amadey | 6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63

Analysis

max time kernel
144s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe
Size

1011KB
MD5

74600f062b79cc7a316c98ed45c7cfdf
SHA1

e5b6e1bb1f85efc5307f1615627c47615750513a
SHA256

6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63
SHA512

d1d3dd8bbcfe6ec0e697ec23b6fb721159bbbd425609b0313721d1b135549019eab21404134a886a2009e3aadfec4a31a4b62a7f05af100917d896a53fa5cf62
SSDEEP

24576:9ySbfTVnsR8alnbCxBbY3NU0aLGntBmu:YSbLVnsR8alnbyqNUPyntI

Score

10^/10

amadey redline bolt down discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

bolt

193.233.20.31:4125

Attributes

auth_value
29540c7bf0277243e2faf6601e15a754

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v9937Rp.exetz6757.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v9937Rp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v9937Rp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz6757.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz6757.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz6757.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v9937Rp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v9937Rp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz6757.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz6757.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz6757.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v9937Rp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v9937Rp.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3408-211-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-212-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-214-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-216-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-218-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-223-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-226-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-228-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-230-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-232-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-234-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-236-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-238-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-242-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-240-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-244-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/3408-246-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y77wk01.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y77wk01.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 11 IoCs

Processes:

zap3672.exezap3918.exezap4173.exetz6757.exev9937Rp.exew57qF26.exexpPCe67.exey77wk01.exelegenda.exelegenda.exelegenda.exe

pid	process
2732	zap3672.exe
4996	zap3918.exe
2396	zap4173.exe
844	tz6757.exe
4136	v9937Rp.exe
3408	w57qF26.exe
4648	xpPCe67.exe
3456	y77wk01.exe
1968	legenda.exe
784	legenda.exe
4960	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4344 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4344	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz6757.exev9937Rp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz6757.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v9937Rp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v9937Rp.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exezap3672.exezap3918.exezap4173.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3672.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3672.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3918.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap3918.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap4173.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap4173.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4424 4136 WerFault.exe v9937Rp.exe
3428 3408 WerFault.exe w57qF26.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3000 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz6757.exev9937Rp.exew57qF26.exexpPCe67.exe

pid process

844 tz6757.exe
844 tz6757.exe
4136 v9937Rp.exe
4136 v9937Rp.exe
3408 w57qF26.exe
3408 w57qF26.exe
4648 xpPCe67.exe
4648 xpPCe67.exe

pid	pid_target	process	target process
4424	4136	WerFault.exe	v9937Rp.exe
3428	3408	WerFault.exe	w57qF26.exe

pid	process
3000	schtasks.exe

pid	process
844	tz6757.exe
844	tz6757.exe
4136	v9937Rp.exe
4136	v9937Rp.exe
3408	w57qF26.exe
3408	w57qF26.exe
4648	xpPCe67.exe
4648	xpPCe67.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz6757.exev9937Rp.exew57qF26.exexpPCe67.exe

description	pid	process
Token: SeDebugPrivilege	844	tz6757.exe
Token: SeDebugPrivilege	4136	v9937Rp.exe
Token: SeDebugPrivilege	3408	w57qF26.exe
Token: SeDebugPrivilege	4648	xpPCe67.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exezap3672.exezap3918.exezap4173.exey77wk01.exelegenda.execmd.exe

