amadey | 5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280

Analysis

max time kernel
106s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe
Size

1.0MB
MD5

47433b915698dcb188ed67c557d57f9e
SHA1

80a5c3192116d2ac22ab82c8a05933a7a627b06f
SHA256

5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280
SHA512

9db8abbf333061bd7b1e99e6e2c1789a6db7f9c6367b354f4cca88c8a5754e5c7eb9228670fd911b23d11572f873cafb957a2eb203d9c385feb1b36059661fef
SSDEEP

24576:pysYEQefjdB1LlXo7UP518iTomx3gcXJ5+qDUYVL:c4QefjdZX2C5JTgI5+iUYV

Score

10^/10

amadey redline boris netu discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

netu

193.233.20.32:4125

Attributes

auth_value
9641925ae487005582b5cf30476dd305

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz0268.exev3274ow.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz0268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz0268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v3274ow.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v3274ow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v3274ow.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v3274ow.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v3274ow.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v3274ow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz0268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz0268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz0268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz0268.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2856-209-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-210-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-212-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-214-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-216-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-220-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-224-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-226-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-228-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-230-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-232-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-234-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-236-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-238-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-240-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-242-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-244-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline
behavioral1/memory/2856-246-0x0000000004B10000-0x0000000004B4F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y67TH68.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y67TH68.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 10 IoCs

Processes:

zap3998.exezap2576.exezap4896.exetz0268.exev3274ow.exew00KS38.exexqYdh12.exey67TH68.exelegenda.exelegenda.exe

pid	process
4600	zap3998.exe
4544	zap2576.exe
792	zap4896.exe
1392	tz0268.exe
3572	v3274ow.exe
2856	w00KS38.exe
4016	xqYdh12.exe
1580	y67TH68.exe
2088	legenda.exe
1868	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4572 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4572	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

v3274ow.exetz0268.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v3274ow.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz0268.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v3274ow.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exezap3998.exezap2576.exezap4896.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3998.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2576.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap2576.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap4896.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap4896.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1772 3572 WerFault.exe v3274ow.exe
1436 2856 WerFault.exe w00KS38.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1564 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz0268.exev3274ow.exew00KS38.exexqYdh12.exe

pid process

1392 tz0268.exe
1392 tz0268.exe
3572 v3274ow.exe
3572 v3274ow.exe
2856 w00KS38.exe
2856 w00KS38.exe
4016 xqYdh12.exe
4016 xqYdh12.exe

pid	pid_target	process	target process
1772	3572	WerFault.exe	v3274ow.exe
1436	2856	WerFault.exe	w00KS38.exe

pid	process
1564	schtasks.exe

pid	process
1392	tz0268.exe
1392	tz0268.exe
3572	v3274ow.exe
3572	v3274ow.exe
2856	w00KS38.exe
2856	w00KS38.exe
4016	xqYdh12.exe
4016	xqYdh12.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz0268.exev3274ow.exew00KS38.exexqYdh12.exe

description	pid	process
Token: SeDebugPrivilege	1392	tz0268.exe
Token: SeDebugPrivilege	3572	v3274ow.exe
Token: SeDebugPrivilege	2856	w00KS38.exe
Token: SeDebugPrivilege	4016	xqYdh12.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exezap3998.exezap2576.exezap4896.exey67TH68.exelegenda.execmd.exe

