amadey | a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63

Analysis

max time kernel
132s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe
Size

1.0MB
MD5

d37f1d62b9a14999193f6349d524f108
SHA1

fe2ae90c42c2883370cab054f3337c5bc16072b2
SHA256

a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63
SHA512

55e492820c8c60549542aafaf72707e2a9d1028312624404f8b382da2f7e56d66298f49360cd1605053e185d1935ac4d1433b24eab12567134cf1b9c202b4479
SSDEEP

24576:Jy6TdOLzeaDb0ulSldns87e/ErAqSBJHk90D6iZ7xqqicy:86TAHeyQ8xmAqiJHU3iZ

Score

10^/10

amadey redline boris lida discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

lida

193.233.20.32:4125

Attributes

auth_value
24052aa2e9b85984a98d80cf08623e8d

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz8262.exev5697Yr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz8262.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz8262.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v5697Yr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v5697Yr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz8262.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz8262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v5697Yr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v5697Yr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v5697Yr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v5697Yr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz8262.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz8262.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4580-210-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-211-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-213-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-215-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-217-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-219-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-221-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-223-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-225-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-227-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-229-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-231-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-236-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-239-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-241-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-243-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-245-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline
behavioral1/memory/4580-247-0x0000000007170000-0x00000000071AF000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y16Ky39.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y16Ky39.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 10 IoCs

Processes:

zap3541.exezap1538.exezap3919.exetz8262.exev5697Yr.exew30ti96.exexBetE90.exey16Ky39.exelegenda.exelegenda.exe

pid	process
4700	zap3541.exe
368	zap1538.exe
1420	zap3919.exe
3768	tz8262.exe
4032	v5697Yr.exe
4580	w30ti96.exe
3580	xBetE90.exe
2628	y16Ky39.exe
5064	legenda.exe
4120	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4896 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4896	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz8262.exev5697Yr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz8262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v5697Yr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v5697Yr.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap3541.exezap1538.exezap3919.exea27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3541.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1538.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3919.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap3919.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3541.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3688 4032 WerFault.exe v5697Yr.exe
2212 4580 WerFault.exe w30ti96.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2164 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz8262.exev5697Yr.exew30ti96.exexBetE90.exe

pid process

3768 tz8262.exe
3768 tz8262.exe
4032 v5697Yr.exe
4032 v5697Yr.exe
4580 w30ti96.exe
4580 w30ti96.exe
3580 xBetE90.exe
3580 xBetE90.exe

pid	pid_target	process	target process
3688	4032	WerFault.exe	v5697Yr.exe
2212	4580	WerFault.exe	w30ti96.exe

pid	process
2164	schtasks.exe

pid	process
3768	tz8262.exe
3768	tz8262.exe
4032	v5697Yr.exe
4032	v5697Yr.exe
4580	w30ti96.exe
4580	w30ti96.exe
3580	xBetE90.exe
3580	xBetE90.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz8262.exev5697Yr.exew30ti96.exexBetE90.exe

description	pid	process
Token: SeDebugPrivilege	3768	tz8262.exe
Token: SeDebugPrivilege	4032	v5697Yr.exe
Token: SeDebugPrivilege	4580	w30ti96.exe
Token: SeDebugPrivilege	3580	xBetE90.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exezap3541.exezap1538.exezap3919.exey16Ky39.exelegenda.execmd.exe