description	pid	process	target process
PID 1328 wrote to memory of 2732	1328	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe	zap3672.exe
PID 1328 wrote to memory of 2732	1328	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe	zap3672.exe
PID 1328 wrote to memory of 2732	1328	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe	zap3672.exe
PID 2732 wrote to memory of 4996	2732	zap3672.exe	zap3918.exe
PID 2732 wrote to memory of 4996	2732	zap3672.exe	zap3918.exe
PID 2732 wrote to memory of 4996	2732	zap3672.exe	zap3918.exe
PID 4996 wrote to memory of 2396	4996	zap3918.exe	zap4173.exe
PID 4996 wrote to memory of 2396	4996	zap3918.exe	zap4173.exe
PID 4996 wrote to memory of 2396	4996	zap3918.exe	zap4173.exe
PID 2396 wrote to memory of 844	2396	zap4173.exe	tz6757.exe
PID 2396 wrote to memory of 844	2396	zap4173.exe	tz6757.exe
PID 2396 wrote to memory of 4136	2396	zap4173.exe	v9937Rp.exe
PID 2396 wrote to memory of 4136	2396	zap4173.exe	v9937Rp.exe
PID 2396 wrote to memory of 4136	2396	zap4173.exe	v9937Rp.exe
PID 4996 wrote to memory of 3408	4996	zap3918.exe	w57qF26.exe
PID 4996 wrote to memory of 3408	4996	zap3918.exe	w57qF26.exe
PID 4996 wrote to memory of 3408	4996	zap3918.exe	w57qF26.exe
PID 2732 wrote to memory of 4648	2732	zap3672.exe	xpPCe67.exe
PID 2732 wrote to memory of 4648	2732	zap3672.exe	xpPCe67.exe
PID 2732 wrote to memory of 4648	2732	zap3672.exe	xpPCe67.exe
PID 1328 wrote to memory of 3456	1328	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe	y77wk01.exe
PID 1328 wrote to memory of 3456	1328	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe	y77wk01.exe
PID 1328 wrote to memory of 3456	1328	6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe	y77wk01.exe
PID 3456 wrote to memory of 1968	3456	y77wk01.exe	legenda.exe
PID 3456 wrote to memory of 1968	3456	y77wk01.exe	legenda.exe
PID 3456 wrote to memory of 1968	3456	y77wk01.exe	legenda.exe
PID 1968 wrote to memory of 3000	1968	legenda.exe	schtasks.exe
PID 1968 wrote to memory of 3000	1968	legenda.exe	schtasks.exe
PID 1968 wrote to memory of 3000	1968	legenda.exe	schtasks.exe
PID 1968 wrote to memory of 4376	1968	legenda.exe	cmd.exe
PID 1968 wrote to memory of 4376	1968	legenda.exe	cmd.exe
PID 1968 wrote to memory of 4376	1968	legenda.exe	cmd.exe
PID 4376 wrote to memory of 704	4376	cmd.exe	cmd.exe
PID 4376 wrote to memory of 704	4376	cmd.exe	cmd.exe
PID 4376 wrote to memory of 704	4376	cmd.exe	cmd.exe
PID 4376 wrote to memory of 1440	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 1440	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 1440	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 1948	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 1948	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 1948	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 4076	4376	cmd.exe	cmd.exe
PID 4376 wrote to memory of 4076	4376	cmd.exe	cmd.exe
PID 4376 wrote to memory of 4076	4376	cmd.exe	cmd.exe
PID 4376 wrote to memory of 4112	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 4112	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 4112	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 3960	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 3960	4376	cmd.exe	cacls.exe
PID 4376 wrote to memory of 3960	4376	cmd.exe	cacls.exe
PID 1968 wrote to memory of 4344	1968	legenda.exe	rundll32.exe
PID 1968 wrote to memory of 4344	1968	legenda.exe	rundll32.exe
PID 1968 wrote to memory of 4344	1968	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe
"C:\Users\Admin\AppData\Local\Temp\6ef09b7cf396983ac950be6ca00c01b25d14177897790b2df5de021110067f63.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3672.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3672.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3918.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3918.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4996

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4173.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4173.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6757.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6757.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9937Rp.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9937Rp.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 1084
6⤵
- Program crash
PID:4424

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57qF26.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57qF26.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1336
5⤵
- Program crash
PID:3428

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpPCe67.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpPCe67.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77wk01.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77wk01.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:704

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:1440

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4076

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4112

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3960

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4136 -ip 4136
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3408 -ip 3408
1⤵
PID:4676

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:784

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77wk01.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77wk01.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3672.exe
Filesize
826KB

