amadey | 8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe
Size

1012KB
MD5

8e7b2388d0833affb27d6cab58ed64f7
SHA1

b37f3223edf17d43c01e9768e4fe87300e67c31a
SHA256

8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513
SHA512

4e7f7b3e12f047e9a024ae31fb755fd3673685f0c76e5e26402314c420bd457606ee35bfeb2225fb3487ee713ca592218aebe6a8059824500370dc4b6549f1b3
SSDEEP

24576:JyS2oPYjAxVqKjyQUifEIAG/+phqbG5HDxMM5Jc/:8S/wjAxQKjyQUiUOlSHlMy

Score

10^/10

amadey redline bolt down discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

bolt

193.233.20.31:4125

Attributes

auth_value
29540c7bf0277243e2faf6601e15a754

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz4372.exev8686Da.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4372.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v8686Da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v8686Da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v8686Da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4372.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4372.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4372.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v8686Da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v8686Da.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4372.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4372.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v8686Da.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2204-211-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-210-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-213-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-215-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-217-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-219-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-221-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-223-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-225-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-227-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-231-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-235-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-237-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-239-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-241-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-243-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-245-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-247-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/2204-1130-0x0000000007240000-0x0000000007250000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y05zY66.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	y05zY66.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 11 IoCs

Processes:

zap2203.exezap4114.exezap2498.exetz4372.exev8686Da.exew69og45.exexRtDS48.exey05zY66.exelegenda.exelegenda.exelegenda.exe

pid	process
544	zap2203.exe
1364	zap4114.exe
3808	zap2498.exe
3468	tz4372.exe
3868	v8686Da.exe
2204	w69og45.exe
1836	xRtDS48.exe
3844	y05zY66.exe
3404	legenda.exe
3088	legenda.exe
2276	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4364 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4364	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz4372.exev8686Da.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4372.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v8686Da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v8686Da.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exezap2203.exezap4114.exezap2498.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap2203.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap4114.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap4114.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2498.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap2498.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4268 3868 WerFault.exe v8686Da.exe
4208 2204 WerFault.exe w69og45.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4392 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz4372.exev8686Da.exew69og45.exexRtDS48.exe

pid process

3468 tz4372.exe
3468 tz4372.exe
3868 v8686Da.exe
3868 v8686Da.exe
2204 w69og45.exe
2204 w69og45.exe
1836 xRtDS48.exe
1836 xRtDS48.exe

pid	pid_target	process	target process
4268	3868	WerFault.exe	v8686Da.exe
4208	2204	WerFault.exe	w69og45.exe

pid	process
4392	schtasks.exe

pid	process
3468	tz4372.exe
3468	tz4372.exe
3868	v8686Da.exe
3868	v8686Da.exe
2204	w69og45.exe
2204	w69og45.exe
1836	xRtDS48.exe
1836	xRtDS48.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz4372.exev8686Da.exew69og45.exexRtDS48.exe

description	pid	process
Token: SeDebugPrivilege	3468	tz4372.exe
Token: SeDebugPrivilege	3868	v8686Da.exe
Token: SeDebugPrivilege	2204	w69og45.exe
Token: SeDebugPrivilege	1836	xRtDS48.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exezap2203.exezap4114.exezap2498.exey05zY66.exelegenda.execmd.exe

