amadey | 8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz0584.exev7163jp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz0584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz0584.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v7163jp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v7163jp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v7163jp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz0584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz0584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz0584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz0584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v7163jp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v7163jp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v7163jp.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3032-211-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-213-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-210-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-215-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-217-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-219-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-221-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-223-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-225-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-227-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-229-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-231-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-235-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-239-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-241-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-243-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-245-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline
behavioral1/memory/3032-247-0x0000000002640000-0x000000000267E000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

YJROPMCQjRX9.exe

description pid process target process

PID 2256 created 2576 2256 YJROPMCQjRX9.exe taskhostw.exe
Downloads MZ/PE file

description	pid	process	target process
PID 2256 created 2576	2256	YJROPMCQjRX9.exe	taskhostw.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

y89Fj41.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	y89Fj41.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 13 IoCs

Processes:

zap6690.exezap8680.exezap1678.exetz0584.exev7163jp.exew80PE82.exexEDrb58.exey89Fj41.exelegenda.exeserv.exesvchost.exeYJROPMCQjRX9.exelegenda.exe

pid	process
2500	zap6690.exe
2960	zap8680.exe
4412	zap1678.exe
100	tz0584.exe
1652	v7163jp.exe
3032	w80PE82.exe
3628	xEDrb58.exe
4388	y89Fj41.exe
2088	legenda.exe
4944	serv.exe
2332	svchost.exe
2256	YJROPMCQjRX9.exe
2836	legenda.exe

Loads dropped DLL 4 IoCs

Processes:

YJROPMCQjRX9.exerundll32.exefontview.exe

pid process

2256 YJROPMCQjRX9.exe
2272 rundll32.exe
3788 fontview.exe
3788 fontview.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2256	YJROPMCQjRX9.exe
2272	rundll32.exe
3788	fontview.exe
3788	fontview.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

tz0584.exev7163jp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz0584.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v7163jp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v7163jp.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exezap6690.exezap8680.exezap1678.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6690.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap6690.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8680.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap8680.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1678.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap1678.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

serv.exe

pid process

4944 serv.exe
4944 serv.exe
4944 serv.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

YJROPMCQjRX9.exe

description pid process target process

PID 2256 set thread context of 220 2256 YJROPMCQjRX9.exe ngentask.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4924 1652 WerFault.exe v7163jp.exe
4780 3032 WerFault.exe w80PE82.exe
1412 4944 WerFault.exe serv.exe

pid	process
4944	serv.exe
4944	serv.exe
4944	serv.exe

description	pid	process	target process
PID 2256 set thread context of 220	2256	YJROPMCQjRX9.exe	ngentask.exe

pid	pid_target	process	target process
4924	1652	WerFault.exe	v7163jp.exe
4780	3032	WerFault.exe	w80PE82.exe
1412	4944	WerFault.exe	serv.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

serv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	serv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	serv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	serv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

fontview.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fontview.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fontview.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3748 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5088 timeout.exe

pid	process
3748	schtasks.exe

pid	process
5088	timeout.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

tz0584.exev7163jp.exew80PE82.exexEDrb58.exeYJROPMCQjRX9.exengentask.exefontview.exe

