amadey | 5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765

Analysis

max time kernel
146s
max time network
118s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
22-03-2023 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe
Size

1.0MB
MD5

6ddf47830043d30669c84283fdb1385c
SHA1

188c458d933c2e99e8f76393ac6ba697cb14841f
SHA256

5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765
SHA512

f261cca4ab7f0c5d22cef0e9d09d19b31f6c4e4fcf8f8f2e600190280036d992edd613b70e10076ba66b09eb79424ca3963c624ae2ab7f06c8ee5942c50891e8
SSDEEP

24576:Xyj0ye4P1qffEMzo3nVkiCJPqOODp2Z3OAnFH:ij7eJfflzoldC4OOYZ33n

Score

10^/10

amadey redline @redlinevipchat cloud (tg: @fatherofcarders)down lown discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

193.233.20.31:4125

Attributes

auth_value
4cf836e062bcdc2a4fdbf410f5747ec7

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Extracted

Family

redline

Botnet

@REDLINEVIPCHAT Cloud (TG: @FATHEROFCARDERS)

151.80.89.234:19388

Attributes

auth_value
56af49c3278d982f9a41ef2abb7c4d09

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v8958xl.exetz5307.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v8958xl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v8958xl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v8958xl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz5307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz5307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz5307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v8958xl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz5307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz5307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v8958xl.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2240-196-0x00000000008D0000-0x0000000000916000-memory.dmp	family_redline
behavioral1/memory/2240-197-0x0000000002340000-0x0000000002384000-memory.dmp	family_redline
behavioral1/memory/2240-198-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-199-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-201-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-203-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-209-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-207-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-205-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-211-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-218-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-215-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-221-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-223-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-225-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-227-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-229-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-231-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-233-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline
behavioral1/memory/2240-235-0x0000000002340000-0x000000000237E000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

zap1083.exezap5874.exezap5965.exetz5307.exev8958xl.exew35KX31.exexlJDr86.exey65pS93.exelegenda.exe10MIL.exelegenda.exelegenda.exe

pid	process
3592	zap1083.exe
4280	zap5874.exe
4828	zap5965.exe
4312	tz5307.exe
1000	v8958xl.exe
2240	w35KX31.exe
3732	xlJDr86.exe
2644	y65pS93.exe
2844	legenda.exe
4904	10MIL.exe
3372	legenda.exe
764	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

880 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
880	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz5307.exev8958xl.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz5307.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v8958xl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v8958xl.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap5874.exezap5965.exe5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exezap1083.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5874.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap5874.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5965.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap5965.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap1083.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4324 schtasks.exe

pid	process
4324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

tz5307.exev8958xl.exew35KX31.exexlJDr86.exe10MIL.exe

pid	process
4312	tz5307.exe
4312	tz5307.exe
1000	v8958xl.exe
1000	v8958xl.exe
2240	w35KX31.exe
2240	w35KX31.exe
3732	xlJDr86.exe
3732	xlJDr86.exe
4904	10MIL.exe
4904	10MIL.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

tz5307.exev8958xl.exew35KX31.exexlJDr86.exe10MIL.exe

description	pid	process
Token: SeDebugPrivilege	4312	tz5307.exe
Token: SeDebugPrivilege	1000	v8958xl.exe
Token: SeDebugPrivilege	2240	w35KX31.exe
Token: SeDebugPrivilege	3732	xlJDr86.exe
Token: SeDebugPrivilege	4904	10MIL.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exezap1083.exezap5874.exezap5965.exey65pS93.exelegenda.execmd.exe

