amadey | b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530

Analysis

max time kernel
111s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe
Size

999KB
MD5

d96248b2b856965cdfc3ed1703a09cf4
SHA1

f6534b0ec840983003bdc8faebfb2c7fa818c9c9
SHA256

b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530
SHA512

6169f409311636dadfef2519e1a45cf9b78f2d8c9018365c5db1534d7b440be148f1f18a2487b6a752c5f2d8b54bf194dbef684377746e5019a69efc2d4baab8
SSDEEP

12288:uMrJy90GkjbWGJjEbDKrWYTMw3Jw8pGqMBiDCs7M3inEXdu4hH/K2RFoYaO+YMZt:LyCyGzqmHlbQyg1JolPnbqNu

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v0149JL.exetz4885.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v0149JL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4885.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v0149JL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v0149JL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v0149JL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v0149JL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v0149JL.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3836-211-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-210-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-213-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-215-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-217-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-219-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-221-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-223-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-225-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-227-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-229-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-231-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-233-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-235-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-237-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-239-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-241-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-243-0x0000000002480000-0x00000000024BF000-memory.dmp	family_redline
behavioral1/memory/3836-1130-0x0000000004BF0000-0x0000000004C00000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y02xX37.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y02xX37.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

Processes:

zap9374.exezap1261.exezap6025.exetz4885.exev0149JL.exew47ot16.exexNMNc51.exey02xX37.exeoneetx.exeoneetx.exe

pid	process
4760	zap9374.exe
1208	zap1261.exe
1356	zap6025.exe
2180	tz4885.exe
4696	v0149JL.exe
3836	w47ot16.exe
1976	xNMNc51.exe
912	y02xX37.exe
4456	oneetx.exe
3092	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4100 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4100	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz4885.exev0149JL.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4885.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v0149JL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v0149JL.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap6025.exeb3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exezap9374.exezap1261.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6025.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap6025.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9374.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9374.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1261.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1261.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1484 4696 WerFault.exe v0149JL.exe
4944 3836 WerFault.exe w47ot16.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2848 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz4885.exev0149JL.exew47ot16.exexNMNc51.exe

pid process

2180 tz4885.exe
2180 tz4885.exe
4696 v0149JL.exe
4696 v0149JL.exe
3836 w47ot16.exe
3836 w47ot16.exe
1976 xNMNc51.exe
1976 xNMNc51.exe

pid	pid_target	process	target process
1484	4696	WerFault.exe	v0149JL.exe
4944	3836	WerFault.exe	w47ot16.exe

pid	process
2848	schtasks.exe

pid	process
2180	tz4885.exe
2180	tz4885.exe
4696	v0149JL.exe
4696	v0149JL.exe
3836	w47ot16.exe
3836	w47ot16.exe
1976	xNMNc51.exe
1976	xNMNc51.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz4885.exev0149JL.exew47ot16.exexNMNc51.exe

description	pid	process
Token: SeDebugPrivilege	2180	tz4885.exe
Token: SeDebugPrivilege	4696	v0149JL.exe
Token: SeDebugPrivilege	3836	w47ot16.exe
Token: SeDebugPrivilege	1976	xNMNc51.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

y02xX37.exe

pid process

912 y02xX37.exe

pid	process
912	y02xX37.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exezap9374.exezap1261.exezap6025.exey02xX37.exeoneetx.execmd.exe