description	pid	process	target process
PID 3096 wrote to memory of 4600	3096	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe	zap3998.exe
PID 3096 wrote to memory of 4600	3096	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe	zap3998.exe
PID 3096 wrote to memory of 4600	3096	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe	zap3998.exe
PID 4600 wrote to memory of 4544	4600	zap3998.exe	zap2576.exe
PID 4600 wrote to memory of 4544	4600	zap3998.exe	zap2576.exe
PID 4600 wrote to memory of 4544	4600	zap3998.exe	zap2576.exe
PID 4544 wrote to memory of 792	4544	zap2576.exe	zap4896.exe
PID 4544 wrote to memory of 792	4544	zap2576.exe	zap4896.exe
PID 4544 wrote to memory of 792	4544	zap2576.exe	zap4896.exe
PID 792 wrote to memory of 1392	792	zap4896.exe	tz0268.exe
PID 792 wrote to memory of 1392	792	zap4896.exe	tz0268.exe
PID 792 wrote to memory of 3572	792	zap4896.exe	v3274ow.exe
PID 792 wrote to memory of 3572	792	zap4896.exe	v3274ow.exe
PID 792 wrote to memory of 3572	792	zap4896.exe	v3274ow.exe
PID 4544 wrote to memory of 2856	4544	zap2576.exe	w00KS38.exe
PID 4544 wrote to memory of 2856	4544	zap2576.exe	w00KS38.exe
PID 4544 wrote to memory of 2856	4544	zap2576.exe	w00KS38.exe
PID 4600 wrote to memory of 4016	4600	zap3998.exe	xqYdh12.exe
PID 4600 wrote to memory of 4016	4600	zap3998.exe	xqYdh12.exe
PID 4600 wrote to memory of 4016	4600	zap3998.exe	xqYdh12.exe
PID 3096 wrote to memory of 1580	3096	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe	y67TH68.exe
PID 3096 wrote to memory of 1580	3096	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe	y67TH68.exe
PID 3096 wrote to memory of 1580	3096	5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe	y67TH68.exe
PID 1580 wrote to memory of 2088	1580	y67TH68.exe	legenda.exe
PID 1580 wrote to memory of 2088	1580	y67TH68.exe	legenda.exe
PID 1580 wrote to memory of 2088	1580	y67TH68.exe	legenda.exe
PID 2088 wrote to memory of 1564	2088	legenda.exe	schtasks.exe
PID 2088 wrote to memory of 1564	2088	legenda.exe	schtasks.exe
PID 2088 wrote to memory of 1564	2088	legenda.exe	schtasks.exe
PID 2088 wrote to memory of 3536	2088	legenda.exe	cmd.exe
PID 2088 wrote to memory of 3536	2088	legenda.exe	cmd.exe
PID 2088 wrote to memory of 3536	2088	legenda.exe	cmd.exe
PID 3536 wrote to memory of 4632	3536	cmd.exe	cmd.exe
PID 3536 wrote to memory of 4632	3536	cmd.exe	cmd.exe
PID 3536 wrote to memory of 4632	3536	cmd.exe	cmd.exe
PID 3536 wrote to memory of 2476	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2476	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2476	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 1392	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 1392	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 1392	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2632	3536	cmd.exe	cmd.exe
PID 3536 wrote to memory of 2632	3536	cmd.exe	cmd.exe
PID 3536 wrote to memory of 2632	3536	cmd.exe	cmd.exe
PID 3536 wrote to memory of 2596	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2596	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2596	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2868	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2868	3536	cmd.exe	cacls.exe
PID 3536 wrote to memory of 2868	3536	cmd.exe	cacls.exe
PID 2088 wrote to memory of 4572	2088	legenda.exe	rundll32.exe
PID 2088 wrote to memory of 4572	2088	legenda.exe	rundll32.exe
PID 2088 wrote to memory of 4572	2088	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe
"C:\Users\Admin\AppData\Local\Temp\5d3ed73054e749b03d3cc68b6c2ca78f7add18c918a2ea6613c35371ae4c4280.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3096

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3998.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3998.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2576.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2576.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4544

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4896.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4896.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0268.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0268.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3274ow.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3274ow.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1100
6⤵
- Program crash
PID:1772

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00KS38.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00KS38.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 1332
5⤵
- Program crash
PID:1436

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqYdh12.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqYdh12.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y67TH68.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y67TH68.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4632

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:2476

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:1392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2632

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:2596

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:2868

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3572 -ip 3572
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2856 -ip 2856
1⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:1868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y67TH68.exe
Filesize
235KB

MD5
ea37c3f6cc78e2163e0ccd89314014b1

SHA1
6cd46b88bbea833c4724cbefc3e03072b6231651

SHA256
a096dc3e8387cb5e539afe3a0d5cee4956c646944da416b988bf262f3716eada

SHA512
f75ebc3fab2341c1437f37da428f1e4e799a820f559649056cd23d7228cf77ff4df1bf78fecbf374c4a4f20330b8f9cc65b9c40eb51da064cf798dd17fb3e1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y67TH68.exe
Filesize
235KB

MD5
ea37c3f6cc78e2163e0ccd89314014b1

SHA1
6cd46b88bbea833c4724cbefc3e03072b6231651

SHA256
a096dc3e8387cb5e539afe3a0d5cee4956c646944da416b988bf262f3716eada

SHA512
f75ebc3fab2341c1437f37da428f1e4e799a820f559649056cd23d7228cf77ff4df1bf78fecbf374c4a4f20330b8f9cc65b9c40eb51da064cf798dd17fb3e1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3998.exe
Filesize
853KB

MD5
1ed0255eb55d7e467e358ab8a7fab991

SHA1
695212e1d3f78aacb7b35d7f22d2813c483ce660

SHA256
4517a1070b4818ee144f0e8ec536bb3a11733a60b756f9f1b41f3e701149e858

SHA512
bf2245f43a68ac52cabcfded190a2c4b4cec47830f72c656a422513e372ce399c8d10a71f6fde5b48e37ebba6275d95c389b820edeb8a128281eef7b3d104008

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3998.exe
Filesize
853KB

MD5
1ed0255eb55d7e467e358ab8a7fab991

SHA1
695212e1d3f78aacb7b35d7f22d2813c483ce660

SHA256
4517a1070b4818ee144f0e8ec536bb3a11733a60b756f9f1b41f3e701149e858

SHA512
bf2245f43a68ac52cabcfded190a2c4b4cec47830f72c656a422513e372ce399c8d10a71f6fde5b48e37ebba6275d95c389b820edeb8a128281eef7b3d104008

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqYdh12.exe
Filesize
175KB

MD5
1ffb49890075cb894555c0527522d2f1

SHA1
e0e733a0467c47472c94a62a520f6e946ce674e1

SHA256
42cbbdd543fc688cdb6336178cd18bd808fdd66191df268e36417991a6313e43

SHA512
4d7581404f14b9414df7fa4ddd175f0f323abf6a279a8ed5b7ffcabac7f4636560f8e00aba25c32ca4d298b7834c1cdccd2c12b2c8e56c2c77e2e1f05440f285

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqYdh12.exe
Filesize
175KB

MD5
1ffb49890075cb894555c0527522d2f1

SHA1
e0e733a0467c47472c94a62a520f6e946ce674e1

SHA256
42cbbdd543fc688cdb6336178cd18bd808fdd66191df268e36417991a6313e43

SHA512
4d7581404f14b9414df7fa4ddd175f0f323abf6a279a8ed5b7ffcabac7f4636560f8e00aba25c32ca4d298b7834c1cdccd2c12b2c8e56c2c77e2e1f05440f285

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2576.exe
Filesize
711KB

MD5
fb944b70704f5b48a5547fb5af3f3bc3

SHA1
0fbf20b87f959842d64d2dfdc9ebc756c93fc0b2

SHA256
e34304a180ef1ea54d41e7aeabf524a5161730b45069be6ff16c9595801888f9

SHA512
9267619a687959131f6ba9b4bdeef4b1552646798d549a5b8e992d6364a965e4faad8bdfd20c4de59b3ecf58cc509692232a6efa6455020f9568f634ca07fbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2576.exe
Filesize
711KB

MD5
fb944b70704f5b48a5547fb5af3f3bc3

SHA1
0fbf20b87f959842d64d2dfdc9ebc756c93fc0b2

SHA256
e34304a180ef1ea54d41e7aeabf524a5161730b45069be6ff16c9595801888f9

SHA512
9267619a687959131f6ba9b4bdeef4b1552646798d549a5b8e992d6364a965e4faad8bdfd20c4de59b3ecf58cc509692232a6efa6455020f9568f634ca07fbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00KS38.exe
Filesize
383KB

MD5
8618cb4952e68bef624590a406006bbf

SHA1
c7919390ca03ebf4a19afbd9c05c17f2d5ab33aa

SHA256
88415c224a36686268726c7fc60492091e89dc6a74c7c7df7bd7248ad1fb6962

SHA512
637b8bb4b499a4ac8b2331ec6c0e2045de3a28883cd280beebeed198dd840521a4cd76180422f8653b4aac303538c68ae592dad7b87d5f4b7e9dce3de8399bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00KS38.exe
Filesize
383KB

MD5
8618cb4952e68bef624590a406006bbf

SHA1
c7919390ca03ebf4a19afbd9c05c17f2d5ab33aa

SHA256
88415c224a36686268726c7fc60492091e89dc6a74c7c7df7bd7248ad1fb6962

SHA512
637b8bb4b499a4ac8b2331ec6c0e2045de3a28883cd280beebeed198dd840521a4cd76180422f8653b4aac303538c68ae592dad7b87d5f4b7e9dce3de8399bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4896.exe
Filesize
352KB

MD5
d1f6e13ec853f7b3fe9251bc0c4d9c6c

SHA1
755d18405cce78fa6b3f524d0c8096d0393de9de

SHA256
10ca8b6918eb9ebca48ae4fd63d33ff55992c5faedbb7e7149b71cedf29f8def

SHA512
10b007bb815be3caee4a7372ef3c2da282e4ed03ee53f8207acdd714536b1c042381b33cfba8dd4d59bbb1a15aca2a74cb9a287daed6b73a3ad0f750bf03c643

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4896.exe
Filesize
352KB

MD5
d1f6e13ec853f7b3fe9251bc0c4d9c6c

SHA1
755d18405cce78fa6b3f524d0c8096d0393de9de

SHA256
10ca8b6918eb9ebca48ae4fd63d33ff55992c5faedbb7e7149b71cedf29f8def

SHA512
10b007bb815be3caee4a7372ef3c2da282e4ed03ee53f8207acdd714536b1c042381b33cfba8dd4d59bbb1a15aca2a74cb9a287daed6b73a3ad0f750bf03c643

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0268.exe
Filesize
11KB

MD5
320b859c451a65d39cb84013e726cc10

SHA1
9c5cc544a8a2bcb0d86724bcc9e977fd9b204323

SHA256
9f613630374a9f458c7a1217a79dbb5edb59bb6e23d9d3586f8e89ec575e7179

SHA512
88949a070bb21cf0c3de9dbdf2f9f197ea101d1d37210819c0ab438d3453e794d1626aa21d97108a75f6d7ed0944939f81b1a5d9338bd8eb79caf0fba5846538

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0268.exe
Filesize
11KB

MD5
320b859c451a65d39cb84013e726cc10

SHA1
9c5cc544a8a2bcb0d86724bcc9e977fd9b204323

SHA256
9f613630374a9f458c7a1217a79dbb5edb59bb6e23d9d3586f8e89ec575e7179

SHA512
88949a070bb21cf0c3de9dbdf2f9f197ea101d1d37210819c0ab438d3453e794d1626aa21d97108a75f6d7ed0944939f81b1a5d9338bd8eb79caf0fba5846538

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3274ow.exe
Filesize
325KB

MD5
21fe3ffd6d1fc05e420098b7a22fcc69

SHA1
9fe6ec2ad69a9a09be01217462aa9f029d25b270

SHA256
9fe6224391ff9c4e27155cb87238f5002711ffd96eb1f1a39cb65e50633b9cad

SHA512
bc60d7354f6f255125d962d2112f41b70ae59aa3a612c8291132e735a5069ce026b76dc118dd3155b550009f1c37e116cc41a308fbcd81394228cafac1639b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3274ow.exe
Filesize
325KB

MD5
21fe3ffd6d1fc05e420098b7a22fcc69

SHA1
9fe6ec2ad69a9a09be01217462aa9f029d25b270

SHA256
9fe6224391ff9c4e27155cb87238f5002711ffd96eb1f1a39cb65e50633b9cad

SHA512
bc60d7354f6f255125d962d2112f41b70ae59aa3a612c8291132e735a5069ce026b76dc118dd3155b550009f1c37e116cc41a308fbcd81394228cafac1639b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
ea37c3f6cc78e2163e0ccd89314014b1

SHA1
6cd46b88bbea833c4724cbefc3e03072b6231651

SHA256
a096dc3e8387cb5e539afe3a0d5cee4956c646944da416b988bf262f3716eada

SHA512
f75ebc3fab2341c1437f37da428f1e4e799a820f559649056cd23d7228cf77ff4df1bf78fecbf374c4a4f20330b8f9cc65b9c40eb51da064cf798dd17fb3e1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
ea37c3f6cc78e2163e0ccd89314014b1

SHA1
6cd46b88bbea833c4724cbefc3e03072b6231651

SHA256
a096dc3e8387cb5e539afe3a0d5cee4956c646944da416b988bf262f3716eada

SHA512
f75ebc3fab2341c1437f37da428f1e4e799a820f559649056cd23d7228cf77ff4df1bf78fecbf374c4a4f20330b8f9cc65b9c40eb51da064cf798dd17fb3e1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
ea37c3f6cc78e2163e0ccd89314014b1

SHA1
6cd46b88bbea833c4724cbefc3e03072b6231651

SHA256
a096dc3e8387cb5e539afe3a0d5cee4956c646944da416b988bf262f3716eada

SHA512
f75ebc3fab2341c1437f37da428f1e4e799a820f559649056cd23d7228cf77ff4df1bf78fecbf374c4a4f20330b8f9cc65b9c40eb51da064cf798dd17fb3e1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
ea37c3f6cc78e2163e0ccd89314014b1

SHA1
6cd46b88bbea833c4724cbefc3e03072b6231651

SHA256
a096dc3e8387cb5e539afe3a0d5cee4956c646944da416b988bf262f3716eada

SHA512
f75ebc3fab2341c1437f37da428f1e4e799a820f559649056cd23d7228cf77ff4df1bf78fecbf374c4a4f20330b8f9cc65b9c40eb51da064cf798dd17fb3e1fb

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/1392-161-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2856-1127-0x0000000008A20000-0x0000000008A96000-memory.dmp

Filesize
472KB

Download
memory/2856-242-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-1134-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-1133-0x0000000008F80000-0x00000000094AC000-memory.dmp

Filesize
5.2MB

Download
memory/2856-1132-0x0000000008D60000-0x0000000008F22000-memory.dmp

Filesize
1.8MB

Download
memory/2856-1131-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-1130-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-1129-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-1128-0x0000000008AB0000-0x0000000008B00000-memory.dmp

Filesize
320KB

Download
memory/2856-1126-0x0000000008950000-0x00000000089E2000-memory.dmp

Filesize
584KB

Download
memory/2856-1125-0x0000000008280000-0x00000000082E6000-memory.dmp

Filesize
408KB

Download
memory/2856-1123-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-209-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-210-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-212-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-214-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-217-0x0000000002E10000-0x0000000002E5B000-memory.dmp

Filesize
300KB

Download
memory/2856-216-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-223-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-221-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-220-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-219-0x00000000071B0000-0x00000000071C0000-memory.dmp

Filesize
64KB

Download
memory/2856-224-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-226-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-228-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-230-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-232-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-234-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-236-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-238-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-240-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-1122-0x0000000007FA0000-0x0000000007FDC000-memory.dmp

Filesize
240KB

Download
memory/2856-244-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-246-0x0000000004B10000-0x0000000004B4F000-memory.dmp

Filesize
252KB

Download
memory/2856-1119-0x0000000007870000-0x0000000007E88000-memory.dmp

Filesize
6.1MB

Download
memory/2856-1120-0x0000000007E90000-0x0000000007F9A000-memory.dmp

Filesize
1.0MB

Download
memory/2856-1121-0x0000000007180000-0x0000000007192000-memory.dmp

Filesize
72KB

Download
memory/3572-186-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-192-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-184-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-194-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-188-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-203-0x00000000071F0000-0x0000000007200000-memory.dmp

Filesize
64KB

Download
memory/3572-202-0x00000000071F0000-0x0000000007200000-memory.dmp

Filesize
64KB

Download
memory/3572-200-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/3572-199-0x00000000071F0000-0x0000000007200000-memory.dmp

Filesize
64KB

Download
memory/3572-198-0x00000000071F0000-0x0000000007200000-memory.dmp

Filesize
64KB

Download
memory/3572-197-0x00000000071F0000-0x0000000007200000-memory.dmp

Filesize
64KB

Download
memory/3572-196-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-167-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/3572-190-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-204-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/3572-168-0x0000000007200000-0x00000000077A4000-memory.dmp

Filesize
5.6MB

Download
memory/3572-182-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-180-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-178-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-176-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-174-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-172-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-170-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/3572-169-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/4016-1141-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/4016-1140-0x00000000008E0000-0x0000000000912000-memory.dmp

Filesize
200KB

Download