amadey | ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15

Analysis

max time kernel
110s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe
Size

992KB
MD5

8b39c1a80305abe4573d9b8dc1504a57
SHA1

730081e5a09f23947c443fa3d91593b881a402b7
SHA256

ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15
SHA512

11388d710852a95498701d6a1f2d9ef54a54e9fda78ef5f9706fe6376c3a5eeed5bb593d4a09454cbb1dde2d3e3673786bbebf6332dc9329ce5adc49fe9054b0
SSDEEP

24576:Jyqe4HJvH44+mb1fwyG/uTrUCUPuUbxmPwt3TQ2Ph8/8qP/:8qeIJvH4rmb9o/SkuDP8zi/8y

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz6935.exev6021Oi.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz6935.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz6935.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v6021Oi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v6021Oi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v6021Oi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v6021Oi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz6935.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz6935.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz6935.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz6935.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v6021Oi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v6021Oi.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3132-207-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-208-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-210-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-212-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-214-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-216-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-218-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-220-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-222-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-224-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-226-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-228-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-230-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-232-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-234-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-236-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-238-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-242-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/3132-1128-0x00000000072A0000-0x00000000072B0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y62NU65.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y62NU65.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

Processes:

zap2583.exezap1267.exezap6201.exetz6935.exev6021Oi.exew40Ft00.exexZssk84.exey62NU65.exeoneetx.exeoneetx.exe

pid	process
4364	zap2583.exe
1776	zap1267.exe
2000	zap6201.exe
3760	tz6935.exe
1172	v6021Oi.exe
3132	w40Ft00.exe
4112	xZssk84.exe
3348	y62NU65.exe
4684	oneetx.exe
1684	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4836 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4836	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz6935.exev6021Oi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz6935.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v6021Oi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v6021Oi.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap1267.exezap6201.exeac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exezap2583.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1267.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1267.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap6201.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2583.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap2583.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3576 1172 WerFault.exe v6021Oi.exe
3700 3132 WerFault.exe w40Ft00.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2604 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz6935.exev6021Oi.exew40Ft00.exexZssk84.exe

pid process

3760 tz6935.exe
3760 tz6935.exe
1172 v6021Oi.exe
1172 v6021Oi.exe
3132 w40Ft00.exe
3132 w40Ft00.exe
4112 xZssk84.exe
4112 xZssk84.exe

pid	pid_target	process	target process
3576	1172	WerFault.exe	v6021Oi.exe
3700	3132	WerFault.exe	w40Ft00.exe

pid	process
2604	schtasks.exe

pid	process
3760	tz6935.exe
3760	tz6935.exe
1172	v6021Oi.exe
1172	v6021Oi.exe
3132	w40Ft00.exe
3132	w40Ft00.exe
4112	xZssk84.exe
4112	xZssk84.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz6935.exev6021Oi.exew40Ft00.exexZssk84.exe

description	pid	process
Token: SeDebugPrivilege	3760	tz6935.exe
Token: SeDebugPrivilege	1172	v6021Oi.exe
Token: SeDebugPrivilege	3132	w40Ft00.exe
Token: SeDebugPrivilege	4112	xZssk84.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

y62NU65.exe

pid process

3348 y62NU65.exe

pid	process
3348	y62NU65.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exezap2583.exezap1267.exezap6201.exey62NU65.exeoneetx.execmd.exe