description	pid	process	target process
PID 1160 wrote to memory of 4700	1160	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe	zap3541.exe
PID 1160 wrote to memory of 4700	1160	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe	zap3541.exe
PID 1160 wrote to memory of 4700	1160	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe	zap3541.exe
PID 4700 wrote to memory of 368	4700	zap3541.exe	zap1538.exe
PID 4700 wrote to memory of 368	4700	zap3541.exe	zap1538.exe
PID 4700 wrote to memory of 368	4700	zap3541.exe	zap1538.exe
PID 368 wrote to memory of 1420	368	zap1538.exe	zap3919.exe
PID 368 wrote to memory of 1420	368	zap1538.exe	zap3919.exe
PID 368 wrote to memory of 1420	368	zap1538.exe	zap3919.exe
PID 1420 wrote to memory of 3768	1420	zap3919.exe	tz8262.exe
PID 1420 wrote to memory of 3768	1420	zap3919.exe	tz8262.exe
PID 1420 wrote to memory of 4032	1420	zap3919.exe	v5697Yr.exe
PID 1420 wrote to memory of 4032	1420	zap3919.exe	v5697Yr.exe
PID 1420 wrote to memory of 4032	1420	zap3919.exe	v5697Yr.exe
PID 368 wrote to memory of 4580	368	zap1538.exe	w30ti96.exe
PID 368 wrote to memory of 4580	368	zap1538.exe	w30ti96.exe
PID 368 wrote to memory of 4580	368	zap1538.exe	w30ti96.exe
PID 4700 wrote to memory of 3580	4700	zap3541.exe	xBetE90.exe
PID 4700 wrote to memory of 3580	4700	zap3541.exe	xBetE90.exe
PID 4700 wrote to memory of 3580	4700	zap3541.exe	xBetE90.exe
PID 1160 wrote to memory of 2628	1160	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe	y16Ky39.exe
PID 1160 wrote to memory of 2628	1160	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe	y16Ky39.exe
PID 1160 wrote to memory of 2628	1160	a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe	y16Ky39.exe
PID 2628 wrote to memory of 5064	2628	y16Ky39.exe	legenda.exe
PID 2628 wrote to memory of 5064	2628	y16Ky39.exe	legenda.exe
PID 2628 wrote to memory of 5064	2628	y16Ky39.exe	legenda.exe
PID 5064 wrote to memory of 2164	5064	legenda.exe	schtasks.exe
PID 5064 wrote to memory of 2164	5064	legenda.exe	schtasks.exe
PID 5064 wrote to memory of 2164	5064	legenda.exe	schtasks.exe
PID 5064 wrote to memory of 4860	5064	legenda.exe	cmd.exe
PID 5064 wrote to memory of 4860	5064	legenda.exe	cmd.exe
PID 5064 wrote to memory of 4860	5064	legenda.exe	cmd.exe
PID 4860 wrote to memory of 1712	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 1712	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 1712	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 4756	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4756	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4756	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4072	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4072	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4072	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 4752	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 4752	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 4752	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 448	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 448	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 448	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 3520	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 3520	4860	cmd.exe	cacls.exe
PID 4860 wrote to memory of 3520	4860	cmd.exe	cacls.exe
PID 5064 wrote to memory of 4896	5064	legenda.exe	rundll32.exe
PID 5064 wrote to memory of 4896	5064	legenda.exe	rundll32.exe
PID 5064 wrote to memory of 4896	5064	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe
"C:\Users\Admin\AppData\Local\Temp\a27a6325f20b04ced8771599ebc61e81f1158718c0151e817487184426345b63.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3541.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3541.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4700

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1538.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1538.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3919.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3919.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8262.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8262.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5697Yr.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5697Yr.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1080
6⤵
- Program crash
PID:3688

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w30ti96.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w30ti96.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1544
5⤵
- Program crash
PID:2212

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBetE90.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBetE90.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y16Ky39.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y16Ky39.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:2164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1712

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:4756

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4752

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:448

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3520

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4032 -ip 4032
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4580 -ip 4580
1⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y16Ky39.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y16Ky39.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3541.exe
Filesize
858KB

MD5
47dbcc22e6e56c8f142f2cbfc77c20de

SHA1
3587b84426869bc03b0115dcc67db5d88142c0dd

SHA256
45ec5d8142e824da2bd5c4bf33656807edfcc26ca048baf619dcee2f022a96ab

SHA512
f26d22872b74f0183e42cc22366690038edf8a332b2cd7ecbbafd9e22d59dc2a6c7f2f29004563c78f0c88ebc6ce13ee6cde6f525d7d118211cd686f299965df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3541.exe
Filesize
858KB