description	pid	process	target process
PID 1568 wrote to memory of 4760	1568	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe	zap9374.exe
PID 1568 wrote to memory of 4760	1568	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe	zap9374.exe
PID 1568 wrote to memory of 4760	1568	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe	zap9374.exe
PID 4760 wrote to memory of 1208	4760	zap9374.exe	zap1261.exe
PID 4760 wrote to memory of 1208	4760	zap9374.exe	zap1261.exe
PID 4760 wrote to memory of 1208	4760	zap9374.exe	zap1261.exe
PID 1208 wrote to memory of 1356	1208	zap1261.exe	zap6025.exe
PID 1208 wrote to memory of 1356	1208	zap1261.exe	zap6025.exe
PID 1208 wrote to memory of 1356	1208	zap1261.exe	zap6025.exe
PID 1356 wrote to memory of 2180	1356	zap6025.exe	tz4885.exe
PID 1356 wrote to memory of 2180	1356	zap6025.exe	tz4885.exe
PID 1356 wrote to memory of 4696	1356	zap6025.exe	v0149JL.exe
PID 1356 wrote to memory of 4696	1356	zap6025.exe	v0149JL.exe
PID 1356 wrote to memory of 4696	1356	zap6025.exe	v0149JL.exe
PID 1208 wrote to memory of 3836	1208	zap1261.exe	w47ot16.exe
PID 1208 wrote to memory of 3836	1208	zap1261.exe	w47ot16.exe
PID 1208 wrote to memory of 3836	1208	zap1261.exe	w47ot16.exe
PID 4760 wrote to memory of 1976	4760	zap9374.exe	xNMNc51.exe
PID 4760 wrote to memory of 1976	4760	zap9374.exe	xNMNc51.exe
PID 4760 wrote to memory of 1976	4760	zap9374.exe	xNMNc51.exe
PID 1568 wrote to memory of 912	1568	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe	y02xX37.exe
PID 1568 wrote to memory of 912	1568	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe	y02xX37.exe
PID 1568 wrote to memory of 912	1568	b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe	y02xX37.exe
PID 912 wrote to memory of 4456	912	y02xX37.exe	oneetx.exe
PID 912 wrote to memory of 4456	912	y02xX37.exe	oneetx.exe
PID 912 wrote to memory of 4456	912	y02xX37.exe	oneetx.exe
PID 4456 wrote to memory of 2848	4456	oneetx.exe	schtasks.exe
PID 4456 wrote to memory of 2848	4456	oneetx.exe	schtasks.exe
PID 4456 wrote to memory of 2848	4456	oneetx.exe	schtasks.exe
PID 4456 wrote to memory of 3748	4456	oneetx.exe	cmd.exe
PID 4456 wrote to memory of 3748	4456	oneetx.exe	cmd.exe
PID 4456 wrote to memory of 3748	4456	oneetx.exe	cmd.exe
PID 3748 wrote to memory of 1784	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1784	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1784	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 5104	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 5104	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 5104	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 4300	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 4300	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 4300	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 2428	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 2428	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 2428	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1228	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1228	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1228	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 5112	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 5112	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 5112	3748	cmd.exe	cacls.exe
PID 4456 wrote to memory of 4100	4456	oneetx.exe	rundll32.exe
PID 4456 wrote to memory of 4100	4456	oneetx.exe	rundll32.exe
PID 4456 wrote to memory of 4100	4456	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe
"C:\Users\Admin\AppData\Local\Temp\b3cd41c946d08acedea8e22cdbdb7ed8003a154bbad8683f86ce20855bfec530.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9374.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9374.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4760

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1261.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1261.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6025.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6025.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1356

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4885.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4885.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0149JL.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0149JL.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1084
6⤵
- Program crash
PID:1484

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47ot16.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47ot16.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1368
5⤵
- Program crash
PID:4944

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xNMNc51.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xNMNc51.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02xX37.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02xX37.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:2848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1784

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:5104

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:4300

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2428

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:N"
5⤵
PID:1228

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:R" /E
5⤵
PID:5112

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4696 -ip 4696
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3836 -ip 3836
1⤵
PID:536

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02xX37.exe
Filesize
236KB

MD5
0c30d8df65b61e987207e95a98d355cf

SHA1
bb6b3df6d8b845d52eac7adf59355fd6ba6af8f5

SHA256
546587fd9dd0b62f55b423cd02992524d12e92fd2b4469dc177296d81feee794

SHA512
bcf094320b0d5a1ead047d39c21c8ce7b251d3140c734e665773c76e961214c33305ef8fbd0c0f49b9e718e32224f757749d495dd0e296b5a22e0d5976ca09d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02xX37.exe
Filesize
236KB

