amadey | 14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe
Size

990KB
MD5

f3f862f455c622aeeb1efe9241f086c2
SHA1

fc8f0bae785897d829ef3e2cd54177e5d85db753
SHA256

14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4
SHA512

42ec4cc175c1bffa4e393262f4da4d22e6f93a40684f35964a725150849d429b96e5f71ad935e14255da07dad589918c09ac445b46cc37f3b3a7b68d3ad8969d
SSDEEP

24576:vyo7ft3W7om+mD8YbjbpBh5l+zUYmJUgvUFa:6ob47om+a8YbvlP+WUF

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz8976.exev0410tg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz8976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz8976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v0410tg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v0410tg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v0410tg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz8976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz8976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz8976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz8976.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v0410tg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v0410tg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v0410tg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1596-207-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-208-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-210-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-212-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-214-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-218-0x0000000007240000-0x0000000007250000-memory.dmp	family_redline
behavioral1/memory/1596-219-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-222-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-224-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-226-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-228-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-230-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-234-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-236-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-238-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-240-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-232-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-242-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline
behavioral1/memory/1596-244-0x0000000007140000-0x000000000717F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y26Ne06.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y26Ne06.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

Processes:

zap0742.exezap7339.exezap1885.exetz8976.exev0410tg.exew35xr11.exexBfFc25.exey26Ne06.exeoneetx.exeoneetx.exe

pid	process
4692	zap0742.exe
1916	zap7339.exe
4008	zap1885.exe
712	tz8976.exe
4260	v0410tg.exe
1596	w35xr11.exe
1948	xBfFc25.exe
3672	y26Ne06.exe
4240	oneetx.exe
1676	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2320 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2320	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz8976.exev0410tg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz8976.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v0410tg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v0410tg.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap1885.exe14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exezap0742.exezap7339.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1885.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap1885.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0742.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap0742.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap7339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap7339.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3464 4260 WerFault.exe v0410tg.exe
4632 1596 WerFault.exe w35xr11.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3080 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz8976.exev0410tg.exew35xr11.exexBfFc25.exe

pid process

712 tz8976.exe
712 tz8976.exe
4260 v0410tg.exe
4260 v0410tg.exe
1596 w35xr11.exe
1596 w35xr11.exe
1948 xBfFc25.exe
1948 xBfFc25.exe

pid	pid_target	process	target process
3464	4260	WerFault.exe	v0410tg.exe
4632	1596	WerFault.exe	w35xr11.exe

pid	process
3080	schtasks.exe

pid	process
712	tz8976.exe
712	tz8976.exe
4260	v0410tg.exe
4260	v0410tg.exe
1596	w35xr11.exe
1596	w35xr11.exe
1948	xBfFc25.exe
1948	xBfFc25.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz8976.exev0410tg.exew35xr11.exexBfFc25.exe

description	pid	process
Token: SeDebugPrivilege	712	tz8976.exe
Token: SeDebugPrivilege	4260	v0410tg.exe
Token: SeDebugPrivilege	1596	w35xr11.exe
Token: SeDebugPrivilege	1948	xBfFc25.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

y26Ne06.exe

pid process

3672 y26Ne06.exe

pid	process
3672	y26Ne06.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exezap0742.exezap7339.exezap1885.exey26Ne06.exeoneetx.execmd.exe