pid	process
100	tz0584.exe
100	tz0584.exe
1652	v7163jp.exe
1652	v7163jp.exe
3032	w80PE82.exe
3032	w80PE82.exe
3628	xEDrb58.exe
3628	xEDrb58.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
2256	YJROPMCQjRX9.exe
220	ngentask.exe
220	ngentask.exe
3788	fontview.exe
3788	fontview.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tz0584.exev7163jp.exew80PE82.exexEDrb58.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	100	tz0584.exe
Token: SeDebugPrivilege	1652	v7163jp.exe
Token: SeDebugPrivilege	3032	w80PE82.exe
Token: SeDebugPrivilege	3628	xEDrb58.exe
Token: SeIncreaseQuotaPrivilege	2956	wmic.exe
Token: SeSecurityPrivilege	2956	wmic.exe
Token: SeTakeOwnershipPrivilege	2956	wmic.exe
Token: SeLoadDriverPrivilege	2956	wmic.exe
Token: SeSystemProfilePrivilege	2956	wmic.exe
Token: SeSystemtimePrivilege	2956	wmic.exe
Token: SeProfSingleProcessPrivilege	2956	wmic.exe
Token: SeIncBasePriorityPrivilege	2956	wmic.exe
Token: SeCreatePagefilePrivilege	2956	wmic.exe
Token: SeBackupPrivilege	2956	wmic.exe
Token: SeRestorePrivilege	2956	wmic.exe
Token: SeShutdownPrivilege	2956	wmic.exe
Token: SeDebugPrivilege	2956	wmic.exe
Token: SeSystemEnvironmentPrivilege	2956	wmic.exe
Token: SeRemoteShutdownPrivilege	2956	wmic.exe
Token: SeUndockPrivilege	2956	wmic.exe
Token: SeManageVolumePrivilege	2956	wmic.exe
Token: 33	2956	wmic.exe
Token: 34	2956	wmic.exe
Token: 35	2956	wmic.exe
Token: 36	2956	wmic.exe
Token: SeIncreaseQuotaPrivilege	2956	wmic.exe
Token: SeSecurityPrivilege	2956	wmic.exe
Token: SeTakeOwnershipPrivilege	2956	wmic.exe
Token: SeLoadDriverPrivilege	2956	wmic.exe
Token: SeSystemProfilePrivilege	2956	wmic.exe
Token: SeSystemtimePrivilege	2956	wmic.exe
Token: SeProfSingleProcessPrivilege	2956	wmic.exe
Token: SeIncBasePriorityPrivilege	2956	wmic.exe
Token: SeCreatePagefilePrivilege	2956	wmic.exe
Token: SeBackupPrivilege	2956	wmic.exe
Token: SeRestorePrivilege	2956	wmic.exe
Token: SeShutdownPrivilege	2956	wmic.exe
Token: SeDebugPrivilege	2956	wmic.exe
Token: SeSystemEnvironmentPrivilege	2956	wmic.exe
Token: SeRemoteShutdownPrivilege	2956	wmic.exe
Token: SeUndockPrivilege	2956	wmic.exe
Token: SeManageVolumePrivilege	2956	wmic.exe
Token: 33	2956	wmic.exe
Token: 34	2956	wmic.exe
Token: 35	2956	wmic.exe
Token: 36	2956	wmic.exe
Token: SeIncreaseQuotaPrivilege	3664	WMIC.exe
Token: SeSecurityPrivilege	3664	WMIC.exe
Token: SeTakeOwnershipPrivilege	3664	WMIC.exe
Token: SeLoadDriverPrivilege	3664	WMIC.exe
Token: SeSystemProfilePrivilege	3664	WMIC.exe
Token: SeSystemtimePrivilege	3664	WMIC.exe
Token: SeProfSingleProcessPrivilege	3664	WMIC.exe
Token: SeIncBasePriorityPrivilege	3664	WMIC.exe
Token: SeCreatePagefilePrivilege	3664	WMIC.exe
Token: SeBackupPrivilege	3664	WMIC.exe
Token: SeRestorePrivilege	3664	WMIC.exe
Token: SeShutdownPrivilege	3664	WMIC.exe
Token: SeDebugPrivilege	3664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3664	WMIC.exe
Token: SeRemoteShutdownPrivilege	3664	WMIC.exe
Token: SeUndockPrivilege	3664	WMIC.exe
Token: SeManageVolumePrivilege	3664	WMIC.exe
Token: 33	3664	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exezap6690.exezap8680.exezap1678.exey89Fj41.exelegenda.execmd.exesvchost.exe

