amadey | 7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea

Analysis

max time kernel
106s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe
Size

1.0MB
MD5

6d4ac7152fc035a051b84925efaf0cae
SHA1

60c4ba7a3ed47b038d3edeec841b3d69112d5d3d
SHA256

7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea
SHA512

6ed35969fe2d11ab296f1dfa675e4eddd75dacb4da0466f3450105fe9bebc9fe0ebd3b1d281b6e90b418d77bac6c3e4432f8137d5b4fb1018aa5739974c780c9
SSDEEP

24576:dyWub1rdPy4PQhhhlCpw1+f8FXM3NoTtMIC6YC0atonH1kNqXZ:4WO1rd9Q7hlCpO+fgMcC7CTSVk

Score

10^/10

amadey redline boris netu discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

netu

193.233.20.32:4125

Attributes

auth_value
9641925ae487005582b5cf30476dd305

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v6601QM.exetz6085.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v6601QM.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v6601QM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz6085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz6085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz6085.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v6601QM.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v6601QM.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz6085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz6085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz6085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v6601QM.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v6601QM.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1652-210-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-211-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-213-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-215-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-217-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-221-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-224-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-226-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-228-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-230-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-232-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-234-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-238-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-240-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-242-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-236-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-244-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-246-0x0000000004C40000-0x0000000004C7F000-memory.dmp	family_redline
behavioral1/memory/1652-1127-0x00000000049B0000-0x00000000049C0000-memory.dmp	family_redline
behavioral1/memory/1652-1128-0x00000000049B0000-0x00000000049C0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y89ga02.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	y89ga02.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 10 IoCs

Processes:

zap2447.exezap1364.exezap5514.exetz6085.exev6601QM.exew74Bp86.exextcOz05.exey89ga02.exelegenda.exelegenda.exe

pid	process
2816	zap2447.exe
2644	zap1364.exe
2676	zap5514.exe
4660	tz6085.exe
3176	v6601QM.exe
1652	w74Bp86.exe
2652	xtcOz05.exe
2156	y89ga02.exe
2460	legenda.exe
3756	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4404 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4404	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

v6601QM.exetz6085.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v6601QM.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v6601QM.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz6085.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap1364.exezap5514.exe7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exezap2447.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1364.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5514.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap5514.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2447.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap2447.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1364.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2916 3176 WerFault.exe v6601QM.exe
2940 1652 WerFault.exe w74Bp86.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3964 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz6085.exev6601QM.exew74Bp86.exextcOz05.exe

pid process

4660 tz6085.exe
4660 tz6085.exe
3176 v6601QM.exe
3176 v6601QM.exe
1652 w74Bp86.exe
1652 w74Bp86.exe
2652 xtcOz05.exe
2652 xtcOz05.exe

pid	pid_target	process	target process
2916	3176	WerFault.exe	v6601QM.exe
2940	1652	WerFault.exe	w74Bp86.exe

pid	process
3964	schtasks.exe

pid	process
4660	tz6085.exe
4660	tz6085.exe
3176	v6601QM.exe
3176	v6601QM.exe
1652	w74Bp86.exe
1652	w74Bp86.exe
2652	xtcOz05.exe
2652	xtcOz05.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz6085.exev6601QM.exew74Bp86.exextcOz05.exe

