amadey | 62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe
Size

1.0MB
MD5

5e9076cada585316b8ddfdd3bc3c67cc
SHA1

764c51e93e8c31dfaf93ebdfdce7fa449c97a892
SHA256

62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303
SHA512

15e0e8ba33989aa79118b118fd23592e5f106736e5384a072d18aff4da482d0db5d7d4e4e256740eff0fe1eb92bcce06fe3abaa960ca114caa8645af40263d89
SSDEEP

12288:yMr5y90oxsOOppJO/2MGQW6SaBUD56KtdgWyoHSSHs4uBIvZC0qKOO69GQMzr7W5:DylOpp1E1Ktd1SS2BmCWOOWGQY7JA

Score

10^/10

amadey redline boris rotik discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

rotik

193.233.20.32:4125

Attributes

auth_value
74863478ae154e921eb729354d2bb4bd

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz4373.exev1787DG.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v1787DG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v1787DG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4373.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v1787DG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v1787DG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v1787DG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v1787DG.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5040-212-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-214-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-216-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-218-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-220-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-222-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-224-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-226-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-228-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-230-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-232-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-234-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-236-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-238-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-240-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-242-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-244-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline
behavioral1/memory/5040-246-0x00000000049D0000-0x0000000004A0F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y90QJ11.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y90QJ11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 11 IoCs

Processes:

zap3283.exezap1376.exezap4694.exetz4373.exev1787DG.exew23Bi68.exexWdLW07.exey90QJ11.exelegenda.exelegenda.exelegenda.exe

pid	process
1744	zap3283.exe
1796	zap1376.exe
4432	zap4694.exe
3452	tz4373.exe
4988	v1787DG.exe
5040	w23Bi68.exe
212	xWdLW07.exe
1292	y90QJ11.exe
4232	legenda.exe
2500	legenda.exe
1200	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1972 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1972	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz4373.exev1787DG.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4373.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v1787DG.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v1787DG.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap4694.exe62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exezap3283.exezap1376.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap4694.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3283.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3283.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1376.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1376.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap4694.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1564 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3724 4988 WerFault.exe v1787DG.exe
3876 5040 WerFault.exe w23Bi68.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1104 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz4373.exev1787DG.exew23Bi68.exexWdLW07.exe

pid process

3452 tz4373.exe
3452 tz4373.exe
4988 v1787DG.exe
4988 v1787DG.exe
5040 w23Bi68.exe
5040 w23Bi68.exe
212 xWdLW07.exe
212 xWdLW07.exe

pid	process
1564	sc.exe

pid	pid_target	process	target process
3724	4988	WerFault.exe	v1787DG.exe
3876	5040	WerFault.exe	w23Bi68.exe

pid	process
1104	schtasks.exe

pid	process
3452	tz4373.exe
3452	tz4373.exe
4988	v1787DG.exe
4988	v1787DG.exe
5040	w23Bi68.exe
5040	w23Bi68.exe
212	xWdLW07.exe
212	xWdLW07.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz4373.exev1787DG.exew23Bi68.exexWdLW07.exe

description	pid	process
Token: SeDebugPrivilege	3452	tz4373.exe
Token: SeDebugPrivilege	4988	v1787DG.exe
Token: SeDebugPrivilege	5040	w23Bi68.exe
Token: SeDebugPrivilege	212	xWdLW07.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exezap3283.exezap1376.exezap4694.exey90QJ11.exelegenda.execmd.exe