MD5
0c30d8df65b61e987207e95a98d355cf

SHA1
bb6b3df6d8b845d52eac7adf59355fd6ba6af8f5

SHA256
546587fd9dd0b62f55b423cd02992524d12e92fd2b4469dc177296d81feee794

SHA512
bcf094320b0d5a1ead047d39c21c8ce7b251d3140c734e665773c76e961214c33305ef8fbd0c0f49b9e718e32224f757749d495dd0e296b5a22e0d5976ca09d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9374.exe
Filesize
815KB

MD5
aba6655df960072adbc261c9282f15ec

SHA1
eaca4791f225012ed8fd08385e8dd4a48ef4dc44

SHA256
1d9bf55f3c922a94c2846af2f4f5e35b3ed8dc390f92cd940e2338e4fad52ca5

SHA512
681138f4ef8759286abaedda178985e1e6c1b935591cd6efe72aca9dd0c88fa8905c5bbe2e20dad8d2f0d31d46e72f012c32f02a563bd4eb8d66358e1ab8a364

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9374.exe
Filesize
815KB

MD5
aba6655df960072adbc261c9282f15ec

SHA1
eaca4791f225012ed8fd08385e8dd4a48ef4dc44

SHA256
1d9bf55f3c922a94c2846af2f4f5e35b3ed8dc390f92cd940e2338e4fad52ca5

SHA512
681138f4ef8759286abaedda178985e1e6c1b935591cd6efe72aca9dd0c88fa8905c5bbe2e20dad8d2f0d31d46e72f012c32f02a563bd4eb8d66358e1ab8a364

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xNMNc51.exe
Filesize
175KB

MD5
1bac8bb1a1206f67e403094817cb0e83

SHA1
6664a7c939d98e7f69c9e90af454ca7303d38a34

SHA256
b162463d4e6a3bc45a30464f0330be61d327db96dd29dd6e961f21be9ecefed7

SHA512
a59ef35ed40f915edae2f3c630c9f639775a177a6dd509e211af31943c818740b3b4468ae872fd8bedec41650755921631f38428df9c5bdfb5c2d1b3fca8c293

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xNMNc51.exe
Filesize
175KB

MD5
1bac8bb1a1206f67e403094817cb0e83

SHA1
6664a7c939d98e7f69c9e90af454ca7303d38a34

SHA256
b162463d4e6a3bc45a30464f0330be61d327db96dd29dd6e961f21be9ecefed7

SHA512
a59ef35ed40f915edae2f3c630c9f639775a177a6dd509e211af31943c818740b3b4468ae872fd8bedec41650755921631f38428df9c5bdfb5c2d1b3fca8c293

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1261.exe
Filesize
673KB

MD5
d58c4f0bfaacd311bfa4252da7401ee8

SHA1
d4e46f3e50a353752971b6774adcd28ae0f951ea

SHA256
d12ee28e69ec4eea8676c40a733569f60766a2a879fbf279fff9f877cbeab9d3

SHA512
35ea5cc82b028fb77a70793882627cc3f3744a9d6baa53434337bb6a835d5a253657caf50d7ffaa4c64f278d2852f7a5362819307717f05463f992069ef75914

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1261.exe
Filesize
673KB

MD5
d58c4f0bfaacd311bfa4252da7401ee8

SHA1
d4e46f3e50a353752971b6774adcd28ae0f951ea

SHA256
d12ee28e69ec4eea8676c40a733569f60766a2a879fbf279fff9f877cbeab9d3

SHA512
35ea5cc82b028fb77a70793882627cc3f3744a9d6baa53434337bb6a835d5a253657caf50d7ffaa4c64f278d2852f7a5362819307717f05463f992069ef75914