description	pid	process
Token: SeDebugPrivilege	4660	tz6085.exe
Token: SeDebugPrivilege	3176	v6601QM.exe
Token: SeDebugPrivilege	1652	w74Bp86.exe
Token: SeDebugPrivilege	2652	xtcOz05.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exezap2447.exezap1364.exezap5514.exey89ga02.exelegenda.execmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 2816	4940	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe	zap2447.exe
PID 4940 wrote to memory of 2816	4940	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe	zap2447.exe
PID 4940 wrote to memory of 2816	4940	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe	zap2447.exe
PID 2816 wrote to memory of 2644	2816	zap2447.exe	zap1364.exe
PID 2816 wrote to memory of 2644	2816	zap2447.exe	zap1364.exe
PID 2816 wrote to memory of 2644	2816	zap2447.exe	zap1364.exe
PID 2644 wrote to memory of 2676	2644	zap1364.exe	zap5514.exe
PID 2644 wrote to memory of 2676	2644	zap1364.exe	zap5514.exe
PID 2644 wrote to memory of 2676	2644	zap1364.exe	zap5514.exe
PID 2676 wrote to memory of 4660	2676	zap5514.exe	tz6085.exe
PID 2676 wrote to memory of 4660	2676	zap5514.exe	tz6085.exe
PID 2676 wrote to memory of 3176	2676	zap5514.exe	v6601QM.exe
PID 2676 wrote to memory of 3176	2676	zap5514.exe	v6601QM.exe
PID 2676 wrote to memory of 3176	2676	zap5514.exe	v6601QM.exe
PID 2644 wrote to memory of 1652	2644	zap1364.exe	w74Bp86.exe
PID 2644 wrote to memory of 1652	2644	zap1364.exe	w74Bp86.exe
PID 2644 wrote to memory of 1652	2644	zap1364.exe	w74Bp86.exe
PID 2816 wrote to memory of 2652	2816	zap2447.exe	xtcOz05.exe
PID 2816 wrote to memory of 2652	2816	zap2447.exe	xtcOz05.exe
PID 2816 wrote to memory of 2652	2816	zap2447.exe	xtcOz05.exe
PID 4940 wrote to memory of 2156	4940	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe	y89ga02.exe
PID 4940 wrote to memory of 2156	4940	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe	y89ga02.exe
PID 4940 wrote to memory of 2156	4940	7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe	y89ga02.exe
PID 2156 wrote to memory of 2460	2156	y89ga02.exe	legenda.exe
PID 2156 wrote to memory of 2460	2156	y89ga02.exe	legenda.exe
PID 2156 wrote to memory of 2460	2156	y89ga02.exe	legenda.exe
PID 2460 wrote to memory of 3964	2460	legenda.exe	schtasks.exe
PID 2460 wrote to memory of 3964	2460	legenda.exe	schtasks.exe
PID 2460 wrote to memory of 3964	2460	legenda.exe	schtasks.exe
PID 2460 wrote to memory of 2168	2460	legenda.exe	cmd.exe
PID 2460 wrote to memory of 2168	2460	legenda.exe	cmd.exe
PID 2460 wrote to memory of 2168	2460	legenda.exe	cmd.exe
PID 2168 wrote to memory of 2304	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 2304	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 2304	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 4476	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 4476	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 4476	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 3480	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 3480	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 3480	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 3988	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 3988	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 3988	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 3476	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 3476	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 3476	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 1488	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 1488	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 1488	2168	cmd.exe	cacls.exe
PID 2460 wrote to memory of 4404	2460	legenda.exe	rundll32.exe
PID 2460 wrote to memory of 4404	2460	legenda.exe	rundll32.exe
PID 2460 wrote to memory of 4404	2460	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe
"C:\Users\Admin\AppData\Local\Temp\7b1ed1c1a41f8f6095c82970b88c033d7dfdd38c676b606bf7c5fca61290ebea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2447.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2447.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2816

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1364.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1364.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5514.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5514.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2676

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6085.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6085.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6601QM.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6601QM.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 1088
6⤵
- Program crash
PID:2916

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74Bp86.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74Bp86.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 1348
5⤵
- Program crash
PID:2940

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xtcOz05.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xtcOz05.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89ga02.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89ga02.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2304

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:4476

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:3480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3988

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:3476

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:1488

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3176 -ip 3176
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1652 -ip 1652
1⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89ga02.exe
Filesize
235KB

MD5
41110d56e0b3b44e51aef577bcd2af05

SHA1
ff35389a7c671b6fad6e2de17cd4f09d22c481b9

SHA256
28d4eaabfa1eeee7343acd357ce8eb9087382028f739e6b862b378debeb8380a

SHA512
2ac7dc627179cbbd2c11e8f13d874a31a182cc67b46ef5d965590e8e07b4476cc0a5ea739b05670bb2826975ba436b62e3b3cb10170c5a729b9ccfc505fff0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89ga02.exe
Filesize
235KB