MD5
eae80a961cdc642883fe83f77b2a7e61

SHA1
1719c10e668d406224b0f9eea3aa30219fc538b3

SHA256
eb201d42debb12292fabcbc134de1dca14ff394f8c5ac8873cfe6d62c4c00112

SHA512
e5bcce1e656b994b0bf3130e8232356a23924e66e81d86118b3b578420e8c76f1e103ca0a90f203f552a50abd9eee834cf1fcfa11aaeb75166d9145daefc59d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3672.exe
Filesize
826KB

MD5
eae80a961cdc642883fe83f77b2a7e61

SHA1
1719c10e668d406224b0f9eea3aa30219fc538b3

SHA256
eb201d42debb12292fabcbc134de1dca14ff394f8c5ac8873cfe6d62c4c00112

SHA512
e5bcce1e656b994b0bf3130e8232356a23924e66e81d86118b3b578420e8c76f1e103ca0a90f203f552a50abd9eee834cf1fcfa11aaeb75166d9145daefc59d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpPCe67.exe
Filesize
175KB

MD5
78efaf7292c2027da40635ca1aae855a

SHA1
686227a48e23b382a06c74f17d9b6f36e76042fd

SHA256
2f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab

SHA512
19e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpPCe67.exe
Filesize
175KB

MD5
78efaf7292c2027da40635ca1aae855a

SHA1
686227a48e23b382a06c74f17d9b6f36e76042fd

SHA256
2f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab

SHA512
19e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3918.exe
Filesize
684KB

MD5
aae42447944d12f3ed87d4148b92204a

SHA1
1f90b30126d8337ca8ca92d0732171bbc04fd9ba

SHA256
a9ff799f9b2e3885de109bf85bd5fb0516171cc0242b58902c67f9eeae118169

SHA512
3dcc7ba8c1def795cfec1337e6e9a7f976aa80b2c7ead6a0037e01098ada46bbb4277da3c0607aca9eceeff597774a621791613cbcd3537b8ee7a25b574a2c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3918.exe
Filesize
684KB

MD5
aae42447944d12f3ed87d4148b92204a

SHA1
1f90b30126d8337ca8ca92d0732171bbc04fd9ba

SHA256
a9ff799f9b2e3885de109bf85bd5fb0516171cc0242b58902c67f9eeae118169

SHA512
3dcc7ba8c1def795cfec1337e6e9a7f976aa80b2c7ead6a0037e01098ada46bbb4277da3c0607aca9eceeff597774a621791613cbcd3537b8ee7a25b574a2c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57qF26.exe
Filesize
355KB

MD5
43d0e54d90b94f9878efd3e7e8d6e01d

SHA1
93212756f9a3acef0a98160f75883ae15987711f

SHA256
1be4e71e0c832208b940e817cf2489fcc904a2cc8bde5e12f85796039001e5d8

SHA512
c2ecf859851aed35ac237853756a8e142d46837ca213b190944412e1e76a0658f8a4fc262619116e800da405f31953a756312a48f819cb3a11f0fb24904bbdc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57qF26.exe
Filesize
355KB

MD5
43d0e54d90b94f9878efd3e7e8d6e01d

SHA1
93212756f9a3acef0a98160f75883ae15987711f

SHA256
1be4e71e0c832208b940e817cf2489fcc904a2cc8bde5e12f85796039001e5d8

SHA512
c2ecf859851aed35ac237853756a8e142d46837ca213b190944412e1e76a0658f8a4fc262619116e800da405f31953a756312a48f819cb3a11f0fb24904bbdc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4173.exe
Filesize
339KB

MD5
9cc1c196a8b60e5ff5593fa1fe920105

SHA1
2b1b395088f7b48d53336ce27725c54759dccb03

SHA256
4844cc1df199ae7fd678838962bb36b45641455fae8070e8ee171db648c2dda7

SHA512
47f0888f71f79447e7fb67ec661ab3563f1b26666be16f7e7c3b44de26ac56638d18405398ffed687d8b3cda293166e0e7b6564babd1009d9c2eb8b93a5abe07