description	pid	process	target process
PID 2516 wrote to memory of 4692	2516	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe	zap0742.exe
PID 2516 wrote to memory of 4692	2516	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe	zap0742.exe
PID 2516 wrote to memory of 4692	2516	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe	zap0742.exe
PID 4692 wrote to memory of 1916	4692	zap0742.exe	zap7339.exe
PID 4692 wrote to memory of 1916	4692	zap0742.exe	zap7339.exe
PID 4692 wrote to memory of 1916	4692	zap0742.exe	zap7339.exe
PID 1916 wrote to memory of 4008	1916	zap7339.exe	zap1885.exe
PID 1916 wrote to memory of 4008	1916	zap7339.exe	zap1885.exe
PID 1916 wrote to memory of 4008	1916	zap7339.exe	zap1885.exe
PID 4008 wrote to memory of 712	4008	zap1885.exe	tz8976.exe
PID 4008 wrote to memory of 712	4008	zap1885.exe	tz8976.exe
PID 4008 wrote to memory of 4260	4008	zap1885.exe	v0410tg.exe
PID 4008 wrote to memory of 4260	4008	zap1885.exe	v0410tg.exe
PID 4008 wrote to memory of 4260	4008	zap1885.exe	v0410tg.exe
PID 1916 wrote to memory of 1596	1916	zap7339.exe	w35xr11.exe
PID 1916 wrote to memory of 1596	1916	zap7339.exe	w35xr11.exe
PID 1916 wrote to memory of 1596	1916	zap7339.exe	w35xr11.exe
PID 4692 wrote to memory of 1948	4692	zap0742.exe	xBfFc25.exe
PID 4692 wrote to memory of 1948	4692	zap0742.exe	xBfFc25.exe
PID 4692 wrote to memory of 1948	4692	zap0742.exe	xBfFc25.exe
PID 2516 wrote to memory of 3672	2516	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe	y26Ne06.exe
PID 2516 wrote to memory of 3672	2516	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe	y26Ne06.exe
PID 2516 wrote to memory of 3672	2516	14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe	y26Ne06.exe
PID 3672 wrote to memory of 4240	3672	y26Ne06.exe	oneetx.exe
PID 3672 wrote to memory of 4240	3672	y26Ne06.exe	oneetx.exe
PID 3672 wrote to memory of 4240	3672	y26Ne06.exe	oneetx.exe
PID 4240 wrote to memory of 3080	4240	oneetx.exe	schtasks.exe
PID 4240 wrote to memory of 3080	4240	oneetx.exe	schtasks.exe
PID 4240 wrote to memory of 3080	4240	oneetx.exe	schtasks.exe
PID 4240 wrote to memory of 1096	4240	oneetx.exe	cmd.exe
PID 4240 wrote to memory of 1096	4240	oneetx.exe	cmd.exe
PID 4240 wrote to memory of 1096	4240	oneetx.exe	cmd.exe
PID 1096 wrote to memory of 4068	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 4068	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 4068	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 5044	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5044	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5044	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5032	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5032	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5032	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 2100	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 2100	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 2100	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 4104	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 4104	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 4104	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 3044	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 3044	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 3044	1096	cmd.exe	cacls.exe
PID 4240 wrote to memory of 2320	4240	oneetx.exe	rundll32.exe
PID 4240 wrote to memory of 2320	4240	oneetx.exe	rundll32.exe
PID 4240 wrote to memory of 2320	4240	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe
"C:\Users\Admin\AppData\Local\Temp\14df2597f4a53158c5e75d74524a8f168d665c3ba5dbd8c0b0ffe561437796d4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2516

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0742.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0742.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4692

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7339.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7339.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1885.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1885.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4008

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8976.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8976.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0410tg.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0410tg.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 1080
6⤵
- Program crash
PID:3464

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35xr11.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35xr11.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1732
5⤵
- Program crash
PID:4632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBfFc25.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBfFc25.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y26Ne06.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y26Ne06.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:3080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4068

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:5044

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2100

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:N"
5⤵
PID:4104

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:R" /E
5⤵
PID:3044

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4260 -ip 4260
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1596 -ip 1596
1⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y26Ne06.exe
Filesize
236KB

MD5
7bd82f353b23fc060b6a6e5ec2314559

SHA1
59b4235396e3e4d84066e6d26e7cafc35b171d41

SHA256
d6b8f4ca2c90cfea62526867bff6369fecdad85039fd5e847ba336e9f002aa2e

SHA512
dd2a3674a4b9e9ba555eedd158570634e25cf4b9edeca5681db21066954e470159f876731f45bdaeb87d621daf61bc01aac26493a715b5f44c6736b1359a7d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y26Ne06.exe
Filesize
236KB

MD5
7bd82f353b23fc060b6a6e5ec2314559

SHA1
59b4235396e3e4d84066e6d26e7cafc35b171d41

SHA256
d6b8f4ca2c90cfea62526867bff6369fecdad85039fd5e847ba336e9f002aa2e

SHA512
dd2a3674a4b9e9ba555eedd158570634e25cf4b9edeca5681db21066954e470159f876731f45bdaeb87d621daf61bc01aac26493a715b5f44c6736b1359a7d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0742.exe
Filesize
808KB