MD5
41110d56e0b3b44e51aef577bcd2af05

SHA1
ff35389a7c671b6fad6e2de17cd4f09d22c481b9

SHA256
28d4eaabfa1eeee7343acd357ce8eb9087382028f739e6b862b378debeb8380a

SHA512
2ac7dc627179cbbd2c11e8f13d874a31a182cc67b46ef5d965590e8e07b4476cc0a5ea739b05670bb2826975ba436b62e3b3cb10170c5a729b9ccfc505fff0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2447.exe
Filesize
854KB

MD5
ae72726ac6571545d93f8e2ff00b921f

SHA1
666e8b0fa07029d0b3462ecae58317cf6c5031e9

SHA256
f51044c3c54cd179ca64d11abe04e28b570fd27b2a3380cf352402982f0f86a4

SHA512
ce57ca68056f16a81252f9a86e3d82b68fbce1837f85bfa94ee3d07ec4725d27d79ee1fa821d0746f90f352b32ab9d910c83a2788a3f7800626ca1741be86b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2447.exe
Filesize
854KB

MD5
ae72726ac6571545d93f8e2ff00b921f

SHA1
666e8b0fa07029d0b3462ecae58317cf6c5031e9

SHA256
f51044c3c54cd179ca64d11abe04e28b570fd27b2a3380cf352402982f0f86a4

SHA512
ce57ca68056f16a81252f9a86e3d82b68fbce1837f85bfa94ee3d07ec4725d27d79ee1fa821d0746f90f352b32ab9d910c83a2788a3f7800626ca1741be86b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xtcOz05.exe
Filesize
175KB

MD5
da909173ed2c4c305dacfcaa70a8a4f5

SHA1
6ed33e3a8ccf25772a25bba8e76095d34e465ed2

SHA256
a422cc678edb0198751e6fed9a0fd61766ede9784e512c7626523cac11a0d233

SHA512
39bf220f4b43bd52cb21ef833dba032d69c9c76c6cd3f4d1b3586509aa0d420d13f4fefdb1d9202024e4e2c12736bcc970816c3aad7cf1d5acec80e3bf9ffae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xtcOz05.exe
Filesize
175KB

MD5
da909173ed2c4c305dacfcaa70a8a4f5

SHA1
6ed33e3a8ccf25772a25bba8e76095d34e465ed2

SHA256
a422cc678edb0198751e6fed9a0fd61766ede9784e512c7626523cac11a0d233

SHA512
39bf220f4b43bd52cb21ef833dba032d69c9c76c6cd3f4d1b3586509aa0d420d13f4fefdb1d9202024e4e2c12736bcc970816c3aad7cf1d5acec80e3bf9ffae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1364.exe
Filesize
712KB

MD5
0d4412d603f4d1b5e05f64139e834a47

SHA1
065b34920906a978a8d474e85644d92f1c50c6a3

SHA256
dfcee1eb66c16a00ad5f9d5280af78f7c0cf09b8e22cd7d1cd3c730d493a782f

SHA512
98f42530d977aea7fbf09ca337e8771e957e89cc7bbf537c79f46a58d2b99cbe70c87606b6202bcfc39bb0ca2c16be6c0cb0cb94491ea40af516302916caf940

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1364.exe
Filesize
712KB

MD5
0d4412d603f4d1b5e05f64139e834a47

SHA1
065b34920906a978a8d474e85644d92f1c50c6a3

SHA256
dfcee1eb66c16a00ad5f9d5280af78f7c0cf09b8e22cd7d1cd3c730d493a782f

SHA512
98f42530d977aea7fbf09ca337e8771e957e89cc7bbf537c79f46a58d2b99cbe70c87606b6202bcfc39bb0ca2c16be6c0cb0cb94491ea40af516302916caf940

