amadey | b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc

Analysis

max time kernel
124s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe
Size

1022KB
MD5

b1504cfd1158a5687793a8699e58c2b1
SHA1

1ca97fba3dd2f0d1d54101cc88ec658504c1d0ee
SHA256

b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc
SHA512

d1f33d9b780e580df35357e4b53f0375ae3a88b292d32ef26ee7b18cb9f3dcea21f2dc1f3e092119145d65184ad8abca1cbe1735945aa56e40117380b329a9a1
SSDEEP

24576:yyNAO1Rpfq64M/mvtfDZlrqmip0hi2dLtS9uoA5RXyjWX+p1wTBi:ZNAgRY64MOJDqlp0hlZtwu/v4Tq

Score

10^/10

amadey redline down lown discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

193.233.20.31:4125

Attributes

auth_value
4cf836e062bcdc2a4fdbf410f5747ec7

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz3994.exev3325PC.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz3994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz3994.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v3325PC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v3325PC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz3994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz3994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz3994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz3994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v3325PC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v3325PC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v3325PC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v3325PC.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4944-210-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-211-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-213-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-215-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-217-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-219-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-221-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-223-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-225-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-227-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-229-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-231-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-233-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-235-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-237-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-239-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-241-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-243-0x0000000004D10000-0x0000000004D4E000-memory.dmp	family_redline
behavioral1/memory/4944-1129-0x0000000004E70000-0x0000000004E80000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y85Pq62.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y85Pq62.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 11 IoCs

Processes:

zap9081.exezap0056.exezap4411.exetz3994.exev3325PC.exew47kC69.exexRMBD77.exey85Pq62.exelegenda.exelegenda.exelegenda.exe

pid	process
2120	zap9081.exe
3472	zap0056.exe
3400	zap4411.exe
1796	tz3994.exe
404	v3325PC.exe
4944	w47kC69.exe
1292	xRMBD77.exe
2044	y85Pq62.exe
3228	legenda.exe
4724	legenda.exe
2552	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3476 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3476	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz3994.exev3325PC.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz3994.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v3325PC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v3325PC.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap4411.exeb5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exezap9081.exezap0056.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap4411.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap4411.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9081.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0056.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap0056.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4580 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz3994.exev3325PC.exew47kC69.exexRMBD77.exe

pid process

1796 tz3994.exe
1796 tz3994.exe
404 v3325PC.exe
404 v3325PC.exe
4944 w47kC69.exe
4944 w47kC69.exe
1292 xRMBD77.exe
1292 xRMBD77.exe

pid	process
4580	schtasks.exe

pid	process
1796	tz3994.exe
1796	tz3994.exe
404	v3325PC.exe
404	v3325PC.exe
4944	w47kC69.exe
4944	w47kC69.exe
1292	xRMBD77.exe
1292	xRMBD77.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz3994.exev3325PC.exew47kC69.exexRMBD77.exe

description	pid	process
Token: SeDebugPrivilege	1796	tz3994.exe
Token: SeDebugPrivilege	404	v3325PC.exe
Token: SeDebugPrivilege	4944	w47kC69.exe
Token: SeDebugPrivilege	1292	xRMBD77.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exezap9081.exezap0056.exezap4411.exey85Pq62.exelegenda.execmd.exe