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47ot16.exe
Filesize
318KB

MD5
44754546a023ab8b1cf91d23dc7f0d5f

SHA1
2dc5deee808a951b927dcb22ed2a490fd3a6da1b

SHA256
d736815b23330e91636c66d85539b0cf09b7390bffcf9e5e056b63f67e354b97

SHA512
4e00689810471d6760b342ab9c0c28b7bd5472b06eb138a32de3929c72a63226de69bd96dfbab9042edd36b4ffd56c8f2beb73797cce3612764ad6678ee71b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47ot16.exe
Filesize
318KB

MD5
44754546a023ab8b1cf91d23dc7f0d5f

SHA1
2dc5deee808a951b927dcb22ed2a490fd3a6da1b

SHA256
d736815b23330e91636c66d85539b0cf09b7390bffcf9e5e056b63f67e354b97

SHA512
4e00689810471d6760b342ab9c0c28b7bd5472b06eb138a32de3929c72a63226de69bd96dfbab9042edd36b4ffd56c8f2beb73797cce3612764ad6678ee71b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6025.exe
Filesize
333KB

MD5
6d8a26b69d7bac847b80df707532f611

SHA1
a7fdca3100e2c6b5ec8af0f1d448ff0fd91bc91f

SHA256
10c06771bf2da7a6ddb106806fc8afa0486b7b3c3cdbaaeed3aca9efa76d87f9

SHA512
e343e0edf22c2802a6e7f7b3d57eb9cfffe081ed466c65751ef23447034a9cc15ee1ebb2256272b5a988cded9f2b50be2a96e4cd3845f2cfbddb4a74eec8666c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6025.exe
Filesize
333KB

MD5
6d8a26b69d7bac847b80df707532f611

SHA1
a7fdca3100e2c6b5ec8af0f1d448ff0fd91bc91f

SHA256
10c06771bf2da7a6ddb106806fc8afa0486b7b3c3cdbaaeed3aca9efa76d87f9

SHA512
e343e0edf22c2802a6e7f7b3d57eb9cfffe081ed466c65751ef23447034a9cc15ee1ebb2256272b5a988cded9f2b50be2a96e4cd3845f2cfbddb4a74eec8666c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4885.exe
Filesize
11KB

MD5
b8a9fc73785648020c861e0918f4457d

SHA1
733fcd0916762f92ab4ab6b7594902501b459b20

SHA256
5fa69b09d6ce2d5c80f9f52eff336140c0f655d670418fcb6a326e1058f3100c

SHA512
4cdf50febd29068cdd3dba166eb96a88d4f657651527e5cab71db282c0bda346133f13d7b75f63bcb1f2d1b38ff309a40d546d5ce7b749f090ab20f3ecbbf6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4885.exe
Filesize
11KB

MD5
b8a9fc73785648020c861e0918f4457d

SHA1
733fcd0916762f92ab4ab6b7594902501b459b20

SHA256
5fa69b09d6ce2d5c80f9f52eff336140c0f655d670418fcb6a326e1058f3100c

SHA512
4cdf50febd29068cdd3dba166eb96a88d4f657651527e5cab71db282c0bda346133f13d7b75f63bcb1f2d1b38ff309a40d546d5ce7b749f090ab20f3ecbbf6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0149JL.exe
Filesize
259KB

MD5
d7682163015c4e0b9699739885a4ef5c

SHA1
83357d8c54506e7508387defff20a73ec037d138

SHA256
19029e5d370803333477c038fd67708254493b74ea1fe6fec1eb57525c74ad67

SHA512
72d73df582dde096a61945204062e07bd504b317baf8b9b2f4f37a64bffc70697bc7e3b2be7b17c5eac79ac1115bc97b5a5581c2d6a9d9ca1bae088904a82d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0149JL.exe
Filesize
259KB

MD5
d7682163015c4e0b9699739885a4ef5c

SHA1
83357d8c54506e7508387defff20a73ec037d138

SHA256
19029e5d370803333477c038fd67708254493b74ea1fe6fec1eb57525c74ad67

SHA512
72d73df582dde096a61945204062e07bd504b317baf8b9b2f4f37a64bffc70697bc7e3b2be7b17c5eac79ac1115bc97b5a5581c2d6a9d9ca1bae088904a82d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
0c30d8df65b61e987207e95a98d355cf