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74Bp86.exe
Filesize
383KB

MD5
3bb51444b501561241d4c9eb13f70c20

SHA1
3df52fe2db1a2b067702a46158dd599d4f2d6888

SHA256
3daeefea2e390a6ead152c724b899c3f4ec60f216ea3ddab6cd784aa37406b28

SHA512
b3d8e1fefbb7cfa108703e2430dceb6bf092476bea5e781619f1903ecc9502ff22a87ef896c9cbadf892768ab5df515d20346f3d891b70c1aad4d0ae44278bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74Bp86.exe
Filesize
383KB

MD5
3bb51444b501561241d4c9eb13f70c20

SHA1
3df52fe2db1a2b067702a46158dd599d4f2d6888

SHA256
3daeefea2e390a6ead152c724b899c3f4ec60f216ea3ddab6cd784aa37406b28

SHA512
b3d8e1fefbb7cfa108703e2430dceb6bf092476bea5e781619f1903ecc9502ff22a87ef896c9cbadf892768ab5df515d20346f3d891b70c1aad4d0ae44278bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5514.exe
Filesize
353KB

MD5
236e1e03ebf5fe7da437178d62f434de

SHA1
19840d4fa9ca0c0e47d4868f514b2899b0043ff7

SHA256
1193aacb87ef879c0507d3b097cddc8f03e29a887e4a89b7390b1baf2cc40dbd

SHA512
e1a89fc257010663ce6ceb064b44dbb89b24e4037498f9dc1d7f947b02f1a4864b659c91853b43631b5d36c6dd55e18c5f6108488c6c4e551da5fb11501120a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5514.exe
Filesize
353KB

MD5
236e1e03ebf5fe7da437178d62f434de

SHA1
19840d4fa9ca0c0e47d4868f514b2899b0043ff7

SHA256
1193aacb87ef879c0507d3b097cddc8f03e29a887e4a89b7390b1baf2cc40dbd

SHA512
e1a89fc257010663ce6ceb064b44dbb89b24e4037498f9dc1d7f947b02f1a4864b659c91853b43631b5d36c6dd55e18c5f6108488c6c4e551da5fb11501120a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6085.exe
Filesize
11KB

MD5
228a6331e7080324c6fb2033fd49d0ac

SHA1
c656f156c7a56347b3a0a45e46171e9f2e9101c8

SHA256
ae1712595adb8b5a82214b7cb12ccd0db4db71561adfb0b2742ca8aae824835d

SHA512
756d1a2150180228ed165d5cd0573d0c989a4a5afe1d4f8a50b276b86a8463f97f4e5b01d1f241b8fa3d42268e0e02ca97b5fa9fcc783c0b5cfd5d9b2526afc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6085.exe
Filesize
11KB

MD5
228a6331e7080324c6fb2033fd49d0ac

SHA1
c656f156c7a56347b3a0a45e46171e9f2e9101c8

SHA256
ae1712595adb8b5a82214b7cb12ccd0db4db71561adfb0b2742ca8aae824835d

SHA512
756d1a2150180228ed165d5cd0573d0c989a4a5afe1d4f8a50b276b86a8463f97f4e5b01d1f241b8fa3d42268e0e02ca97b5fa9fcc783c0b5cfd5d9b2526afc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6601QM.exe
Filesize
325KB

MD5
5bc77b6f05a2d5be2143e4ac1bfdf502

SHA1
3d70b88b4477a6f28f9b9ec2f43ab60ff2b771ef

SHA256
672e36163bda669add95a8456bedae18041a1c6c550b33e75264bad5de4c5410

SHA512
9ed5439ac57961768381a587b823fe2d656970eb213f0e6afedddc982f4e80bf7e3a5b1e0761de32af2f8f6ead05cfc69f67df0867d3e92be5f9d8af9645129d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6601QM.exe
Filesize
325KB

MD5
5bc77b6f05a2d5be2143e4ac1bfdf502

SHA1
3d70b88b4477a6f28f9b9ec2f43ab60ff2b771ef

SHA256
672e36163bda669add95a8456bedae18041a1c6c550b33e75264bad5de4c5410

SHA512
9ed5439ac57961768381a587b823fe2d656970eb213f0e6afedddc982f4e80bf7e3a5b1e0761de32af2f8f6ead05cfc69f67df0867d3e92be5f9d8af9645129d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
41110d56e0b3b44e51aef577bcd2af05