description	pid	process	target process
PID 4076 wrote to memory of 4364	4076	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe	zap2583.exe
PID 4076 wrote to memory of 4364	4076	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe	zap2583.exe
PID 4076 wrote to memory of 4364	4076	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe	zap2583.exe
PID 4364 wrote to memory of 1776	4364	zap2583.exe	zap1267.exe
PID 4364 wrote to memory of 1776	4364	zap2583.exe	zap1267.exe
PID 4364 wrote to memory of 1776	4364	zap2583.exe	zap1267.exe
PID 1776 wrote to memory of 2000	1776	zap1267.exe	zap6201.exe
PID 1776 wrote to memory of 2000	1776	zap1267.exe	zap6201.exe
PID 1776 wrote to memory of 2000	1776	zap1267.exe	zap6201.exe
PID 2000 wrote to memory of 3760	2000	zap6201.exe	tz6935.exe
PID 2000 wrote to memory of 3760	2000	zap6201.exe	tz6935.exe
PID 2000 wrote to memory of 1172	2000	zap6201.exe	v6021Oi.exe
PID 2000 wrote to memory of 1172	2000	zap6201.exe	v6021Oi.exe
PID 2000 wrote to memory of 1172	2000	zap6201.exe	v6021Oi.exe
PID 1776 wrote to memory of 3132	1776	zap1267.exe	w40Ft00.exe
PID 1776 wrote to memory of 3132	1776	zap1267.exe	w40Ft00.exe
PID 1776 wrote to memory of 3132	1776	zap1267.exe	w40Ft00.exe
PID 4364 wrote to memory of 4112	4364	zap2583.exe	xZssk84.exe
PID 4364 wrote to memory of 4112	4364	zap2583.exe	xZssk84.exe
PID 4364 wrote to memory of 4112	4364	zap2583.exe	xZssk84.exe
PID 4076 wrote to memory of 3348	4076	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe	y62NU65.exe
PID 4076 wrote to memory of 3348	4076	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe	y62NU65.exe
PID 4076 wrote to memory of 3348	4076	ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe	y62NU65.exe
PID 3348 wrote to memory of 4684	3348	y62NU65.exe	oneetx.exe
PID 3348 wrote to memory of 4684	3348	y62NU65.exe	oneetx.exe
PID 3348 wrote to memory of 4684	3348	y62NU65.exe	oneetx.exe
PID 4684 wrote to memory of 2604	4684	oneetx.exe	schtasks.exe
PID 4684 wrote to memory of 2604	4684	oneetx.exe	schtasks.exe
PID 4684 wrote to memory of 2604	4684	oneetx.exe	schtasks.exe
PID 4684 wrote to memory of 3340	4684	oneetx.exe	cmd.exe
PID 4684 wrote to memory of 3340	4684	oneetx.exe	cmd.exe
PID 4684 wrote to memory of 3340	4684	oneetx.exe	cmd.exe
PID 3340 wrote to memory of 1016	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 1016	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 1016	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 3920	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3920	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3920	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3288	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3288	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3288	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 4248	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 4248	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 4248	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 4132	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 4132	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 4132	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 4988	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 4988	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 4988	3340	cmd.exe	cacls.exe
PID 4684 wrote to memory of 4836	4684	oneetx.exe	rundll32.exe
PID 4684 wrote to memory of 4836	4684	oneetx.exe	rundll32.exe
PID 4684 wrote to memory of 4836	4684	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe
"C:\Users\Admin\AppData\Local\Temp\ac1331b96aad274bcba551ed2bccba3eedbe068b77a5bc1dc06db17b13256c15.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2583.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2583.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4364

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1267.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1267.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6201.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6201.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6935.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6935.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6021Oi.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6021Oi.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 1080
6⤵
- Program crash
PID:3576

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w40Ft00.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w40Ft00.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 1564
5⤵
- Program crash
PID:3700

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZssk84.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZssk84.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y62NU65.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y62NU65.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3348

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:2604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1016

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:3920

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:3288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4248

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:N"
5⤵
PID:4132

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:R" /E
5⤵
PID:4988

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1172 -ip 1172
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3132 -ip 3132
1⤵
PID:1868

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y62NU65.exe
Filesize
236KB

MD5
de1c84004d69ad1dcc613a2b2f7aecd3

SHA1
e296ab500772502c400058a660115848ca93810b

SHA256
24af9fb2d4312dff97a4fa24d3087bbfbee9e4242a7b1789414bdb7021eab38b

SHA512
82f93f2423d0dfe5f9772dca6298158d18e3b25f8b0f65d839d1a58e40bcd9fc4e12589da783da27eca8be05dfa168e48d590ee2f45a3ee8a90a189c330935d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y62NU65.exe
Filesize
236KB

