\AppData\Local\Temp\ss31.exe
"C:\Users\Admin\AppData\Local\Temp\ss31.exe"
2⤵
- Executes dropped EXE
PID:3288

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 604
3⤵
- Program crash
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2588 -ip 2588
1⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 3608 -ip 3608
1⤵
PID:3976

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\013461898371
Filesize
83KB

MD5
ac63f77bbfd39d558f5d20aa53216f7f

SHA1
6b805c624279c12b041c264ca784408dfd397655

SHA256
9b59b075dbae292f53c63c751796c43a7e8008569d7866b163c15f09af7fa511

SHA512
5de585c7e6e452dba7190434bf8dedecb841ee0800e6565047fe5d486a4161e32f6826be701aa3850798ab89ba3050a84642bc10a6833fbef061fb25ea82951e

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat
Filesize
557KB

MD5
ee5d452cc4ee71e1f544582bf6fca143

SHA1
a193952075b2b4a83759098754e814a931b8ba90

SHA256
f5cb9476e4b5576bb94eae1d278093b6470b0238226d4c05ec8c76747d57cbfe

SHA512
7a935ae3df65b949c5e7f1ed93bd2173165ef4e347ceb5879725fbb995aedeef853b5b1dc4c4155d423f34d004f8a0df59258cefdad5f49e617d0a74764c896b

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\liwen.exe
Filesize
328KB

MD5
bbaa394e6b0ecb7808722986b90d290c

SHA1
682e835d7ea19c9aa3d464436d673e5c89ab2bb6

SHA256
baa3acf778b3bcf4b7be932384799e8c95a5dc56c0faea8cbf7a33195ab47e73

SHA512
2f3ef8921f36beaedf364d72f01af70aaa16acd3804343a1c5ff4f72b91333b4489d15c33c08b05695b216cbd024fc8783676dd98a907be3af8cb8a56c075f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\liwen.exe
Filesize
328KB

MD5
bbaa394e6b0ecb7808722986b90d290c

SHA1
682e835d7ea19c9aa3d464436d673e5c89ab2bb6

SHA256
baa3acf778b3bcf4b7be932384799e8c95a5dc56c0faea8cbf7a33195ab47e73

SHA512
2f3ef8921f36beaedf364d72f01af70aaa16acd3804343a1c5ff4f72b91333b4489d15c33c08b05695b216cbd024fc8783676dd98a907be3af8cb8a56c075f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\liwen.exe
Filesize
328KB

MD5
bbaa394e6b0ecb7808722986b90d290c

SHA1
682e835d7ea19c9aa3d464436d673e5c89ab2bb6

SHA256
baa3acf778b3bcf4b7be932384799e8c95a5dc56c0faea8cbf7a33195ab47e73

SHA512
2f3ef8921f36beaedf364d72f01af70aaa16acd3804343a1c5ff4f72b91333b4489d15c33c08b05695b216cbd024fc8783676dd98a907be3af8cb8a56c075f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\liwen.exe
Filesize
328KB

MD5
bbaa394e6b0ecb7808722986b90d290c

SHA1
682e835d7ea19c9aa3d464436d673e5c89ab2bb6

SHA256
baa3acf778b3bcf4b7be932384799e8c95a5dc56c0faea8cbf7a33195ab47e73

SHA512
2f3ef8921f36beaedf364d72f01af70aaa16acd3804343a1c5ff4f72b91333b4489d15c33c08b05695b216cbd024fc8783676dd98a907be3af8cb8a56c075f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
900KB

MD5
635d7aef53ed843b44be739c2b6d0c43

SHA1
abbf9fd908d4d2a2c4c87366552fc7d75ae474ef

SHA256
55c1e82d5fd4c19b79e692d6a869f41f65c5014e0f5122c5da52a3c5e64e54e8

SHA512
8ab908305fa3ccad0a51658c3c94965cd342ce9e1fd300660088bfa60c95aad353af639540aaf22acf711bc254b9ae38654aa043e7e2e0c0cdfd352cde74df20

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
900KB

MD5
635d7aef53ed843b44be739c2b6d0c43

SHA1
abbf9fd908d4d2a2c4c87366552fc7d75ae474ef

SHA256
55c1e82d5fd4c19b79e692d6a869f41f65c5014e0f5122c5da52a3c5e64e54e8

SHA512
8ab908305fa3ccad0a51658c3c94965cd342ce9e1fd300660088bfa60c95aad353af639540aaf22acf711bc254b9ae38654aa043e7e2e0c0cdfd352cde74df20

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
900KB

MD5
635d7aef53ed843b44be739c2b6d0c43

SHA1
abbf9fd908d4d2a2c4c87366552fc7d75ae474ef

SHA256
55c1e82d5fd4c19b79e692d6a869f41f65c5014e0f5122c5da52a3c5e64e54e8

SHA512
8ab908305fa3ccad0a51658c3c94965cd342ce9e1fd300660088bfa60c95aad353af639540aaf22acf711bc254b9ae38654aa043e7e2e0c0cdfd352cde74df20

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
memory/3288-186-0x000001A9B70C0000-0x000001A9B71F4000-memory.dmp

Filesize
1.2MB

Download
memory/3288-181-0x000001A9B70C0000-0x000001A9B71F4000-memory.dmp

Filesize
1.2MB

Download
memory/3288-180-0x000001A9B6F40000-0x000001A9B70B3000-memory.dmp

Filesize
1.4MB

Download
memory/4048-133-0x0000000000C20000-0x0000000000D9A000-memory.dmp

Filesize
1.5MB

Download