description	pid	process	target process
PID 3720 wrote to memory of 544	3720	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe	zap2203.exe
PID 3720 wrote to memory of 544	3720	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe	zap2203.exe
PID 3720 wrote to memory of 544	3720	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe	zap2203.exe
PID 544 wrote to memory of 1364	544	zap2203.exe	zap4114.exe
PID 544 wrote to memory of 1364	544	zap2203.exe	zap4114.exe
PID 544 wrote to memory of 1364	544	zap2203.exe	zap4114.exe
PID 1364 wrote to memory of 3808	1364	zap4114.exe	zap2498.exe
PID 1364 wrote to memory of 3808	1364	zap4114.exe	zap2498.exe
PID 1364 wrote to memory of 3808	1364	zap4114.exe	zap2498.exe
PID 3808 wrote to memory of 3468	3808	zap2498.exe	tz4372.exe
PID 3808 wrote to memory of 3468	3808	zap2498.exe	tz4372.exe
PID 3808 wrote to memory of 3868	3808	zap2498.exe	v8686Da.exe
PID 3808 wrote to memory of 3868	3808	zap2498.exe	v8686Da.exe
PID 3808 wrote to memory of 3868	3808	zap2498.exe	v8686Da.exe
PID 1364 wrote to memory of 2204	1364	zap4114.exe	w69og45.exe
PID 1364 wrote to memory of 2204	1364	zap4114.exe	w69og45.exe
PID 1364 wrote to memory of 2204	1364	zap4114.exe	w69og45.exe
PID 544 wrote to memory of 1836	544	zap2203.exe	xRtDS48.exe
PID 544 wrote to memory of 1836	544	zap2203.exe	xRtDS48.exe
PID 544 wrote to memory of 1836	544	zap2203.exe	xRtDS48.exe
PID 3720 wrote to memory of 3844	3720	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe	y05zY66.exe
PID 3720 wrote to memory of 3844	3720	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe	y05zY66.exe
PID 3720 wrote to memory of 3844	3720	8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe	y05zY66.exe
PID 3844 wrote to memory of 3404	3844	y05zY66.exe	legenda.exe
PID 3844 wrote to memory of 3404	3844	y05zY66.exe	legenda.exe
PID 3844 wrote to memory of 3404	3844	y05zY66.exe	legenda.exe
PID 3404 wrote to memory of 4392	3404	legenda.exe	schtasks.exe
PID 3404 wrote to memory of 4392	3404	legenda.exe	schtasks.exe
PID 3404 wrote to memory of 4392	3404	legenda.exe	schtasks.exe
PID 3404 wrote to memory of 1420	3404	legenda.exe	cmd.exe
PID 3404 wrote to memory of 1420	3404	legenda.exe	cmd.exe
PID 3404 wrote to memory of 1420	3404	legenda.exe	cmd.exe
PID 1420 wrote to memory of 1184	1420	cmd.exe	cmd.exe
PID 1420 wrote to memory of 1184	1420	cmd.exe	cmd.exe
PID 1420 wrote to memory of 1184	1420	cmd.exe	cmd.exe
PID 1420 wrote to memory of 1576	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 1576	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 1576	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 2080	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 2080	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 2080	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 4212	1420	cmd.exe	cmd.exe
PID 1420 wrote to memory of 4212	1420	cmd.exe	cmd.exe
PID 1420 wrote to memory of 4212	1420	cmd.exe	cmd.exe
PID 1420 wrote to memory of 3036	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 3036	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 3036	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 4236	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 4236	1420	cmd.exe	cacls.exe
PID 1420 wrote to memory of 4236	1420	cmd.exe	cacls.exe
PID 3404 wrote to memory of 4364	3404	legenda.exe	rundll32.exe
PID 3404 wrote to memory of 4364	3404	legenda.exe	rundll32.exe
PID 3404 wrote to memory of 4364	3404	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe
"C:\Users\Admin\AppData\Local\Temp\8c4e21d67872bc1508bc72bb9f56cf8ef9bafaa84b03cd7ed688869fbdba1513.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2203.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2203.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4114.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4114.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2498.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2498.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4372.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4372.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8686Da.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8686Da.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1080
        6⤵
        Program crash
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69og45.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69og45.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1932
        5⤵
        Program crash
        
        PID:4208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRtDS48.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRtDS48.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y05zY66.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y05zY66.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
    "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4392
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1184
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:N"
        5⤵
        
        PID:1576
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:R" /E
        5⤵
        
        PID:2080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4212
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:N"
        5⤵
        