MD5
de1c84004d69ad1dcc613a2b2f7aecd3

SHA1
e296ab500772502c400058a660115848ca93810b

SHA256
24af9fb2d4312dff97a4fa24d3087bbfbee9e4242a7b1789414bdb7021eab38b

SHA512
82f93f2423d0dfe5f9772dca6298158d18e3b25f8b0f65d839d1a58e40bcd9fc4e12589da783da27eca8be05dfa168e48d590ee2f45a3ee8a90a189c330935d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2583.exe
Filesize
808KB

MD5
86be147bb19b856f5941c35f7e7c52f4

SHA1
f8d913028699e8ba0bd42154cf99ee43afa7124b

SHA256
04d573a973d317957cb81dbbf7d84281be8da256dfe4a3f3173a13067a06edd0

SHA512
8b512516cc3d8205beef668d913ed188319e261dcc459c6582fb182a5186278b2a23d6054218634d5ec88af718ca5271817b15ffad960adfecc8ac7bda98b60e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2583.exe
Filesize
808KB

MD5
86be147bb19b856f5941c35f7e7c52f4

SHA1
f8d913028699e8ba0bd42154cf99ee43afa7124b

SHA256
04d573a973d317957cb81dbbf7d84281be8da256dfe4a3f3173a13067a06edd0

SHA512
8b512516cc3d8205beef668d913ed188319e261dcc459c6582fb182a5186278b2a23d6054218634d5ec88af718ca5271817b15ffad960adfecc8ac7bda98b60e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZssk84.exe
Filesize
175KB

MD5
baaa8bee4b077660f2e792616205776b

SHA1
e049de75ce5e0d68a1a176ae4e1f3a1d4731e994

SHA256
c4fd09751a4799cc101863ceb84eb20a042508dc77b69e1b267b6c5c29d3a546

SHA512
1a87ff52fe76358656d8f110d6313d294ca06521dbddf1a0daccb966671eb8218af76a8a9ad59598bad1d441a9f0fa7e99a5e7cf7c1643d46fc8ffe05fcf80b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xZssk84.exe
Filesize
175KB

MD5
baaa8bee4b077660f2e792616205776b

SHA1
e049de75ce5e0d68a1a176ae4e1f3a1d4731e994

SHA256
c4fd09751a4799cc101863ceb84eb20a042508dc77b69e1b267b6c5c29d3a546

SHA512
1a87ff52fe76358656d8f110d6313d294ca06521dbddf1a0daccb966671eb8218af76a8a9ad59598bad1d441a9f0fa7e99a5e7cf7c1643d46fc8ffe05fcf80b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1267.exe
Filesize
665KB

MD5
0042989582b2bd8d9d794ecf96600c6b

SHA1
41aa9f15201f7df2a948ccb64a9a13e85d74f4e4

SHA256
0eb090e403a80207eae989662a7e279f125d451e59b308fcc014ab46a116c053

SHA512
70a3f7a5264e0fcb19ea1c3060546dfb521c6b8a866392ef71e38c3fb3d4579038d4ce6888b42295c582a2d9267bc7aee8ed05c595dec3fb5eac054998319ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1267.exe
Filesize
665KB

MD5
0042989582b2bd8d9d794ecf96600c6b

SHA1
41aa9f15201f7df2a948ccb64a9a13e85d74f4e4

SHA256
0eb090e403a80207eae989662a7e279f125d451e59b308fcc014ab46a116c053

SHA512
70a3f7a5264e0fcb19ea1c3060546dfb521c6b8a866392ef71e38c3fb3d4579038d4ce6888b42295c582a2d9267bc7aee8ed05c595dec3fb5eac054998319ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w40Ft00.exe
Filesize
342KB