MD5
24e01396ff4258bbddaad7e0d7abab4d

SHA1
3965fc4670dd8162ba2d7b3adff090865ebbf8f0

SHA256
18efa5347520f29497e8b6fe95146fc06db8ae4fcc92e189ce7839995fad0dd5

SHA512
0396a9eec29eda85f3e7010f5d0de2cfdaf83d7a711414cee72dec2747765ed55c8eaf1571f76a59f8f8f5d48884464a4b20ff58d409f924ada4b4f5e862fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0742.exe
Filesize
808KB

MD5
24e01396ff4258bbddaad7e0d7abab4d

SHA1
3965fc4670dd8162ba2d7b3adff090865ebbf8f0

SHA256
18efa5347520f29497e8b6fe95146fc06db8ae4fcc92e189ce7839995fad0dd5

SHA512
0396a9eec29eda85f3e7010f5d0de2cfdaf83d7a711414cee72dec2747765ed55c8eaf1571f76a59f8f8f5d48884464a4b20ff58d409f924ada4b4f5e862fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBfFc25.exe
Filesize
175KB

MD5
300f950600772f95615713691c6d6c29

SHA1
6f2d85720245710b1247cea75016b9999f099244

SHA256
8f1fb9a3fee0771e6b0de115fb97009080512cae9ed827bfa4584df466b9c8d0

SHA512
41c8d06a241a6c96825bd16427f65a4aecb79a8450fda4aceca21fe7eaf549ac43638fd439e81d03e9423317f226ea41a2180561a44480cc80de98489a278eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBfFc25.exe
Filesize
175KB

MD5
300f950600772f95615713691c6d6c29

SHA1
6f2d85720245710b1247cea75016b9999f099244

SHA256
8f1fb9a3fee0771e6b0de115fb97009080512cae9ed827bfa4584df466b9c8d0

SHA512
41c8d06a241a6c96825bd16427f65a4aecb79a8450fda4aceca21fe7eaf549ac43638fd439e81d03e9423317f226ea41a2180561a44480cc80de98489a278eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7339.exe
Filesize
665KB

MD5
95775d893840b324e0dd16e2d3f72621

SHA1
e3fa916ce495156a209223cc4ea27e4bf3188c8e

SHA256
17755b1ea1d83add8b65a37e2f8188e90565dd63d7311bdb43dc622edf75c680

SHA512
069c1e7dffdc63cfad41f83f725dfba08b5e36c8af8f5b4e2f1873dce791db6cc34fddf3a31a590a234917e136321388b0c721a1d4bf88f70aa829468d493901

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7339.exe
Filesize
665KB

MD5
95775d893840b324e0dd16e2d3f72621

SHA1
e3fa916ce495156a209223cc4ea27e4bf3188c8e

SHA256
17755b1ea1d83add8b65a37e2f8188e90565dd63d7311bdb43dc622edf75c680

SHA512
069c1e7dffdc63cfad41f83f725dfba08b5e36c8af8f5b4e2f1873dce791db6cc34fddf3a31a590a234917e136321388b0c721a1d4bf88f70aa829468d493901

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35xr11.exe
Filesize
342KB

MD5
eb9be22c785b170af7c2fa9e7ef28db5

SHA1
4cec639ed59e94de6f09858bfeb76caf37e881b8

SHA256
8b12201310f64b39ad6a8a4f3c8671346a553e12ab0907059545cc01411b481e

SHA512
6306fe04d2c897840d8df6c059cfa57bac9f993ca73e647b853239d6d72a6749c6c75d52442688cf81f9097df6b217add0ffc3e5c4a589e969b8f9bb05b6a490

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w35xr11.exe
Filesize
342KB

MD5
eb9be22c785b170af7c2fa9e7ef28db5

SHA1
4cec639ed59e94de6f09858bfeb76caf37e881b8

SHA256
8b12201310f64b39ad6a8a4f3c8671346a553e12ab0907059545cc01411b481e

SHA512
6306fe04d2c897840d8df6c059cfa57bac9f993ca73e647b853239d6d72a6749c6c75d52442688cf81f9097df6b217add0ffc3e5c4a589e969b8f9bb05b6a490