        PID:3036
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:R" /E
        5⤵
        
        PID:4236
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3868 -ip 3868
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2204 -ip 2204
1⤵
PID:4572

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y05zY66.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y05zY66.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2203.exe

Filesize
828KB

MD5
94e6dbd644fd2e132e7fb5e76f32ed0f

SHA1
3e37b518ccad006fcb0b4501f9141f52dc8441b7

SHA256
c3259a11dcc5eb930dece00adfe1cd0c14490b2b78026c13ce5a2ec69739a6d6

SHA512
b4874333d328a983a0a3e803f632128e7d7babd697517ee79067d226091f3058369fa44b3c70122201e58ae2fde4686ad3ba783a6b427c07591b1f0e2c9707ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2203.exe

Filesize
828KB

MD5
94e6dbd644fd2e132e7fb5e76f32ed0f

SHA1
3e37b518ccad006fcb0b4501f9141f52dc8441b7

SHA256
c3259a11dcc5eb930dece00adfe1cd0c14490b2b78026c13ce5a2ec69739a6d6

SHA512
b4874333d328a983a0a3e803f632128e7d7babd697517ee79067d226091f3058369fa44b3c70122201e58ae2fde4686ad3ba783a6b427c07591b1f0e2c9707ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRtDS48.exe

Filesize
175KB

MD5
78efaf7292c2027da40635ca1aae855a

SHA1
686227a48e23b382a06c74f17d9b6f36e76042fd

SHA256
2f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab

SHA512
19e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xRtDS48.exe

Filesize
175KB

MD5
78efaf7292c2027da40635ca1aae855a

SHA1
686227a48e23b382a06c74f17d9b6f36e76042fd

SHA256
2f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab

SHA512
19e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4114.exe

Filesize
686KB

MD5
0c87f86d44271dc93ed3b1ead26681b3

SHA1
ed6c8787ea9a7dd3070febfc783f58413c59670d

SHA256
0c6cb9fcffbe72b1f336ff49205acb0a61bc0fb2b1a3b1873280e653e93eaca6

SHA512
ce43319d2f772fd77282d4f7c7dfcb9ad3da818107a31c78a1e4d70962c403b99595cc082ed211f3f0bd00877bd4706eaa06fa4ffffb08e657d8d4a84691df57

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4114.exe

Filesize
686KB

MD5
0c87f86d44271dc93ed3b1ead26681b3

SHA1
ed6c8787ea9a7dd3070febfc783f58413c59670d

SHA256
0c6cb9fcffbe72b1f336ff49205acb0a61bc0fb2b1a3b1873280e653e93eaca6

SHA512
ce43319d2f772fd77282d4f7c7dfcb9ad3da818107a31c78a1e4d70962c403b99595cc082ed211f3f0bd00877bd4706eaa06fa4ffffb08e657d8d4a84691df57

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69og45.exe

Filesize
355KB

MD5
cf4ecccde5b90481c84e771d0a7a1ade

SHA1
5b20a23ea98a14c25aa61561aa9d1cfff5309e76

SHA256
8509a56f852a78b7fe0ec738b949e7dc4e8e76f394affc470c61f92432db3236

SHA512
b77f6f85524362e1073c2b6175f1fc240794063f7d5e8d2cc9f033d979611568a7d4644bdb1d5922f732a758e80594b8d0e5da13942b32108e50dda2be9f1950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69og45.exe

Filesize
355KB

MD5
cf4ecccde5b90481c84e771d0a7a1ade

SHA1
5b20a23ea98a14c25aa61561aa9d1cfff5309e76

SHA256
8509a56f852a78b7fe0ec738b949e7dc4e8e76f394affc470c61f92432db3236

SHA512
b77f6f85524362e1073c2b6175f1fc240794063f7d5e8d2cc9f033d979611568a7d4644bdb1d5922f732a758e80594b8d0e5da13942b32108e50dda2be9f1950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2498.exe