description	pid	process	target process
PID 4836 wrote to memory of 2120	4836	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe	zap9081.exe
PID 4836 wrote to memory of 2120	4836	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe	zap9081.exe
PID 4836 wrote to memory of 2120	4836	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe	zap9081.exe
PID 2120 wrote to memory of 3472	2120	zap9081.exe	zap0056.exe
PID 2120 wrote to memory of 3472	2120	zap9081.exe	zap0056.exe
PID 2120 wrote to memory of 3472	2120	zap9081.exe	zap0056.exe
PID 3472 wrote to memory of 3400	3472	zap0056.exe	zap4411.exe
PID 3472 wrote to memory of 3400	3472	zap0056.exe	zap4411.exe
PID 3472 wrote to memory of 3400	3472	zap0056.exe	zap4411.exe
PID 3400 wrote to memory of 1796	3400	zap4411.exe	tz3994.exe
PID 3400 wrote to memory of 1796	3400	zap4411.exe	tz3994.exe
PID 3400 wrote to memory of 404	3400	zap4411.exe	v3325PC.exe
PID 3400 wrote to memory of 404	3400	zap4411.exe	v3325PC.exe
PID 3400 wrote to memory of 404	3400	zap4411.exe	v3325PC.exe
PID 3472 wrote to memory of 4944	3472	zap0056.exe	w47kC69.exe
PID 3472 wrote to memory of 4944	3472	zap0056.exe	w47kC69.exe
PID 3472 wrote to memory of 4944	3472	zap0056.exe	w47kC69.exe
PID 2120 wrote to memory of 1292	2120	zap9081.exe	xRMBD77.exe
PID 2120 wrote to memory of 1292	2120	zap9081.exe	xRMBD77.exe
PID 2120 wrote to memory of 1292	2120	zap9081.exe	xRMBD77.exe
PID 4836 wrote to memory of 2044	4836	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe	y85Pq62.exe
PID 4836 wrote to memory of 2044	4836	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe	y85Pq62.exe
PID 4836 wrote to memory of 2044	4836	b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe	y85Pq62.exe
PID 2044 wrote to memory of 3228	2044	y85Pq62.exe	legenda.exe
PID 2044 wrote to memory of 3228	2044	y85Pq62.exe	legenda.exe
PID 2044 wrote to memory of 3228	2044	y85Pq62.exe	legenda.exe
PID 3228 wrote to memory of 4580	3228	legenda.exe	schtasks.exe
PID 3228 wrote to memory of 4580	3228	legenda.exe	schtasks.exe
PID 3228 wrote to memory of 4580	3228	legenda.exe	schtasks.exe
PID 3228 wrote to memory of 4628	3228	legenda.exe	cmd.exe
PID 3228 wrote to memory of 4628	3228	legenda.exe	cmd.exe
PID 3228 wrote to memory of 4628	3228	legenda.exe	cmd.exe
PID 4628 wrote to memory of 244	4628	cmd.exe	cmd.exe
PID 4628 wrote to memory of 244	4628	cmd.exe	cmd.exe
PID 4628 wrote to memory of 244	4628	cmd.exe	cmd.exe
PID 4628 wrote to memory of 228	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 228	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 228	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 232	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 232	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 232	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 4700	4628	cmd.exe	cmd.exe
PID 4628 wrote to memory of 4700	4628	cmd.exe	cmd.exe
PID 4628 wrote to memory of 4700	4628	cmd.exe	cmd.exe
PID 4628 wrote to memory of 1076	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 1076	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 1076	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 3376	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 3376	4628	cmd.exe	cacls.exe
PID 4628 wrote to memory of 3376	4628	cmd.exe	cacls.exe
PID 3228 wrote to memory of 3476	3228	legenda.exe	rundll32.exe
PID 3228 wrote to memory of 3476	3228	legenda.exe	rundll32.exe
PID 3228 wrote to memory of 3476	3228	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe
"C:\Users\Admin\AppData\Local\Temp\b5924d960665f5db4db5b0b17ae25a508a5a69209d84d653b3bc2a4449510afc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4836

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9081.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9081.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0056.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0056.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3472

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4411.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4411.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3994.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3994.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3325PC.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3325PC.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47kC69.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47kC69.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRMBD77.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRMBD77.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y85Pq62.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y85Pq62.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:4580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:244

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:228

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4700

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:1076

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3376

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:3476

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y85Pq62.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y85Pq62.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9081.exe
Filesize
837KB