description	pid	process	target process
PID 2060 wrote to memory of 2500	2060	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe	zap6690.exe
PID 2060 wrote to memory of 2500	2060	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe	zap6690.exe
PID 2060 wrote to memory of 2500	2060	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe	zap6690.exe
PID 2500 wrote to memory of 2960	2500	zap6690.exe	zap8680.exe
PID 2500 wrote to memory of 2960	2500	zap6690.exe	zap8680.exe
PID 2500 wrote to memory of 2960	2500	zap6690.exe	zap8680.exe
PID 2960 wrote to memory of 4412	2960	zap8680.exe	zap1678.exe
PID 2960 wrote to memory of 4412	2960	zap8680.exe	zap1678.exe
PID 2960 wrote to memory of 4412	2960	zap8680.exe	zap1678.exe
PID 4412 wrote to memory of 100	4412	zap1678.exe	tz0584.exe
PID 4412 wrote to memory of 100	4412	zap1678.exe	tz0584.exe
PID 4412 wrote to memory of 1652	4412	zap1678.exe	v7163jp.exe
PID 4412 wrote to memory of 1652	4412	zap1678.exe	v7163jp.exe
PID 4412 wrote to memory of 1652	4412	zap1678.exe	v7163jp.exe
PID 2960 wrote to memory of 3032	2960	zap8680.exe	w80PE82.exe
PID 2960 wrote to memory of 3032	2960	zap8680.exe	w80PE82.exe
PID 2960 wrote to memory of 3032	2960	zap8680.exe	w80PE82.exe
PID 2500 wrote to memory of 3628	2500	zap6690.exe	xEDrb58.exe
PID 2500 wrote to memory of 3628	2500	zap6690.exe	xEDrb58.exe
PID 2500 wrote to memory of 3628	2500	zap6690.exe	xEDrb58.exe
PID 2060 wrote to memory of 4388	2060	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe	y89Fj41.exe
PID 2060 wrote to memory of 4388	2060	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe	y89Fj41.exe
PID 2060 wrote to memory of 4388	2060	8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe	y89Fj41.exe
PID 4388 wrote to memory of 2088	4388	y89Fj41.exe	legenda.exe
PID 4388 wrote to memory of 2088	4388	y89Fj41.exe	legenda.exe
PID 4388 wrote to memory of 2088	4388	y89Fj41.exe	legenda.exe
PID 2088 wrote to memory of 3748	2088	legenda.exe	schtasks.exe
PID 2088 wrote to memory of 3748	2088	legenda.exe	schtasks.exe
PID 2088 wrote to memory of 3748	2088	legenda.exe	schtasks.exe
PID 2088 wrote to memory of 1536	2088	legenda.exe	cmd.exe
PID 2088 wrote to memory of 1536	2088	legenda.exe	cmd.exe
PID 2088 wrote to memory of 1536	2088	legenda.exe	cmd.exe
PID 1536 wrote to memory of 2820	1536	cmd.exe	cmd.exe
PID 1536 wrote to memory of 2820	1536	cmd.exe	cmd.exe
PID 1536 wrote to memory of 2820	1536	cmd.exe	cmd.exe
PID 1536 wrote to memory of 3772	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3772	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3772	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 2272	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 2272	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 2272	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 4300	1536	cmd.exe	cmd.exe
PID 1536 wrote to memory of 4300	1536	cmd.exe	cmd.exe
PID 1536 wrote to memory of 4300	1536	cmd.exe	cmd.exe
PID 1536 wrote to memory of 3764	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3764	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3764	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3908	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3908	1536	cmd.exe	cacls.exe
PID 1536 wrote to memory of 3908	1536	cmd.exe	cacls.exe
PID 2088 wrote to memory of 4944	2088	legenda.exe	serv.exe
PID 2088 wrote to memory of 4944	2088	legenda.exe	serv.exe
PID 2088 wrote to memory of 4944	2088	legenda.exe	serv.exe
PID 2088 wrote to memory of 2332	2088	legenda.exe	svchost.exe
PID 2088 wrote to memory of 2332	2088	legenda.exe	svchost.exe
PID 2088 wrote to memory of 2332	2088	legenda.exe	svchost.exe
PID 2088 wrote to memory of 2256	2088	legenda.exe	YJROPMCQjRX9.exe
PID 2088 wrote to memory of 2256	2088	legenda.exe	YJROPMCQjRX9.exe
PID 2088 wrote to memory of 2256	2088	legenda.exe	YJROPMCQjRX9.exe
PID 2332 wrote to memory of 2956	2332	svchost.exe	wmic.exe
PID 2332 wrote to memory of 2956	2332	svchost.exe	wmic.exe
PID 2332 wrote to memory of 2956	2332	svchost.exe	wmic.exe
PID 2332 wrote to memory of 380	2332	svchost.exe	cmd.exe
PID 2332 wrote to memory of 380	2332	svchost.exe	cmd.exe

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2576

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3788

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\SysWOW64\fontview.exe" & exit
3⤵
PID:504

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:5088

C:\Users\Admin\AppData\Local\Temp\8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe
"C:\Users\Admin\AppData\Local\Temp\8da86e3a2a398afbc744d25442a6c3b635e211b086cb98992c2d6dea0ae8ac67.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2060

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6690.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2500

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8680.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2960

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1678.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4412

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0584.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:100

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7163jp.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 1084
6⤵
- Program crash
PID:4924

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w80PE82.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1348
5⤵
- Program crash
PID:4780

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEDrb58.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89Fj41.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2820

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:3772

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4300

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:3764

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3908

C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe
"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 684
5⤵
- Program crash
PID:1412

C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
PID:380

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
PID:2460

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:4312

C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe
"C:\Users\Admin\AppData\Roaming\1000120000\YJROPMCQjRX9.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:220

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1652 -ip 1652
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3032 -ip 3032
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4944 -ip 4944
1⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery