amadey | 279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737

Analysis

max time kernel
121s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe
Size

1.0MB
MD5

ae585323d9c237ef325839dcafc2655d
SHA1

ad7be1eeae3260baa7b738202ded0fa16e4bb0e5
SHA256

279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737
SHA512

0d6e0754bc23246312b3ac3172250458f729d39d84090fa0ac39fe59b7c3320f3cf4446d0c4bc8cb301e7a9383cff60b2b7979302ac9efaa30aa477a3c97612a
SSDEEP

24576:Ry1wbHazasIOyjQ4TpWEy2x7Z5C8NB8iTVZLs7JEA:E1w25IOuQ4TIEpx15CcrhstE

Score

10^/10

amadey redline boris netu discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

netu

193.233.20.32:4125

Attributes

auth_value
9641925ae487005582b5cf30476dd305

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v5421mI.exetz0101.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v5421mI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz0101.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz0101.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz0101.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz0101.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v5421mI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v5421mI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v5421mI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz0101.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz0101.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v5421mI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v5421mI.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1352-212-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-213-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-215-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-219-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-217-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-221-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-223-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-225-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-227-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-229-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-231-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-233-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-235-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-237-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-239-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-241-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-243-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline
behavioral1/memory/1352-245-0x0000000007720000-0x000000000775F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y72zX49.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	y72zX49.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 10 IoCs

Processes:

zap3344.exezap8564.exezap1569.exetz0101.exev5421mI.exew23Kv15.exexABnE17.exey72zX49.exelegenda.exelegenda.exe

pid	process
2012	zap3344.exe
640	zap8564.exe
3740	zap1569.exe
2304	tz0101.exe
4496	v5421mI.exe
1352	w23Kv15.exe
3908	xABnE17.exe
3304	y72zX49.exe
4972	legenda.exe
4056	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1336 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1336	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz0101.exev5421mI.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz0101.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v5421mI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v5421mI.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exezap3344.exezap8564.exezap1569.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3344.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8564.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap8564.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1569.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap1569.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4596 4496 WerFault.exe v5421mI.exe
3208 1352 WerFault.exe w23Kv15.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4904 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz0101.exev5421mI.exew23Kv15.exexABnE17.exe

pid process

2304 tz0101.exe
2304 tz0101.exe
4496 v5421mI.exe
4496 v5421mI.exe
1352 w23Kv15.exe
1352 w23Kv15.exe
3908 xABnE17.exe
3908 xABnE17.exe

pid	pid_target	process	target process
4596	4496	WerFault.exe	v5421mI.exe
3208	1352	WerFault.exe	w23Kv15.exe

pid	process
4904	schtasks.exe

pid	process
2304	tz0101.exe
2304	tz0101.exe
4496	v5421mI.exe
4496	v5421mI.exe
1352	w23Kv15.exe
1352	w23Kv15.exe
3908	xABnE17.exe
3908	xABnE17.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz0101.exev5421mI.exew23Kv15.exexABnE17.exe

description	pid	process
Token: SeDebugPrivilege	2304	tz0101.exe
Token: SeDebugPrivilege	4496	v5421mI.exe
Token: SeDebugPrivilege	1352	w23Kv15.exe
Token: SeDebugPrivilege	3908	xABnE17.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exezap3344.exezap8564.exezap1569.exey72zX49.exelegenda.execmd.exe

description	pid	process	target process
PID 1280 wrote to memory of 2012	1280	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe	zap3344.exe
PID 1280 wrote to memory of 2012	1280	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe	zap3344.exe
PID 1280 wrote to memory of 2012	1280	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe	zap3344.exe
PID 2012 wrote to memory of 640	2012	zap3344.exe	zap8564.exe
PID 2012 wrote to memory of 640	2012	zap3344.exe	zap8564.exe
PID 2012 wrote to memory of 640	2012	zap3344.exe	zap8564.exe
PID 640 wrote to memory of 3740	640	zap8564.exe	zap1569.exe
PID 640 wrote to memory of 3740	640	zap8564.exe	zap1569.exe
PID 640 wrote to memory of 3740	640	zap8564.exe	zap1569.exe
PID 3740 wrote to memory of 2304	3740	zap1569.exe	tz0101.exe
PID 3740 wrote to memory of 2304	3740	zap1569.exe	tz0101.exe
PID 3740 wrote to memory of 4496	3740	zap1569.exe	v5421mI.exe
PID 3740 wrote to memory of 4496	3740	zap1569.exe	v5421mI.exe
PID 3740 wrote to memory of 4496	3740	zap1569.exe	v5421mI.exe
PID 640 wrote to memory of 1352	640	zap8564.exe	w23Kv15.exe
PID 640 wrote to memory of 1352	640	zap8564.exe	w23Kv15.exe
PID 640 wrote to memory of 1352	640	zap8564.exe	w23Kv15.exe
PID 2012 wrote to memory of 3908	2012	zap3344.exe	xABnE17.exe
PID 2012 wrote to memory of 3908	2012	zap3344.exe	xABnE17.exe
PID 2012 wrote to memory of 3908	2012	zap3344.exe	xABnE17.exe
PID 1280 wrote to memory of 3304	1280	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe	y72zX49.exe
PID 1280 wrote to memory of 3304	1280	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe	y72zX49.exe
PID 1280 wrote to memory of 3304	1280	279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe	y72zX49.exe
PID 3304 wrote to memory of 4972	3304	y72zX49.exe	legenda.exe
PID 3304 wrote to memory of 4972	3304	y72zX49.exe	legenda.exe
PID 3304 wrote to memory of 4972	3304	y72zX49.exe	legenda.exe
PID 4972 wrote to memory of 4904	4972	legenda.exe	schtasks.exe
PID 4972 wrote to memory of 4904	4972	legenda.exe	schtasks.exe
PID 4972 wrote to memory of 4904	4972	legenda.exe	schtasks.exe
PID 4972 wrote to memory of 4160	4972	legenda.exe	cmd.exe
PID 4972 wrote to memory of 4160	4972	legenda.exe	cmd.exe
PID 4972 wrote to memory of 4160	4972	legenda.exe	cmd.exe
PID 4160 wrote to memory of 1204	4160	cmd.exe	cmd.exe
PID 4160 wrote to memory of 1204	4160	cmd.exe	cmd.exe
PID 4160 wrote to memory of 1204	4160	cmd.exe	cmd.exe
PID 4160 wrote to memory of 3564	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 3564	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 3564	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 1272	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 1272	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 1272	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 724	4160	cmd.exe	cmd.exe
PID 4160 wrote to memory of 724	4160	cmd.exe	cmd.exe
PID 4160 wrote to memory of 724	4160	cmd.exe	cmd.exe
PID 4160 wrote to memory of 1544	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 1544	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 1544	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 2884	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 2884	4160	cmd.exe	cacls.exe
PID 4160 wrote to memory of 2884	4160	cmd.exe	cacls.exe
PID 4972 wrote to memory of 1336	4972	legenda.exe	rundll32.exe
PID 4972 wrote to memory of 1336	4972	legenda.exe	rundll32.exe
PID 4972 wrote to memory of 1336	4972	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe
"C:\Users\Admin\AppData\Local\Temp\279378159ace53d89a40609b58eeb0e8fabdf19d597ddc846d5375b9db5dd737.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3344.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3344.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8564.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8564.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1569.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1569.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3740

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0101.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0101.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5421mI.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5421mI.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1080
6⤵
- Program crash
PID:4596

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Kv15.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Kv15.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1192
5⤵
- Program crash
PID:3208

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xABnE17.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xABnE17.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y72zX49.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y72zX49.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:4904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1204

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:3564

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:1272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:724

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:1544

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:2884

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4496 -ip 4496
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1352 -ip 1352
1⤵
PID:3828

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y72zX49.exe
Filesize
235KB

MD5
bfcd09749b4e501a3249263640d7c410

SHA1
5136cfdbb9f86dcbdacb0ac919c18485fbed948d

SHA256
499e0c2c02a040d33618d7fcae744697d4ff260581f0812c63d452eb70619ef7

SHA512
272fd5ee99ca650740ace17cbd1cefc3fa3d8d9e4010659b85fca9481163217a5a382c8eda26f8711b3f00cfb4133dc3d519233a8b88bd6983783fdf2fb15564