description	pid	process	target process
PID 1592 wrote to memory of 1744	1592	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe	zap3283.exe
PID 1592 wrote to memory of 1744	1592	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe	zap3283.exe
PID 1592 wrote to memory of 1744	1592	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe	zap3283.exe
PID 1744 wrote to memory of 1796	1744	zap3283.exe	zap1376.exe
PID 1744 wrote to memory of 1796	1744	zap3283.exe	zap1376.exe
PID 1744 wrote to memory of 1796	1744	zap3283.exe	zap1376.exe
PID 1796 wrote to memory of 4432	1796	zap1376.exe	zap4694.exe
PID 1796 wrote to memory of 4432	1796	zap1376.exe	zap4694.exe
PID 1796 wrote to memory of 4432	1796	zap1376.exe	zap4694.exe
PID 4432 wrote to memory of 3452	4432	zap4694.exe	tz4373.exe
PID 4432 wrote to memory of 3452	4432	zap4694.exe	tz4373.exe
PID 4432 wrote to memory of 4988	4432	zap4694.exe	v1787DG.exe
PID 4432 wrote to memory of 4988	4432	zap4694.exe	v1787DG.exe
PID 4432 wrote to memory of 4988	4432	zap4694.exe	v1787DG.exe
PID 1796 wrote to memory of 5040	1796	zap1376.exe	w23Bi68.exe
PID 1796 wrote to memory of 5040	1796	zap1376.exe	w23Bi68.exe
PID 1796 wrote to memory of 5040	1796	zap1376.exe	w23Bi68.exe
PID 1744 wrote to memory of 212	1744	zap3283.exe	xWdLW07.exe
PID 1744 wrote to memory of 212	1744	zap3283.exe	xWdLW07.exe
PID 1744 wrote to memory of 212	1744	zap3283.exe	xWdLW07.exe
PID 1592 wrote to memory of 1292	1592	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe	y90QJ11.exe
PID 1592 wrote to memory of 1292	1592	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe	y90QJ11.exe
PID 1592 wrote to memory of 1292	1592	62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe	y90QJ11.exe
PID 1292 wrote to memory of 4232	1292	y90QJ11.exe	legenda.exe
PID 1292 wrote to memory of 4232	1292	y90QJ11.exe	legenda.exe
PID 1292 wrote to memory of 4232	1292	y90QJ11.exe	legenda.exe
PID 4232 wrote to memory of 1104	4232	legenda.exe	schtasks.exe
PID 4232 wrote to memory of 1104	4232	legenda.exe	schtasks.exe
PID 4232 wrote to memory of 1104	4232	legenda.exe	schtasks.exe
PID 4232 wrote to memory of 2992	4232	legenda.exe	cmd.exe
PID 4232 wrote to memory of 2992	4232	legenda.exe	cmd.exe
PID 4232 wrote to memory of 2992	4232	legenda.exe	cmd.exe
PID 2992 wrote to memory of 3388	2992	cmd.exe	cmd.exe
PID 2992 wrote to memory of 3388	2992	cmd.exe	cmd.exe
PID 2992 wrote to memory of 3388	2992	cmd.exe	cmd.exe
PID 2992 wrote to memory of 2644	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 2644	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 2644	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 3352	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 3352	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 3352	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 1100	2992	cmd.exe	cmd.exe
PID 2992 wrote to memory of 1100	2992	cmd.exe	cmd.exe
PID 2992 wrote to memory of 1100	2992	cmd.exe	cmd.exe
PID 2992 wrote to memory of 4976	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 4976	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 4976	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 5100	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 5100	2992	cmd.exe	cacls.exe
PID 2992 wrote to memory of 5100	2992	cmd.exe	cacls.exe
PID 4232 wrote to memory of 1972	4232	legenda.exe	rundll32.exe
PID 4232 wrote to memory of 1972	4232	legenda.exe	rundll32.exe
PID 4232 wrote to memory of 1972	4232	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe
"C:\Users\Admin\AppData\Local\Temp\62ac58fc742a6838abd2743b8e72f92e3a4bb7bbf82705a6de4193b1beb60303.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3283.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3283.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1376.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1376.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4694.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4694.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4432

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4373.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4373.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1787DG.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1787DG.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1080
6⤵
- Program crash
PID:3724

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Bi68.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Bi68.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1332
5⤵
- Program crash
PID:3876

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xWdLW07.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xWdLW07.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y90QJ11.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y90QJ11.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:1104

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3388

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:2644

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:3352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1100

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4976

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:5100

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4988 -ip 4988
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5040 -ip 5040
1⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y90QJ11.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y90QJ11.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3283.exe
Filesize
856KB

MD5
445478f387e1e6bb4cad0051dedcdc7e

SHA1
e5fa133724143c7a234f9ed26d82ab1a3eb926c9

SHA256
e4007e20c90893f952001bbc0cfcf3476d9d244da3354619ca335ae310780ba5

SHA512
aefac8d85612ba18e255038ee29539927302bfae6c436e2094f7a6c41a3fd53a37d2439f94a560a3c697b235c059560fc44fa0c56bba27384e1c3e9fdae55013