MD5
47dbcc22e6e56c8f142f2cbfc77c20de

SHA1
3587b84426869bc03b0115dcc67db5d88142c0dd

SHA256
45ec5d8142e824da2bd5c4bf33656807edfcc26ca048baf619dcee2f022a96ab

SHA512
f26d22872b74f0183e42cc22366690038edf8a332b2cd7ecbbafd9e22d59dc2a6c7f2f29004563c78f0c88ebc6ce13ee6cde6f525d7d118211cd686f299965df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBetE90.exe
Filesize
175KB

MD5
6b06147bf5fd26306978a93fe83127a4

SHA1
7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

SHA256
11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

SHA512
603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBetE90.exe
Filesize
175KB

MD5
6b06147bf5fd26306978a93fe83127a4

SHA1
7b14ff42f4441b985591ef5b7d4cc703f0bbcdfa

SHA256
11e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0

SHA512
603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1538.exe
Filesize
716KB

MD5
80b809c1bd0b4587d748d454c0e9651b

SHA1
d0a87865f502a28fd6acc4b3275445cbe2097e96

SHA256
4a87f48bb3d728e1d342520989a7aca9bc5ac22b949b5355f386cffb36dd8083

SHA512
5fc135c7284906f07372bf69174c0e4ec36a8091ff2df2157e7274122072bcea512c745b089805c5b76fe22c08730b1a608f395cd153b66803e19d108905c10f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1538.exe
Filesize
716KB

MD5
80b809c1bd0b4587d748d454c0e9651b

SHA1
d0a87865f502a28fd6acc4b3275445cbe2097e96

SHA256
4a87f48bb3d728e1d342520989a7aca9bc5ac22b949b5355f386cffb36dd8083

SHA512
5fc135c7284906f07372bf69174c0e4ec36a8091ff2df2157e7274122072bcea512c745b089805c5b76fe22c08730b1a608f395cd153b66803e19d108905c10f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w30ti96.exe
Filesize
387KB

MD5
b327f8311bb6e673631d8e9c35c06d12

SHA1
189c2642cd01647b1879904b6015d91269c7d4c2

SHA256
fd11e798d9caa00112951731458211d279443f83cd48028cdc00006c337d4f02

SHA512
47869c068a233f67b243f41685c57b4e961b401ccb69cbc13fa7f47053fa20a715e0c4e4c622173a6b7eee14c2c6394681639b316bc92a0bb52e056301854ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w30ti96.exe
Filesize
387KB

MD5
b327f8311bb6e673631d8e9c35c06d12

SHA1
189c2642cd01647b1879904b6015d91269c7d4c2

SHA256
fd11e798d9caa00112951731458211d279443f83cd48028cdc00006c337d4f02

SHA512
47869c068a233f67b243f41685c57b4e961b401ccb69cbc13fa7f47053fa20a715e0c4e4c622173a6b7eee14c2c6394681639b316bc92a0bb52e056301854ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3919.exe
Filesize
355KB

MD5
7233407cda1b8e23d3847d7bfe0a067e

SHA1
afb3ffbb6c58445c67cd3a1e30bfb0d48b89b281

SHA256
4d8d462486b807a107bb762e0f24b67dd22d4d3ab69e1a556ca50443b8b75454

SHA512
9070648c7f965b396ee98913363961232f758ae732d0576043d69d63132f69b9d93b8d1a9253d450f31154be66f3b3a6e8e8fcb9831c64c99df60cf04d4ccb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3919.exe
Filesize
355KB