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4173.exe
Filesize
339KB

MD5
9cc1c196a8b60e5ff5593fa1fe920105

SHA1
2b1b395088f7b48d53336ce27725c54759dccb03

SHA256
4844cc1df199ae7fd678838962bb36b45641455fae8070e8ee171db648c2dda7

SHA512
47f0888f71f79447e7fb67ec661ab3563f1b26666be16f7e7c3b44de26ac56638d18405398ffed687d8b3cda293166e0e7b6564babd1009d9c2eb8b93a5abe07

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6757.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6757.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9937Rp.exe
Filesize
298KB

MD5
5063cf6775cc79d8f6ccad1a232f4598

SHA1
3ce68fdc8e9f7badf54ac15f956e18030ec00e9a

SHA256
587ccede3e8cc8030a75b51f1c24978fc53f0e53f4edd1c6797f005514f8b5cf

SHA512
075cfd08b4aaaca30c744e5dea8ff262a1c97cc3ff1d5e979597bdf947826402aeb5021a06d734a3a878bfd4a9d235a202fee0b417e1c87aad44942dc80f672e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9937Rp.exe
Filesize
298KB

MD5
5063cf6775cc79d8f6ccad1a232f4598

SHA1
3ce68fdc8e9f7badf54ac15f956e18030ec00e9a

SHA256
587ccede3e8cc8030a75b51f1c24978fc53f0e53f4edd1c6797f005514f8b5cf

SHA512
075cfd08b4aaaca30c744e5dea8ff262a1c97cc3ff1d5e979597bdf947826402aeb5021a06d734a3a878bfd4a9d235a202fee0b417e1c87aad44942dc80f672e

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/844-163-0x000000001B1D0000-0x000000001B31E000-memory.dmp

Filesize
1.3MB

Download
memory/844-161-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/3408-1128-0x0000000008B90000-0x0000000008C22000-memory.dmp

Filesize
584KB

Download
memory/3408-244-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-1136-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-1135-0x000000000A2E0000-0x000000000A80C000-memory.dmp

Filesize
5.2MB

Download
memory/3408-1134-0x000000000A110000-0x000000000A2D2000-memory.dmp

Filesize
1.8MB

Download
memory/3408-1133-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-1132-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-1131-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-1130-0x0000000008CF0000-0x0000000008D40000-memory.dmp

Filesize
320KB

Download
memory/3408-1129-0x0000000008C60000-0x0000000008CD6000-memory.dmp

Filesize
472KB

Download
memory/3408-1127-0x00000000083C0000-0x0000000008426000-memory.dmp

Filesize
408KB

Download
memory/3408-1125-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-211-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-212-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-214-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-216-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-219-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

Filesize
300KB

Download
memory/3408-221-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-218-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-223-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-222-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-226-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-225-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/3408-228-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-230-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-232-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-234-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-236-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-238-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-242-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-240-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-1124-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/3408-246-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3408-1121-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/3408-1122-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/3408-1123-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/4136-188-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-168-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download
memory/4136-196-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-190-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-206-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/4136-205-0x00000000073C0000-0x00000000073D0000-memory.dmp

Filesize
64KB

Download
memory/4136-204-0x00000000073C0000-0x00000000073D0000-memory.dmp

Filesize
64KB

Download
memory/4136-202-0x00000000073C0000-0x00000000073D0000-memory.dmp

Filesize
64KB

Download
memory/4136-201-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/4136-200-0x00000000073C0000-0x00000000073D0000-memory.dmp

Filesize
64KB

Download
memory/4136-199-0x00000000073C0000-0x00000000073D0000-memory.dmp

Filesize
64KB

Download
memory/4136-198-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-194-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-192-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-174-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-184-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-186-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-182-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-180-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-178-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-176-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-169-0x00000000073C0000-0x00000000073D0000-memory.dmp

Filesize
64KB

Download
memory/4136-172-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-171-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4136-170-0x00000000073D0000-0x0000000007974000-memory.dmp

Filesize
5.6MB

Download
memory/4648-1142-0x0000000000740000-0x0000000000772000-memory.dmp

Filesize
200KB

Download
memory/4648-1143-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download