MD5
c507dffc5875325848c556a58cfee639

SHA1
2a19082ea08c96b3953d0b457f970d4d2688cb5b

SHA256
d0be4fcc2a7bbf1c04f3987bab5b4bbe5f42a0cb3ac80252a91bd671f001ff34

SHA512
06d6614a0cff4f630cddca07a50d284dcc2fc121220b5e7cbe82fa70351256d7b05355b0ef0e6644d838676c22ced7f78a87106ea76f041415c13518b683d97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9081.exe
Filesize
837KB

MD5
c507dffc5875325848c556a58cfee639

SHA1
2a19082ea08c96b3953d0b457f970d4d2688cb5b

SHA256
d0be4fcc2a7bbf1c04f3987bab5b4bbe5f42a0cb3ac80252a91bd671f001ff34

SHA512
06d6614a0cff4f630cddca07a50d284dcc2fc121220b5e7cbe82fa70351256d7b05355b0ef0e6644d838676c22ced7f78a87106ea76f041415c13518b683d97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRMBD77.exe
Filesize
175KB

MD5
50809fe16d7c482c1f4a2ea19fdcbc0a

SHA1
11b6f69c06a724da15183b16039c5cbc86016158

SHA256
09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

SHA512
c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRMBD77.exe
Filesize
175KB

MD5
50809fe16d7c482c1f4a2ea19fdcbc0a

SHA1
11b6f69c06a724da15183b16039c5cbc86016158

SHA256
09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

SHA512
c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0056.exe
Filesize
695KB

MD5
d80e5d28716ff778078eb09b06069fd7

SHA1
2fa5ed6433f840fea83e9ddb14f0526548125c24

SHA256
f38491994863753dccef000e5be1aed4eb006eaf9ca3165b0bc8916aa3e19212

SHA512
82f0b4b223cd4994516c2e288bacdb4c8b3fc2af202f8e24a3bf41a58dfe44d50809cefb6e876c675c74cddd9b69134de69c26c4319eec6626f38816f79620da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0056.exe
Filesize
695KB

MD5
d80e5d28716ff778078eb09b06069fd7

SHA1
2fa5ed6433f840fea83e9ddb14f0526548125c24

SHA256
f38491994863753dccef000e5be1aed4eb006eaf9ca3165b0bc8916aa3e19212

SHA512
82f0b4b223cd4994516c2e288bacdb4c8b3fc2af202f8e24a3bf41a58dfe44d50809cefb6e876c675c74cddd9b69134de69c26c4319eec6626f38816f79620da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47kC69.exe
Filesize
349KB

MD5
f680e79a1c589385eed0eaf05087030b

SHA1
e94e630625d3bbf3eee0291d9dca09dfc0378a39

SHA256
50714f2fde8f1f84fd842d2c3097109ca94cf3a053a8486c287b42f906d5c1fc

SHA512
8534ebb91cbc3aed032f72f57877bf17f84a47b43ed298c100726d24b4273b31b1f37470d2f4e87625bd367885bca437bc067ee5585db73cf21e295f84d596df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47kC69.exe
Filesize
349KB

MD5
f680e79a1c589385eed0eaf05087030b

SHA1
e94e630625d3bbf3eee0291d9dca09dfc0378a39

SHA256
50714f2fde8f1f84fd842d2c3097109ca94cf3a053a8486c287b42f906d5c1fc

SHA512
8534ebb91cbc3aed032f72f57877bf17f84a47b43ed298c100726d24b4273b31b1f37470d2f4e87625bd367885bca437bc067ee5585db73cf21e295f84d596df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4411.exe
Filesize
345KB

MD5
44cfef50d47138d0e3e917a21d077187

SHA1
19ef1128adc469544078e7efe13b6f1f0e1833b4

SHA256
40acc2dd0602162ce6de54e606e0e40e9b91b4ef7f9d080f895e77c175aff1f3

SHA512
5d4ef0da32cb72e825dd328a91d9a9748c3f371949497158fb8470594d5d3da8b24104503409361f62bde4ebfe6f0b9f30c8528290d84089f1de657eeb510717