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3283.exe
Filesize
856KB

MD5
445478f387e1e6bb4cad0051dedcdc7e

SHA1
e5fa133724143c7a234f9ed26d82ab1a3eb926c9

SHA256
e4007e20c90893f952001bbc0cfcf3476d9d244da3354619ca335ae310780ba5

SHA512
aefac8d85612ba18e255038ee29539927302bfae6c436e2094f7a6c41a3fd53a37d2439f94a560a3c697b235c059560fc44fa0c56bba27384e1c3e9fdae55013

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xWdLW07.exe
Filesize
175KB

MD5
efc3b1703bec9a0e79d4a9fdcedf4a20

SHA1
d019bfe5fbf05fde5cae0029f9580dca9677a3b2

SHA256
1d9b391ee239469206cf31022b982e66c2ab463d3106a38526103e1c1b8be855

SHA512
f36bbf81fe3bb68c8c8a1fc19dd7c79b386cfdb13b1e5d5e617c4a5ef8a38ed4c4c717f466c9293e2e1067d0f94c9d1ebc1814919e5c572dc66365fdd6009b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xWdLW07.exe
Filesize
175KB

MD5
efc3b1703bec9a0e79d4a9fdcedf4a20

SHA1
d019bfe5fbf05fde5cae0029f9580dca9677a3b2

SHA256
1d9b391ee239469206cf31022b982e66c2ab463d3106a38526103e1c1b8be855

SHA512
f36bbf81fe3bb68c8c8a1fc19dd7c79b386cfdb13b1e5d5e617c4a5ef8a38ed4c4c717f466c9293e2e1067d0f94c9d1ebc1814919e5c572dc66365fdd6009b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1376.exe
Filesize
714KB

MD5
48893c5a4e56b89b147017c2adc87e1a

SHA1
82bc7a15ee0554e88636b694b4336a6de3034035

SHA256
405b86c6cd58aa8c41d4d421725819dd4fb27dc1871a07ce097f599560dac59e

SHA512
a09c438bb56eb250978faf2f6a703c763247863771ba40e92a73a919070fa76f53e61037e3a9af53298b5549abd7bf938e06390ee9f0e0c351e6a7485770487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1376.exe
Filesize
714KB

MD5
48893c5a4e56b89b147017c2adc87e1a

SHA1
82bc7a15ee0554e88636b694b4336a6de3034035

SHA256
405b86c6cd58aa8c41d4d421725819dd4fb27dc1871a07ce097f599560dac59e

SHA512
a09c438bb56eb250978faf2f6a703c763247863771ba40e92a73a919070fa76f53e61037e3a9af53298b5549abd7bf938e06390ee9f0e0c351e6a7485770487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Bi68.exe
Filesize
385KB

MD5
10cf54c5eda4c2d3f662b537a8945da7

SHA1
be62b21f3cde2c8adf66e1679f1e1225758ab0ec

SHA256
9d29f3d3bb5758ed969c45ea436b3b2300cec749b5b1a18ec4571b9664b54277

SHA512
7dec56f3833f9d8a830fe72e48afa9ac1bda8b87a3faec64460a439da4b88970403f383b2c67b8c019d6e0e990de8c2d338bbaf8a89d2db85fdb574454cd3ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Bi68.exe
Filesize
385KB

MD5
10cf54c5eda4c2d3f662b537a8945da7

SHA1
be62b21f3cde2c8adf66e1679f1e1225758ab0ec

SHA256
9d29f3d3bb5758ed969c45ea436b3b2300cec749b5b1a18ec4571b9664b54277

SHA512
7dec56f3833f9d8a830fe72e48afa9ac1bda8b87a3faec64460a439da4b88970403f383b2c67b8c019d6e0e990de8c2d338bbaf8a89d2db85fdb574454cd3ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4694.exe
Filesize
354KB

MD5
e78504d6365d2fcb019ba1b98b6f2b02

SHA1
135e67fdd7dd656b52c449a5a13f3b5de5bb8df3

SHA256
e0592fac87a61344a2adb246c7de6aaacae96af7993c5dc41bb9e8b2c273e1dd

SHA512
2661ac8d1c7073c721cfb4f6bb44141468bb96cf3d5df0476ff96bb9fe6043ef9d2fb2757029d27cdbbf73c67367283c7c3b426c791447b79cfff2627c9f20dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4694.exe
Filesize
354KB