description	pid	process	target process
PID 3648 wrote to memory of 3592	3648	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe	zap1083.exe
PID 3648 wrote to memory of 3592	3648	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe	zap1083.exe
PID 3648 wrote to memory of 3592	3648	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe	zap1083.exe
PID 3592 wrote to memory of 4280	3592	zap1083.exe	zap5874.exe
PID 3592 wrote to memory of 4280	3592	zap1083.exe	zap5874.exe
PID 3592 wrote to memory of 4280	3592	zap1083.exe	zap5874.exe
PID 4280 wrote to memory of 4828	4280	zap5874.exe	zap5965.exe
PID 4280 wrote to memory of 4828	4280	zap5874.exe	zap5965.exe
PID 4280 wrote to memory of 4828	4280	zap5874.exe	zap5965.exe
PID 4828 wrote to memory of 4312	4828	zap5965.exe	tz5307.exe
PID 4828 wrote to memory of 4312	4828	zap5965.exe	tz5307.exe
PID 4828 wrote to memory of 1000	4828	zap5965.exe	v8958xl.exe
PID 4828 wrote to memory of 1000	4828	zap5965.exe	v8958xl.exe
PID 4828 wrote to memory of 1000	4828	zap5965.exe	v8958xl.exe
PID 4280 wrote to memory of 2240	4280	zap5874.exe	w35KX31.exe
PID 4280 wrote to memory of 2240	4280	zap5874.exe	w35KX31.exe
PID 4280 wrote to memory of 2240	4280	zap5874.exe	w35KX31.exe
PID 3592 wrote to memory of 3732	3592	zap1083.exe	xlJDr86.exe
PID 3592 wrote to memory of 3732	3592	zap1083.exe	xlJDr86.exe
PID 3592 wrote to memory of 3732	3592	zap1083.exe	xlJDr86.exe
PID 3648 wrote to memory of 2644	3648	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe	y65pS93.exe
PID 3648 wrote to memory of 2644	3648	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe	y65pS93.exe
PID 3648 wrote to memory of 2644	3648	5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe	y65pS93.exe
PID 2644 wrote to memory of 2844	2644	y65pS93.exe	legenda.exe
PID 2644 wrote to memory of 2844	2644	y65pS93.exe	legenda.exe
PID 2644 wrote to memory of 2844	2644	y65pS93.exe	legenda.exe
PID 2844 wrote to memory of 4324	2844	legenda.exe	schtasks.exe
PID 2844 wrote to memory of 4324	2844	legenda.exe	schtasks.exe
PID 2844 wrote to memory of 4324	2844	legenda.exe	schtasks.exe
PID 2844 wrote to memory of 4696	2844	legenda.exe	cmd.exe
PID 2844 wrote to memory of 4696	2844	legenda.exe	cmd.exe
PID 2844 wrote to memory of 4696	2844	legenda.exe	cmd.exe
PID 4696 wrote to memory of 4876	4696	cmd.exe	cmd.exe
PID 4696 wrote to memory of 4876	4696	cmd.exe	cmd.exe
PID 4696 wrote to memory of 4876	4696	cmd.exe	cmd.exe
PID 4696 wrote to memory of 4680	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 4680	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 4680	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 3444	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 3444	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 3444	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 4684	4696	cmd.exe	cmd.exe
PID 4696 wrote to memory of 4684	4696	cmd.exe	cmd.exe
PID 4696 wrote to memory of 4684	4696	cmd.exe	cmd.exe
PID 4696 wrote to memory of 3848	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 3848	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 3848	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 4932	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 4932	4696	cmd.exe	cacls.exe
PID 4696 wrote to memory of 4932	4696	cmd.exe	cacls.exe
PID 2844 wrote to memory of 4904	2844	legenda.exe	10MIL.exe
PID 2844 wrote to memory of 4904	2844	legenda.exe	10MIL.exe
PID 2844 wrote to memory of 4904	2844	legenda.exe	10MIL.exe
PID 2844 wrote to memory of 880	2844	legenda.exe	rundll32.exe
PID 2844 wrote to memory of 880	2844	legenda.exe	rundll32.exe
PID 2844 wrote to memory of 880	2844	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe
"C:\Users\Admin\AppData\Local\Temp\5c4ce6d2623800b9bf3e0717637f9c9be26162aa05949a4770c0ed157cd47765.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3648

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1083.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1083.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3592

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5874.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5874.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4280

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5965.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5965.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4828

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5307.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5307.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8958xl.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8958xl.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35KX31.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35KX31.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlJDr86.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlJDr86.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65pS93.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65pS93.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:4324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4876

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:4680

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:3444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4684

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:3848

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe
"C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:880

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe
Filesize
175KB

MD5
ff7f91fa0ee41b37bb8196d9bb44070c

SHA1
b332b64d585e605dddc0c6d88a47323d8c3fc4d1

SHA256
04a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e

SHA512
58346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe
Filesize
175KB

MD5
ff7f91fa0ee41b37bb8196d9bb44070c

SHA1
b332b64d585e605dddc0c6d88a47323d8c3fc4d1

SHA256
04a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e

SHA512
58346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000134001\10MIL.exe
Filesize
175KB

MD5
ff7f91fa0ee41b37bb8196d9bb44070c

SHA1
b332b64d585e605dddc0c6d88a47323d8c3fc4d1

SHA256
04a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e

SHA512
58346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65pS93.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65pS93.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1083.exe
Filesize
850KB