SHA1
bb6b3df6d8b845d52eac7adf59355fd6ba6af8f5

SHA256
546587fd9dd0b62f55b423cd02992524d12e92fd2b4469dc177296d81feee794

SHA512
bcf094320b0d5a1ead047d39c21c8ce7b251d3140c734e665773c76e961214c33305ef8fbd0c0f49b9e718e32224f757749d495dd0e296b5a22e0d5976ca09d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
0c30d8df65b61e987207e95a98d355cf

SHA1
bb6b3df6d8b845d52eac7adf59355fd6ba6af8f5

SHA256
546587fd9dd0b62f55b423cd02992524d12e92fd2b4469dc177296d81feee794

SHA512
bcf094320b0d5a1ead047d39c21c8ce7b251d3140c734e665773c76e961214c33305ef8fbd0c0f49b9e718e32224f757749d495dd0e296b5a22e0d5976ca09d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
0c30d8df65b61e987207e95a98d355cf

SHA1
bb6b3df6d8b845d52eac7adf59355fd6ba6af8f5

SHA256
546587fd9dd0b62f55b423cd02992524d12e92fd2b4469dc177296d81feee794

SHA512
bcf094320b0d5a1ead047d39c21c8ce7b251d3140c734e665773c76e961214c33305ef8fbd0c0f49b9e718e32224f757749d495dd0e296b5a22e0d5976ca09d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
0c30d8df65b61e987207e95a98d355cf

SHA1
bb6b3df6d8b845d52eac7adf59355fd6ba6af8f5

SHA256
546587fd9dd0b62f55b423cd02992524d12e92fd2b4469dc177296d81feee794

SHA512
bcf094320b0d5a1ead047d39c21c8ce7b251d3140c734e665773c76e961214c33305ef8fbd0c0f49b9e718e32224f757749d495dd0e296b5a22e0d5976ca09d0

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1976-1142-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/1976-1141-0x00000000000E0000-0x0000000000112000-memory.dmp

Filesize
200KB

Download
memory/2180-161-0x0000000000B20000-0x0000000000B2A000-memory.dmp

Filesize
40KB

Download
memory/3836-1127-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/3836-300-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-1135-0x0000000006E90000-0x0000000006EE0000-memory.dmp

Filesize
320KB

Download
memory/3836-1134-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-1133-0x0000000006E00000-0x0000000006E76000-memory.dmp

Filesize
472KB

Download
memory/3836-1132-0x0000000006790000-0x0000000006CBC000-memory.dmp

Filesize
5.2MB

Download
memory/3836-1131-0x00000000065B0000-0x0000000006772000-memory.dmp

Filesize
1.8MB

Download
memory/3836-1130-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-1129-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-1128-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-1125-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/3836-211-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-210-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-213-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-215-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-217-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-219-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-221-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-223-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-225-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-227-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-229-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-231-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-233-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-235-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-237-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-239-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-241-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-243-0x0000000002480000-0x00000000024BF000-memory.dmp

Filesize
252KB

Download
memory/3836-298-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-297-0x0000000001FE0000-0x000000000202B000-memory.dmp

Filesize
300KB

Download
memory/3836-1124-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-302-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3836-1120-0x00000000052B0000-0x00000000058C8000-memory.dmp

Filesize
6.1MB

Download
memory/3836-1121-0x00000000058D0000-0x00000000059DA000-memory.dmp

Filesize
1.0MB

Download
memory/3836-1122-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/3836-1123-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/4696-187-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-205-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4696-197-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-195-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-185-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-204-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4696-203-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4696-183-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-200-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4696-199-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4696-198-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4696-189-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-191-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-193-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-201-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4696-181-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-179-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-177-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-175-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-173-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-171-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-170-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4696-169-0x0000000004E00000-0x00000000053A4000-memory.dmp

Filesize
5.6MB

Download
memory/4696-168-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4696-167-0x0000000000640000-0x000000000066D000-memory.dmp

Filesize
180KB

Download