MD5
e78504d6365d2fcb019ba1b98b6f2b02

SHA1
135e67fdd7dd656b52c449a5a13f3b5de5bb8df3

SHA256
e0592fac87a61344a2adb246c7de6aaacae96af7993c5dc41bb9e8b2c273e1dd

SHA512
2661ac8d1c7073c721cfb4f6bb44141468bb96cf3d5df0476ff96bb9fe6043ef9d2fb2757029d27cdbbf73c67367283c7c3b426c791447b79cfff2627c9f20dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4373.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4373.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1787DG.exe
Filesize
328KB

MD5
11479ec9874141faae89a6c2cd2dfc8b

SHA1
0d438e6f420eabd6e1d7543a33d2552e69bac49e

SHA256
ddfd0b528b3341f710a0de38a37c7e38b38759ef6e6dcef46b97ebce0a047ddd

SHA512
b670e378567724627af3a10e9df4fefb91be324ea445d9e033ae2d27b6ae9567440a2b80d3d929ec737ab7d4013ec2ee7374d2d78d14101d031849f7aeac8660

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1787DG.exe
Filesize
328KB

MD5
11479ec9874141faae89a6c2cd2dfc8b

SHA1
0d438e6f420eabd6e1d7543a33d2552e69bac49e

SHA256
ddfd0b528b3341f710a0de38a37c7e38b38759ef6e6dcef46b97ebce0a047ddd

SHA512
b670e378567724627af3a10e9df4fefb91be324ea445d9e033ae2d27b6ae9567440a2b80d3d929ec737ab7d4013ec2ee7374d2d78d14101d031849f7aeac8660

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/212-1140-0x0000000000FF0000-0x0000000001022000-memory.dmp

Filesize
200KB

Download
memory/212-1141-0x0000000005C00000-0x0000000005C10000-memory.dmp

Filesize
64KB

Download
memory/3452-161-0x00000000001D0000-0x00000000001DA000-memory.dmp

Filesize
40KB

Download
memory/4988-204-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/4988-178-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-192-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-194-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-196-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-198-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-199-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/4988-201-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/4988-202-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/4988-203-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/4988-180-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-190-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-188-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-176-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-174-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-186-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-171-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-172-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-170-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/4988-169-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/4988-168-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4988-167-0x00000000071E0000-0x0000000007784000-memory.dmp

Filesize
5.6MB

Download
memory/4988-184-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/4988-182-0x00000000077E0000-0x00000000077F2000-memory.dmp

Filesize
72KB

Download
memory/5040-214-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-232-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-234-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-236-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-238-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-240-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-242-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-244-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-246-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-1119-0x0000000007980000-0x0000000007F98000-memory.dmp

Filesize
6.1MB

Download
memory/5040-1120-0x0000000007FA0000-0x00000000080AA000-memory.dmp

Filesize
1.0MB

Download
memory/5040-1121-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/5040-1122-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/5040-1123-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-1125-0x00000000083C0000-0x0000000008426000-memory.dmp

Filesize
408KB

Download
memory/5040-1126-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-1127-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-1128-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-1129-0x0000000008A80000-0x0000000008B12000-memory.dmp

Filesize
584KB

Download
memory/5040-1130-0x0000000008C80000-0x0000000008E42000-memory.dmp

Filesize
1.8MB

Download
memory/5040-1131-0x0000000008EA0000-0x00000000093CC000-memory.dmp

Filesize
5.2MB

Download
memory/5040-1132-0x0000000009620000-0x0000000009696000-memory.dmp

Filesize
472KB

Download
memory/5040-230-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-228-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-226-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-224-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-222-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-220-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-218-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-216-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-210-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-212-0x00000000049D0000-0x0000000004A0F000-memory.dmp

Filesize
252KB

Download
memory/5040-211-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-213-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5040-209-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

Filesize
300KB

Download
memory/5040-1133-0x00000000096A0000-0x00000000096F0000-memory.dmp

Filesize
320KB

Download
memory/5040-1135-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download