SHA1
ff35389a7c671b6fad6e2de17cd4f09d22c481b9

SHA256
28d4eaabfa1eeee7343acd357ce8eb9087382028f739e6b862b378debeb8380a

SHA512
2ac7dc627179cbbd2c11e8f13d874a31a182cc67b46ef5d965590e8e07b4476cc0a5ea739b05670bb2826975ba436b62e3b3cb10170c5a729b9ccfc505fff0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
41110d56e0b3b44e51aef577bcd2af05

SHA1
ff35389a7c671b6fad6e2de17cd4f09d22c481b9

SHA256
28d4eaabfa1eeee7343acd357ce8eb9087382028f739e6b862b378debeb8380a

SHA512
2ac7dc627179cbbd2c11e8f13d874a31a182cc67b46ef5d965590e8e07b4476cc0a5ea739b05670bb2826975ba436b62e3b3cb10170c5a729b9ccfc505fff0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
41110d56e0b3b44e51aef577bcd2af05

SHA1
ff35389a7c671b6fad6e2de17cd4f09d22c481b9

SHA256
28d4eaabfa1eeee7343acd357ce8eb9087382028f739e6b862b378debeb8380a

SHA512
2ac7dc627179cbbd2c11e8f13d874a31a182cc67b46ef5d965590e8e07b4476cc0a5ea739b05670bb2826975ba436b62e3b3cb10170c5a729b9ccfc505fff0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
41110d56e0b3b44e51aef577bcd2af05

SHA1
ff35389a7c671b6fad6e2de17cd4f09d22c481b9

SHA256
28d4eaabfa1eeee7343acd357ce8eb9087382028f739e6b862b378debeb8380a

SHA512
2ac7dc627179cbbd2c11e8f13d874a31a182cc67b46ef5d965590e8e07b4476cc0a5ea739b05670bb2826975ba436b62e3b3cb10170c5a729b9ccfc505fff0ba

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/1652-1127-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-242-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-1134-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-1133-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/1652-1132-0x0000000009610000-0x0000000009686000-memory.dmp

Filesize
472KB

Download
memory/1652-1131-0x0000000008D10000-0x000000000923C000-memory.dmp

Filesize
5.2MB

Download
memory/1652-1130-0x0000000008B40000-0x0000000008D02000-memory.dmp

Filesize
1.8MB

Download
memory/1652-1129-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-1128-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-1126-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/1652-1125-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/1652-1123-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-1122-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/1652-1121-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/1652-210-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-211-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-213-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-215-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-218-0x0000000002C60000-0x0000000002CAB000-memory.dmp

Filesize
300KB

Download
memory/1652-217-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-220-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-222-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/1652-221-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-224-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-226-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-228-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-230-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-232-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-234-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-238-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-240-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-1120-0x0000000007E30000-0x0000000007F3A000-memory.dmp

Filesize
1.0MB

Download
memory/1652-236-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-244-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-246-0x0000000004C40000-0x0000000004C7F000-memory.dmp

Filesize
252KB

Download
memory/1652-1119-0x0000000007790000-0x0000000007DA8000-memory.dmp

Filesize
6.1MB

Download
memory/2652-1140-0x0000000000DD0000-0x0000000000E02000-memory.dmp

Filesize
200KB

Download
memory/2652-1141-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/3176-183-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-204-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3176-181-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-189-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-185-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-201-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3176-200-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/3176-199-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3176-198-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3176-197-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-195-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-193-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-191-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-205-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/3176-203-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3176-187-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-179-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-177-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-175-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-173-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-170-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-171-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/3176-169-0x0000000007270000-0x0000000007814000-memory.dmp

Filesize
5.6MB

Download
memory/3176-168-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3176-167-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4660-161-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

Filesize
40KB

Download