MD5
7233407cda1b8e23d3847d7bfe0a067e

SHA1
afb3ffbb6c58445c67cd3a1e30bfb0d48b89b281

SHA256
4d8d462486b807a107bb762e0f24b67dd22d4d3ab69e1a556ca50443b8b75454

SHA512
9070648c7f965b396ee98913363961232f758ae732d0576043d69d63132f69b9d93b8d1a9253d450f31154be66f3b3a6e8e8fcb9831c64c99df60cf04d4ccb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8262.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8262.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5697Yr.exe
Filesize
329KB

MD5
16164b559298c7325aaa4f152d17f162

SHA1
95f4dba9ed396cb5a1f5668c57f2274cb4b78686

SHA256
4b6d47f676e75ac065a53db45841f1df6ff801853e00d975285518e17a18162d

SHA512
4672be9000cf17e0612a63535a82e5c828a8b07bad281b3f0276c29e1312b104410caf0207d41561332584c77a17e12621cd8d5f172b13955d190992a9037925

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5697Yr.exe
Filesize
329KB

MD5
16164b559298c7325aaa4f152d17f162

SHA1
95f4dba9ed396cb5a1f5668c57f2274cb4b78686

SHA256
4b6d47f676e75ac065a53db45841f1df6ff801853e00d975285518e17a18162d

SHA512
4672be9000cf17e0612a63535a82e5c828a8b07bad281b3f0276c29e1312b104410caf0207d41561332584c77a17e12621cd8d5f172b13955d190992a9037925

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/3580-1142-0x00000000056A0000-0x00000000056B0000-memory.dmp

Filesize
64KB

Download
memory/3580-1141-0x0000000000DC0000-0x0000000000DF2000-memory.dmp

Filesize
200KB

Download
memory/3768-161-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download
memory/4032-184-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-188-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-190-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-192-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-195-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/4032-194-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-197-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-199-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-200-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/4032-201-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/4032-202-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/4032-203-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/4032-205-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/4032-186-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-182-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-180-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-178-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-176-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-174-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-172-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-171-0x0000000004860000-0x0000000004872000-memory.dmp

Filesize
72KB

Download
memory/4032-170-0x0000000007450000-0x00000000079F4000-memory.dmp

Filesize
5.6MB

Download
memory/4032-169-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/4032-168-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/4032-167-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4580-217-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-234-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-236-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-237-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-235-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-239-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-241-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-243-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-245-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-247-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-1120-0x00000000078F0000-0x0000000007F08000-memory.dmp

Filesize
6.1MB

Download
memory/4580-1121-0x0000000007F10000-0x000000000801A000-memory.dmp

Filesize
1.0MB

Download
memory/4580-1122-0x0000000007280000-0x0000000007292000-memory.dmp

Filesize
72KB

Download
memory/4580-1123-0x00000000072A0000-0x00000000072DC000-memory.dmp

Filesize
240KB

Download
memory/4580-1124-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-1126-0x0000000008280000-0x00000000082E6000-memory.dmp

Filesize
408KB

Download
memory/4580-1127-0x0000000008950000-0x00000000089E2000-memory.dmp

Filesize
584KB

Download
memory/4580-1128-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-1129-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-1130-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4580-1131-0x0000000008B80000-0x0000000008BF6000-memory.dmp

Filesize
472KB

Download
memory/4580-1132-0x0000000008C10000-0x0000000008C60000-memory.dmp

Filesize
320KB

Download
memory/4580-1133-0x0000000008EC0000-0x0000000009082000-memory.dmp

Filesize
1.8MB

Download
memory/4580-231-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-232-0x0000000002C60000-0x0000000002CAB000-memory.dmp

Filesize
300KB

Download
memory/4580-229-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-227-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-225-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-223-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-221-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-219-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-215-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-213-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-211-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-210-0x0000000007170000-0x00000000071AF000-memory.dmp

Filesize
252KB

Download
memory/4580-1134-0x0000000009090000-0x00000000095BC000-memory.dmp

Filesize
5.2MB

Download
memory/4580-1136-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download