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y72zX49.exe
Filesize
235KB

MD5
bfcd09749b4e501a3249263640d7c410

SHA1
5136cfdbb9f86dcbdacb0ac919c18485fbed948d

SHA256
499e0c2c02a040d33618d7fcae744697d4ff260581f0812c63d452eb70619ef7

SHA512
272fd5ee99ca650740ace17cbd1cefc3fa3d8d9e4010659b85fca9481163217a5a382c8eda26f8711b3f00cfb4133dc3d519233a8b88bd6983783fdf2fb15564

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3344.exe
Filesize
854KB

MD5
d608adc4bd013ee8e7701584ac466a2a

SHA1
ddea45c5612afa12eb52cc1c3b274a393cbd94f8

SHA256
29c03ff7c7208c2358c6978a1343e1f061256762e8238ac93886b7c44c0e2081

SHA512
deae271c1dbc4d811aa051d82943a867ef78fab64a69f0ead72a76c7fd8fe95d55ca63e99efcfdae5642a0096b6f36f46e93c181f1d607f9681fd8353dc409d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3344.exe
Filesize
854KB

MD5
d608adc4bd013ee8e7701584ac466a2a

SHA1
ddea45c5612afa12eb52cc1c3b274a393cbd94f8

SHA256
29c03ff7c7208c2358c6978a1343e1f061256762e8238ac93886b7c44c0e2081

SHA512
deae271c1dbc4d811aa051d82943a867ef78fab64a69f0ead72a76c7fd8fe95d55ca63e99efcfdae5642a0096b6f36f46e93c181f1d607f9681fd8353dc409d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xABnE17.exe
Filesize
175KB

MD5
a8ee2c0d15d87c39241e0d8597118c88

SHA1
3127fa7ba5e51f8a2a7109e6309d1471001b73e3

SHA256
a894c193a5296830f95c7b3c8730aad7ef7900049ad56edb4ae9d6d7771c0248

SHA512
9f93351a4e7f05287ef335e929120effecfeca766aa8109327dec93f9279260a6c9551be1f7988d5277717058d42d017d38d705e7a6bc791c32be0d4a141e78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xABnE17.exe
Filesize
175KB

MD5
a8ee2c0d15d87c39241e0d8597118c88

SHA1
3127fa7ba5e51f8a2a7109e6309d1471001b73e3

SHA256
a894c193a5296830f95c7b3c8730aad7ef7900049ad56edb4ae9d6d7771c0248

SHA512
9f93351a4e7f05287ef335e929120effecfeca766aa8109327dec93f9279260a6c9551be1f7988d5277717058d42d017d38d705e7a6bc791c32be0d4a141e78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8564.exe
Filesize
712KB

MD5
7eeb308ef51595c21ce7e0bd36b9e2f7

SHA1
d3e8e7dbee9134027781f0bef0f35e4c68dc5bfc

SHA256
8ef106a31a62ad207935a05da2f38f2488ab4a8744d5b9ca57d60c0ce76aca72

SHA512
a4c90e96246dc6a526e6c84e7b5e0660315dfcf21353ff70c87ea70e0d111d290c7d94670b0e30780055f3cf76042cee20a098f6086508f2ec44f2583db62d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8564.exe
Filesize
712KB

MD5
7eeb308ef51595c21ce7e0bd36b9e2f7

SHA1
d3e8e7dbee9134027781f0bef0f35e4c68dc5bfc

SHA256
8ef106a31a62ad207935a05da2f38f2488ab4a8744d5b9ca57d60c0ce76aca72

SHA512
a4c90e96246dc6a526e6c84e7b5e0660315dfcf21353ff70c87ea70e0d111d290c7d94670b0e30780055f3cf76042cee20a098f6086508f2ec44f2583db62d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Kv15.exe
Filesize
383KB