MD5
a2d00e5e4b5d1e27383da21eba93cc57

SHA1
1e489041ec4ac90db9d657cef571c809699c2905

SHA256
3899f3ed5fa31c320300257e626c8a0e66bfd105a8dba10d5a7552f7f5ab6e84

SHA512
5809a555797714516562cb19b6213e01e4e07f2b4a91bf02d292cc53e13640ffe1e4d5e4bf6233c3146ae384658b252ee59be3798d3815bc264eff53229165e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w40Ft00.exe
Filesize
342KB

MD5
a2d00e5e4b5d1e27383da21eba93cc57

SHA1
1e489041ec4ac90db9d657cef571c809699c2905

SHA256
3899f3ed5fa31c320300257e626c8a0e66bfd105a8dba10d5a7552f7f5ab6e84

SHA512
5809a555797714516562cb19b6213e01e4e07f2b4a91bf02d292cc53e13640ffe1e4d5e4bf6233c3146ae384658b252ee59be3798d3815bc264eff53229165e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6201.exe
Filesize
329KB

MD5
f09a4f754edccc112c7007ad91847dcb

SHA1
eca9f45513edf991df409330665cf798355a8889

SHA256
8065f6bdd02f788b5c71d78bf819a1ce041f4f433b21ef0ea763f69feedfacb9

SHA512
3cffe93f6777e7fb6125c68f11d9a99c975b5f029ddab2ca6cb6b5b9fe6ba51c70339697ef4854a2a068ca98debbeedc2be54eb2a626a8b096986540abaa0a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6201.exe
Filesize
329KB

MD5
f09a4f754edccc112c7007ad91847dcb

SHA1
eca9f45513edf991df409330665cf798355a8889

SHA256
8065f6bdd02f788b5c71d78bf819a1ce041f4f433b21ef0ea763f69feedfacb9

SHA512
3cffe93f6777e7fb6125c68f11d9a99c975b5f029ddab2ca6cb6b5b9fe6ba51c70339697ef4854a2a068ca98debbeedc2be54eb2a626a8b096986540abaa0a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6935.exe
Filesize
12KB

MD5
6df59c7df838c6d370ff62e08d594d7c

SHA1
fccefb792e947ae376aadad55133cbaef4c0e8b3

SHA256
6cd25bb7fc4d9cf74da0d218a04a8bf8d94a7c446a063b932217d09869ff566f

SHA512
0ae4fa9e289e3ee93cb8ca404aa268e87c32be44b0bec8ea2b1717a600d9d0d94a6484d9eb0c50d331fa32620ae8df42c1f247284cbbee57e62d0b6421beb27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6935.exe
Filesize
12KB

MD5
6df59c7df838c6d370ff62e08d594d7c

SHA1
fccefb792e947ae376aadad55133cbaef4c0e8b3

SHA256
6cd25bb7fc4d9cf74da0d218a04a8bf8d94a7c446a063b932217d09869ff566f

SHA512
0ae4fa9e289e3ee93cb8ca404aa268e87c32be44b0bec8ea2b1717a600d9d0d94a6484d9eb0c50d331fa32620ae8df42c1f247284cbbee57e62d0b6421beb27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6021Oi.exe
Filesize
284KB

MD5
ea8c1425311e3f222f3823145e1eb007

SHA1
cd65c11e87c453afccecfabdbdc75221f3857eb4

SHA256
df21d2559fc14cfc8ce05c28f37bddafbe5a6087ab4c306dae443e7b82537c37

SHA512
4dabff4c2085dfae63fe283a3759b2143012d66d441a2b4d156827e2e5ae948b536bcc2695a144fb9428ab05b40d119af60b4e5c74d45d687acf8ab9a09f0f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6021Oi.exe
Filesize
284KB

MD5
ea8c1425311e3f222f3823145e1eb007

SHA1
cd65c11e87c453afccecfabdbdc75221f3857eb4

SHA256
df21d2559fc14cfc8ce05c28f37bddafbe5a6087ab4c306dae443e7b82537c37

SHA512
4dabff4c2085dfae63fe283a3759b2143012d66d441a2b4d156827e2e5ae948b536bcc2695a144fb9428ab05b40d119af60b4e5c74d45d687acf8ab9a09f0f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
de1c84004d69ad1dcc613a2b2f7aecd3