Filesize
340KB

MD5
29201f84b82b987a94876181f1c4901f

SHA1
fbcc42fbdf8564bba46bd83e9d825069becf083a

SHA256
d52d114a150c719898c54bf61b9df1d165a9ae6b1126bab27431eaad29b227dc

SHA512
064bb6378b3f9f8442f9d6e83d23f89b26c247d24fecc8a5388fc32fb7f3a59b1a3e329b9a3b1d3fec460efc96039c3cf5c2ff4a5170fe75d6903ac8d84aded0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2498.exe

Filesize
340KB

MD5
29201f84b82b987a94876181f1c4901f

SHA1
fbcc42fbdf8564bba46bd83e9d825069becf083a

SHA256
d52d114a150c719898c54bf61b9df1d165a9ae6b1126bab27431eaad29b227dc

SHA512
064bb6378b3f9f8442f9d6e83d23f89b26c247d24fecc8a5388fc32fb7f3a59b1a3e329b9a3b1d3fec460efc96039c3cf5c2ff4a5170fe75d6903ac8d84aded0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4372.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4372.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8686Da.exe

Filesize
298KB

MD5
aca17643f0d4fb32ec440691d07b242d

SHA1
fa743a18410129e65c36989f84dda77a550514c9

SHA256
e17c658aea634c92b66bf553e9b581207348a28e6179b3b7aa7a36ce5ea8eeaa

SHA512
57557f9b902ec595d77394a26db1b83964cfc4a34b7f7ab7718f5cfa5faae6736bdf886cd6b54d4863a114e4e160bea40c2fc9daa83e5877b1280b5b2685836d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8686Da.exe

Filesize
298KB

MD5
aca17643f0d4fb32ec440691d07b242d

SHA1
fa743a18410129e65c36989f84dda77a550514c9

SHA256
e17c658aea634c92b66bf553e9b581207348a28e6179b3b7aa7a36ce5ea8eeaa

SHA512
57557f9b902ec595d77394a26db1b83964cfc4a34b7f7ab7718f5cfa5faae6736bdf886cd6b54d4863a114e4e160bea40c2fc9daa83e5877b1280b5b2685836d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/1836-1142-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/1836-1141-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download
memory/2204-1127-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/2204-245-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-1136-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-1134-0x0000000009090000-0x00000000095BC000-memory.dmp

Filesize
5.2MB

Download
memory/2204-1133-0x0000000008EA0000-0x0000000009062000-memory.dmp

Filesize
1.8MB

Download
memory/2204-1132-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-1131-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-1130-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-1129-0x0000000008BF0000-0x0000000008C40000-memory.dmp

Filesize
320KB

Download
memory/2204-1128-0x0000000008B70000-0x0000000008BE6000-memory.dmp

Filesize
472KB

Download
memory/2204-1126-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/2204-211-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-210-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-213-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-215-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-217-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-219-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-221-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-223-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-225-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-228-0x0000000002C80000-0x0000000002CCB000-memory.dmp

Filesize
300KB

Download
memory/2204-227-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-230-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-231-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-234-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-232-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-235-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-237-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-239-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-241-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-243-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-1124-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/2204-247-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/2204-1120-0x0000000007900000-0x0000000007F18000-memory.dmp

Filesize
6.1MB

Download
memory/2204-1121-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/2204-1122-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/2204-1123-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/3468-161-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/3868-185-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-204-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3868-183-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-205-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/3868-181-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-202-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3868-203-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3868-179-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-199-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-197-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-187-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-195-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-193-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-189-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/3868-177-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-175-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-173-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-172-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3868-171-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3868-170-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3868-169-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3868-168-0x0000000002C80000-0x0000000002CAD000-memory.dmp

Filesize
180KB

Download
memory/3868-167-0x0000000007350000-0x00000000078F4000-memory.dmp

Filesize
5.6MB

Download
memory/3868-191-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download