MD5
26a5c0a867dd285e111c6927a1b23ca3

SHA1
43fa625b6675f1bbe9e4c5c329dd226d50499bf0

SHA256
67f5d51a3ec5b270fd1f9d03f583544fb90f6f4a968cd51cb041895e280de13e

SHA512
c7e195c1a2064979b0f32efbf8d55d40b394f5c0f371ef80f5768bb9fc6fe94578df4b96a84402891be78a25e279ef2b0a0d2127518be247976156921289b76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w23Kv15.exe
Filesize
383KB

MD5
26a5c0a867dd285e111c6927a1b23ca3

SHA1
43fa625b6675f1bbe9e4c5c329dd226d50499bf0

SHA256
67f5d51a3ec5b270fd1f9d03f583544fb90f6f4a968cd51cb041895e280de13e

SHA512
c7e195c1a2064979b0f32efbf8d55d40b394f5c0f371ef80f5768bb9fc6fe94578df4b96a84402891be78a25e279ef2b0a0d2127518be247976156921289b76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1569.exe
Filesize
352KB

MD5
1da08e93a5e822a4d89e1b687f26f072

SHA1
2f8797be1b5a29bf7c611812cfa3d273166bbb60

SHA256
5f3629367e6e707baa893620a917948119f0fe592f5c1b43b82f3b9e8895fb7e

SHA512
a167d0c5bcfeab7b6e37ad90fb91a2d58848151a35a965ae532d9d46f5d93102b407a5373df1902614a6d3ab4f572bd005d21a96e06f328e8cb0f11cce6ae55f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1569.exe
Filesize
352KB

MD5
1da08e93a5e822a4d89e1b687f26f072

SHA1
2f8797be1b5a29bf7c611812cfa3d273166bbb60

SHA256
5f3629367e6e707baa893620a917948119f0fe592f5c1b43b82f3b9e8895fb7e

SHA512
a167d0c5bcfeab7b6e37ad90fb91a2d58848151a35a965ae532d9d46f5d93102b407a5373df1902614a6d3ab4f572bd005d21a96e06f328e8cb0f11cce6ae55f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0101.exe
Filesize
11KB

MD5
3c4c278a63eeffe0289e7d6d37c2ec12

SHA1
df969b0f1780f5da5382c6a06735e7828c28e7ad

SHA256
f40488d4448737b2b495e99af6fd8543668742009c89a3de1f7a7520cad14599

SHA512
2e180b166f0137561f88d6dc09dde522e1883ec134ad55656c15159d46ea727da88865e47e9a2c4efdb49a9d174ccdc4968c0dec33b3be79d39942e5f06ecdcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0101.exe
Filesize
11KB

MD5
3c4c278a63eeffe0289e7d6d37c2ec12

SHA1
df969b0f1780f5da5382c6a06735e7828c28e7ad

SHA256
f40488d4448737b2b495e99af6fd8543668742009c89a3de1f7a7520cad14599

SHA512
2e180b166f0137561f88d6dc09dde522e1883ec134ad55656c15159d46ea727da88865e47e9a2c4efdb49a9d174ccdc4968c0dec33b3be79d39942e5f06ecdcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5421mI.exe
Filesize
325KB

MD5
83102430620d5c13b61a808872df2b7e

SHA1
2668d5e3773cf0b79d01672db12daa1585440905

SHA256
614c0050583a21e13fe27597233ba05afde90fe1f101d104a3cd6e3c87ff7b3c

SHA512
9ec885d0611b9f6c96cf991ee4d79d73b51e30674687a40b10d447ce8d1894a376f4685b51e4552fa371129fce3446a3f0168927376694b8c4460ec4c81e2bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5421mI.exe
Filesize
325KB

MD5
83102430620d5c13b61a808872df2b7e

SHA1
2668d5e3773cf0b79d01672db12daa1585440905

SHA256
614c0050583a21e13fe27597233ba05afde90fe1f101d104a3cd6e3c87ff7b3c

SHA512
9ec885d0611b9f6c96cf991ee4d79d73b51e30674687a40b10d447ce8d1894a376f4685b51e4552fa371129fce3446a3f0168927376694b8c4460ec4c81e2bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
bfcd09749b4e501a3249263640d7c410