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4411.exe
Filesize
345KB

MD5
44cfef50d47138d0e3e917a21d077187

SHA1
19ef1128adc469544078e7efe13b6f1f0e1833b4

SHA256
40acc2dd0602162ce6de54e606e0e40e9b91b4ef7f9d080f895e77c175aff1f3

SHA512
5d4ef0da32cb72e825dd328a91d9a9748c3f371949497158fb8470594d5d3da8b24104503409361f62bde4ebfe6f0b9f30c8528290d84089f1de657eeb510717

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3994.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3994.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3325PC.exe
Filesize
291KB

MD5
664b787073d55ce630fd8639c8db1a79

SHA1
a39a4d260d83e50133316f07e218845a2d352c04

SHA256
433183d1561c89a961efd28c59b1c11127e6ac74919e349cc1d0b57ec5b9ce15

SHA512
0e91668939d8f41f9c31ace9f375505732e11e506ff33c29a71ec3c62c0edd703c5719aa034f808fb319efba65f6bfe2db91f476ec3328569037790b1ea5556b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3325PC.exe
Filesize
291KB

MD5
664b787073d55ce630fd8639c8db1a79

SHA1
a39a4d260d83e50133316f07e218845a2d352c04

SHA256
433183d1561c89a961efd28c59b1c11127e6ac74919e349cc1d0b57ec5b9ce15

SHA512
0e91668939d8f41f9c31ace9f375505732e11e506ff33c29a71ec3c62c0edd703c5719aa034f808fb319efba65f6bfe2db91f476ec3328569037790b1ea5556b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/404-168-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/404-187-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-191-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-193-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-195-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-197-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-199-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-200-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/404-201-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/404-202-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/404-203-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/404-205-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/404-167-0x0000000002260000-0x000000000228D000-memory.dmp

Filesize
180KB

Download
memory/404-189-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-185-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-183-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-181-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-179-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-177-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-175-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-173-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-172-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/404-171-0x0000000004F20000-0x00000000054C4000-memory.dmp

Filesize
5.6MB

Download
memory/404-170-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/404-169-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1292-1142-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/1292-1141-0x0000000000700000-0x0000000000732000-memory.dmp

Filesize
200KB

Download
memory/1796-161-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/4944-221-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-241-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-243-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-428-0x0000000002220000-0x000000000226B000-memory.dmp

Filesize
300KB

Download
memory/4944-432-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-433-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-429-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-1120-0x0000000005530000-0x0000000005B48000-memory.dmp

Filesize
6.1MB

Download
memory/4944-1121-0x0000000005B50000-0x0000000005C5A000-memory.dmp

Filesize
1.0MB

Download
memory/4944-1122-0x0000000004E50000-0x0000000004E62000-memory.dmp

Filesize
72KB

Download
memory/4944-1123-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/4944-1124-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-1125-0x0000000005F50000-0x0000000005FE2000-memory.dmp

Filesize
584KB

Download
memory/4944-1126-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/4944-1128-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-1129-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-1130-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-1131-0x00000000079D0000-0x0000000007B92000-memory.dmp

Filesize
1.8MB

Download
memory/4944-1132-0x0000000007BA0000-0x00000000080CC000-memory.dmp

Filesize
5.2MB

Download
memory/4944-1133-0x0000000008160000-0x00000000081D6000-memory.dmp

Filesize
472KB

Download
memory/4944-1134-0x00000000081F0000-0x0000000008240000-memory.dmp

Filesize
320KB

Download
memory/4944-1135-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4944-239-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-237-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-235-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-233-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-231-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-229-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-227-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-225-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-223-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-219-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-217-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-215-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-213-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-211-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download
memory/4944-210-0x0000000004D10000-0x0000000004D4E000-memory.dmp

Filesize
248KB

Download