MD5
39f48a2b992ace6aaa21b7f71be81df5

SHA1
dd0c724359a0a3538186e9e42c8a7c99cb3dd34c

SHA256
e46d18b1e707353576948b8b786ff45e038d1e17bb91c3643e8c1efbb973a750

SHA512
7a882335c76367c4ed3e1801ec396a13b213c9a43b64961592d66c77068563566369821f1f46484cd9bfdf1761295a99d2bdadc56d995660bcc191d20c20abea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1083.exe
Filesize
850KB

MD5
39f48a2b992ace6aaa21b7f71be81df5

SHA1
dd0c724359a0a3538186e9e42c8a7c99cb3dd34c

SHA256
e46d18b1e707353576948b8b786ff45e038d1e17bb91c3643e8c1efbb973a750

SHA512
7a882335c76367c4ed3e1801ec396a13b213c9a43b64961592d66c77068563566369821f1f46484cd9bfdf1761295a99d2bdadc56d995660bcc191d20c20abea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlJDr86.exe
Filesize
175KB

MD5
50809fe16d7c482c1f4a2ea19fdcbc0a

SHA1
11b6f69c06a724da15183b16039c5cbc86016158

SHA256
09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

SHA512
c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlJDr86.exe
Filesize
175KB

MD5
50809fe16d7c482c1f4a2ea19fdcbc0a

SHA1
11b6f69c06a724da15183b16039c5cbc86016158

SHA256
09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

SHA512
c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5874.exe
Filesize
708KB

MD5
424bfb72d5489dafa48f36dd93ee2486

SHA1
e5bd12a3e8d72e4fae2d1845101774db77985b0d

SHA256
8656b0cb091ccb98b5d025e97a0e1feaa6277547f25d26c0fcd9f17215a6d891

SHA512
d99325d689b7e8ac87109f4b8755e558dda9cedf053838846db2db23e60aeb3df5b1ce31efc13729bbf89f33b04bcbcb91af8ee443425bc92b40a98e29446a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5874.exe
Filesize
708KB

MD5
424bfb72d5489dafa48f36dd93ee2486

SHA1
e5bd12a3e8d72e4fae2d1845101774db77985b0d

SHA256
8656b0cb091ccb98b5d025e97a0e1feaa6277547f25d26c0fcd9f17215a6d891

SHA512
d99325d689b7e8ac87109f4b8755e558dda9cedf053838846db2db23e60aeb3df5b1ce31efc13729bbf89f33b04bcbcb91af8ee443425bc92b40a98e29446a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35KX31.exe
Filesize
497KB

MD5
92de286330866cc2024418d307db17d0

SHA1
d8aef3579450b8e0eb4026a6b2eedf26603f1a5e

SHA256
5750ae0019621f60ed511732c90152d9ae3c5877357e52446fe14e6d876f31c1

SHA512
ae8ce19ac3890f828eeb49e67f1c478b38fe1c4164bb407a3d1bdddcde5f92d0424bd4950522c342ace8994eaf2cf6a44091ce36dbde9774d67ac50d4ef8635b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35KX31.exe
Filesize
497KB

MD5
92de286330866cc2024418d307db17d0

SHA1
d8aef3579450b8e0eb4026a6b2eedf26603f1a5e

SHA256
5750ae0019621f60ed511732c90152d9ae3c5877357e52446fe14e6d876f31c1

SHA512
ae8ce19ac3890f828eeb49e67f1c478b38fe1c4164bb407a3d1bdddcde5f92d0424bd4950522c342ace8994eaf2cf6a44091ce36dbde9774d67ac50d4ef8635b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5965.exe
Filesize
351KB

MD5
17f9c6dc35f998c43b4e8d3db3d0195f

SHA1
bff9d9b4b6e056416b9f89040db84647353ca88e

SHA256
503427077c0ae67c076d2fe84eaf6347105ec66b7318036cfe040c79b0d2dfce

SHA512
b9f25aa01dd6b8fbeeebba5636d1492607ed92c64688fce9bab2ce96e58d1570a970f6093f2eb26f653ccd3e4b4f143dca92f137d238cf6ab22ca56862520046

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5965.exe
Filesize
351KB

MD5
17f9c6dc35f998c43b4e8d3db3d0195f

SHA1
bff9d9b4b6e056416b9f89040db84647353ca88e

SHA256
503427077c0ae67c076d2fe84eaf6347105ec66b7318036cfe040c79b0d2dfce

SHA512
b9f25aa01dd6b8fbeeebba5636d1492607ed92c64688fce9bab2ce96e58d1570a970f6093f2eb26f653ccd3e4b4f143dca92f137d238cf6ab22ca56862520046