SHA1
e296ab500772502c400058a660115848ca93810b

SHA256
24af9fb2d4312dff97a4fa24d3087bbfbee9e4242a7b1789414bdb7021eab38b

SHA512
82f93f2423d0dfe5f9772dca6298158d18e3b25f8b0f65d839d1a58e40bcd9fc4e12589da783da27eca8be05dfa168e48d590ee2f45a3ee8a90a189c330935d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
de1c84004d69ad1dcc613a2b2f7aecd3

SHA1
e296ab500772502c400058a660115848ca93810b

SHA256
24af9fb2d4312dff97a4fa24d3087bbfbee9e4242a7b1789414bdb7021eab38b

SHA512
82f93f2423d0dfe5f9772dca6298158d18e3b25f8b0f65d839d1a58e40bcd9fc4e12589da783da27eca8be05dfa168e48d590ee2f45a3ee8a90a189c330935d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
de1c84004d69ad1dcc613a2b2f7aecd3

SHA1
e296ab500772502c400058a660115848ca93810b

SHA256
24af9fb2d4312dff97a4fa24d3087bbfbee9e4242a7b1789414bdb7021eab38b

SHA512
82f93f2423d0dfe5f9772dca6298158d18e3b25f8b0f65d839d1a58e40bcd9fc4e12589da783da27eca8be05dfa168e48d590ee2f45a3ee8a90a189c330935d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
de1c84004d69ad1dcc613a2b2f7aecd3

SHA1
e296ab500772502c400058a660115848ca93810b

SHA256
24af9fb2d4312dff97a4fa24d3087bbfbee9e4242a7b1789414bdb7021eab38b

SHA512
82f93f2423d0dfe5f9772dca6298158d18e3b25f8b0f65d839d1a58e40bcd9fc4e12589da783da27eca8be05dfa168e48d590ee2f45a3ee8a90a189c330935d1

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1172-180-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-186-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-188-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-190-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-192-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-194-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-196-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-198-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-199-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/1172-200-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1172-202-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/1172-184-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-182-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-178-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-176-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-174-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-172-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-171-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/1172-170-0x00000000073A0000-0x0000000007944000-memory.dmp

Filesize
5.6MB

Download
memory/1172-169-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1172-168-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1172-167-0x0000000002BC0000-0x0000000002BED000-memory.dmp

Filesize
180KB

Download
memory/3132-220-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-1126-0x0000000008C20000-0x000000000914C000-memory.dmp

Filesize
5.2MB

Download
memory/3132-232-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-234-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-236-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-239-0x00000000047C0000-0x000000000480B000-memory.dmp

Filesize
300KB

Download
memory/3132-238-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-241-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-242-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-243-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-245-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-1117-0x0000000007860000-0x0000000007E78000-memory.dmp

Filesize
6.1MB

Download
memory/3132-1118-0x0000000007E80000-0x0000000007F8A000-memory.dmp

Filesize
1.0MB

Download
memory/3132-1119-0x0000000007280000-0x0000000007292000-memory.dmp

Filesize
72KB

Download
memory/3132-1120-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/3132-1121-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-1123-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/3132-1124-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/3132-1125-0x0000000008A40000-0x0000000008C02000-memory.dmp

Filesize
1.8MB

Download
memory/3132-230-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-1127-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-1128-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-1129-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/3132-1130-0x0000000009380000-0x00000000093F6000-memory.dmp

Filesize
472KB

Download
memory/3132-228-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-1131-0x0000000009410000-0x0000000009460000-memory.dmp

Filesize
320KB

Download
memory/3132-207-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-208-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-210-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-212-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-226-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-224-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-222-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-218-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-216-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3132-214-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/3760-161-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Filesize
40KB

Download
memory/4112-1139-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/4112-1138-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/4112-1137-0x0000000000C40000-0x0000000000C72000-memory.dmp

Filesize
200KB

Download