SHA1
5136cfdbb9f86dcbdacb0ac919c18485fbed948d

SHA256
499e0c2c02a040d33618d7fcae744697d4ff260581f0812c63d452eb70619ef7

SHA512
272fd5ee99ca650740ace17cbd1cefc3fa3d8d9e4010659b85fca9481163217a5a382c8eda26f8711b3f00cfb4133dc3d519233a8b88bd6983783fdf2fb15564

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
bfcd09749b4e501a3249263640d7c410

SHA1
5136cfdbb9f86dcbdacb0ac919c18485fbed948d

SHA256
499e0c2c02a040d33618d7fcae744697d4ff260581f0812c63d452eb70619ef7

SHA512
272fd5ee99ca650740ace17cbd1cefc3fa3d8d9e4010659b85fca9481163217a5a382c8eda26f8711b3f00cfb4133dc3d519233a8b88bd6983783fdf2fb15564

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
bfcd09749b4e501a3249263640d7c410

SHA1
5136cfdbb9f86dcbdacb0ac919c18485fbed948d

SHA256
499e0c2c02a040d33618d7fcae744697d4ff260581f0812c63d452eb70619ef7

SHA512
272fd5ee99ca650740ace17cbd1cefc3fa3d8d9e4010659b85fca9481163217a5a382c8eda26f8711b3f00cfb4133dc3d519233a8b88bd6983783fdf2fb15564

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
bfcd09749b4e501a3249263640d7c410

SHA1
5136cfdbb9f86dcbdacb0ac919c18485fbed948d

SHA256
499e0c2c02a040d33618d7fcae744697d4ff260581f0812c63d452eb70619ef7

SHA512
272fd5ee99ca650740ace17cbd1cefc3fa3d8d9e4010659b85fca9481163217a5a382c8eda26f8711b3f00cfb4133dc3d519233a8b88bd6983783fdf2fb15564

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/1352-1127-0x0000000008C60000-0x0000000008CD6000-memory.dmp

Filesize
472KB

Download
memory/1352-241-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-1133-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-1132-0x0000000008F40000-0x000000000946C000-memory.dmp

Filesize
5.2MB

Download
memory/1352-1131-0x0000000008D70000-0x0000000008F32000-memory.dmp

Filesize
1.8MB

Download
memory/1352-1129-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-1130-0x0000000008CF0000-0x0000000008D40000-memory.dmp

Filesize
320KB

Download
memory/1352-1126-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-1128-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-1125-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/1352-1124-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/1352-1122-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-208-0x0000000002B90000-0x0000000002BDB000-memory.dmp

Filesize
300KB

Download
memory/1352-210-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-209-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-211-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/1352-212-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-213-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-215-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-219-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-217-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-221-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-223-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-225-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-227-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-229-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-231-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-233-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-235-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-237-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-239-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-1121-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1352-243-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-245-0x0000000007720000-0x000000000775F000-memory.dmp

Filesize
252KB

Download
memory/1352-1118-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/1352-1119-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/1352-1120-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/2304-161-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/3908-1139-0x0000000000E60000-0x0000000000E92000-memory.dmp

Filesize
200KB

Download
memory/3908-1141-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/3908-1140-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/4496-182-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-203-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4496-200-0x0000000007220000-0x0000000007230000-memory.dmp

Filesize
64KB

Download
memory/4496-199-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4496-198-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-196-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-194-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-192-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-190-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-180-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-201-0x0000000007220000-0x0000000007230000-memory.dmp

Filesize
64KB

Download
memory/4496-184-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-188-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-178-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-176-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-174-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-172-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-171-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4496-170-0x0000000007220000-0x0000000007230000-memory.dmp

Filesize
64KB

Download
memory/4496-169-0x0000000007220000-0x0000000007230000-memory.dmp

Filesize
64KB

Download
memory/4496-168-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download
memory/4496-167-0x0000000007230000-0x00000000077D4000-memory.dmp

Filesize
5.6MB

Download
memory/4496-186-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download