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5307.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5307.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8958xl.exe
Filesize
438KB

MD5
0f53cf170f35ff8e046b814435614c77

SHA1
ce6dbf0d6a330b74343226e60be71f8d9bc5cb36

SHA256
f14638b983e9e611787a4a0c9269e388e98a19cc1947339ba99b22352e169447

SHA512
57d6554d2c1f4a9140fd83e6192fa56cf8b23c586a5c3e663a4432134929c08f4e6eb361655955972a857728d09362f1ed1716bd1173fda7f985269ae0b9eec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8958xl.exe
Filesize
438KB

MD5
0f53cf170f35ff8e046b814435614c77

SHA1
ce6dbf0d6a330b74343226e60be71f8d9bc5cb36

SHA256
f14638b983e9e611787a4a0c9269e388e98a19cc1947339ba99b22352e169447

SHA512
57d6554d2c1f4a9140fd83e6192fa56cf8b23c586a5c3e663a4432134929c08f4e6eb361655955972a857728d09362f1ed1716bd1173fda7f985269ae0b9eec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
memory/1000-175-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-177-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-179-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-181-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-183-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-185-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-186-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1000-187-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1000-188-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/1000-189-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1000-191-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/1000-173-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-171-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-169-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-167-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-165-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-163-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-161-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-159-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-158-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/1000-157-0x0000000002410000-0x0000000002428000-memory.dmp

Filesize
96KB

Download
memory/1000-156-0x0000000004BF0000-0x00000000050EE000-memory.dmp

Filesize
5.0MB

Download
memory/1000-155-0x0000000002160000-0x000000000217A000-memory.dmp

Filesize
104KB

Download
memory/1000-154-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1000-153-0x00000000005C0000-0x00000000005ED000-memory.dmp

Filesize
180KB

Download
memory/2240-212-0x00000000005F0000-0x000000000063B000-memory.dmp

Filesize
300KB

Download
memory/2240-1122-0x00000000068D0000-0x0000000006DFC000-memory.dmp

Filesize
5.2MB

Download
memory/2240-219-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2240-223-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-225-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-227-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-229-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-231-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-233-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-235-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-1108-0x00000000051C0000-0x00000000057C6000-memory.dmp

Filesize
6.0MB

Download
memory/2240-1109-0x00000000057E0000-0x00000000058EA000-memory.dmp

Filesize
1.0MB

Download
memory/2240-1110-0x0000000005920000-0x0000000005932000-memory.dmp

Filesize
72KB

Download
memory/2240-1111-0x0000000005940000-0x000000000597E000-memory.dmp

Filesize
248KB

Download
memory/2240-1112-0x0000000005A90000-0x0000000005ADB000-memory.dmp

Filesize
300KB

Download
memory/2240-1113-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2240-1114-0x0000000005C20000-0x0000000005CB2000-memory.dmp

Filesize
584KB

Download
memory/2240-1115-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/2240-1117-0x00000000064C0000-0x0000000006536000-memory.dmp

Filesize
472KB

Download
memory/2240-1118-0x0000000006550000-0x00000000065A0000-memory.dmp

Filesize
320KB

Download
memory/2240-1119-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2240-1120-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2240-1121-0x0000000006700000-0x00000000068C2000-memory.dmp

Filesize
1.8MB

Download
memory/2240-221-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-196-0x00000000008D0000-0x0000000000916000-memory.dmp

Filesize
280KB

Download
memory/2240-197-0x0000000002340000-0x0000000002384000-memory.dmp

Filesize
272KB

Download
memory/2240-198-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-217-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2240-215-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-218-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-214-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2240-211-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-205-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-207-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-209-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-199-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-201-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/2240-203-0x0000000002340000-0x000000000237E000-memory.dmp

Filesize
248KB

Download
memory/3732-1130-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/3732-1129-0x0000000005160000-0x00000000051AB000-memory.dmp

Filesize
300KB

Download
memory/3732-1128-0x0000000000720000-0x0000000000752000-memory.dmp

Filesize
200KB

Download
memory/4312-147-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/4904-1156-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/4904-1155-0x0000000006D30000-0x0000000006D7B000-memory.dmp

Filesize
300KB

Download
memory/4904-1154-0x0000000000030000-0x0000000000062000-memory.dmp

Filesize
200KB

Download