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1885.exe
Filesize
329KB

MD5
34a9a25284b663fea607a73068c9d175

SHA1
db94b64f09dae42405982ec8980c5ce0952b22bb

SHA256
6300e31848f10411d6566636582f07e2e27dc5092d144cb4a8fdf540db39dc8c

SHA512
c060d38f6190010fb8070702b6a6383ac4bd53aac1468c3899320faf7fbba4a7a032d067e5695bec1b29b253a1da5d44f626c7a50dba38447330d388a78d8a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1885.exe
Filesize
329KB

MD5
34a9a25284b663fea607a73068c9d175

SHA1
db94b64f09dae42405982ec8980c5ce0952b22bb

SHA256
6300e31848f10411d6566636582f07e2e27dc5092d144cb4a8fdf540db39dc8c

SHA512
c060d38f6190010fb8070702b6a6383ac4bd53aac1468c3899320faf7fbba4a7a032d067e5695bec1b29b253a1da5d44f626c7a50dba38447330d388a78d8a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8976.exe
Filesize
12KB

MD5
b6321554efa20532d4efcdae36cdf47c

SHA1
d15c9e6fe98bbcefb8c5d449a75337eaac0c2708

SHA256
08af48dfaf9ac2e7856ff2243c6d928ef1f10898f283444f71d23ccd406562f5

SHA512
113b5c729ebe3923220e1f87207006c2fab834bf5a8c5b3f9b9ab363ea588d47a80c5dc9f587db7cea98ecbc7aa2ca87a1cd693b2beea1b78766ecd26fc62685

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8976.exe
Filesize
12KB

MD5
b6321554efa20532d4efcdae36cdf47c

SHA1
d15c9e6fe98bbcefb8c5d449a75337eaac0c2708

SHA256
08af48dfaf9ac2e7856ff2243c6d928ef1f10898f283444f71d23ccd406562f5

SHA512
113b5c729ebe3923220e1f87207006c2fab834bf5a8c5b3f9b9ab363ea588d47a80c5dc9f587db7cea98ecbc7aa2ca87a1cd693b2beea1b78766ecd26fc62685

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0410tg.exe
Filesize
284KB

MD5
901cdcf59cbd21e7e178360bf3cbf477

SHA1
34b5f752ab2c1b059244a3547e671ecc9d0785d2

SHA256
44fb1ef3ad6c9658153e1f8c1e7661e22323a9a8ef403be9558079d1948bd8ca

SHA512
b82261fea8272df5f18ce67323141d5ced20cb0e67abbb3d80c0e9be8a11873ae09ee8a53906e396386f8d8fb52fbaae3d27939b626ec583958b24a6293fedfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0410tg.exe
Filesize
284KB

MD5
901cdcf59cbd21e7e178360bf3cbf477

SHA1
34b5f752ab2c1b059244a3547e671ecc9d0785d2

SHA256
44fb1ef3ad6c9658153e1f8c1e7661e22323a9a8ef403be9558079d1948bd8ca

SHA512
b82261fea8272df5f18ce67323141d5ced20cb0e67abbb3d80c0e9be8a11873ae09ee8a53906e396386f8d8fb52fbaae3d27939b626ec583958b24a6293fedfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7bd82f353b23fc060b6a6e5ec2314559

SHA1
59b4235396e3e4d84066e6d26e7cafc35b171d41

SHA256
d6b8f4ca2c90cfea62526867bff6369fecdad85039fd5e847ba336e9f002aa2e

SHA512
dd2a3674a4b9e9ba555eedd158570634e25cf4b9edeca5681db21066954e470159f876731f45bdaeb87d621daf61bc01aac26493a715b5f44c6736b1359a7d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7bd82f353b23fc060b6a6e5ec2314559

SHA1
59b4235396e3e4d84066e6d26e7cafc35b171d41

SHA256
d6b8f4ca2c90cfea62526867bff6369fecdad85039fd5e847ba336e9f002aa2e

SHA512
dd2a3674a4b9e9ba555eedd158570634e25cf4b9edeca5681db21066954e470159f876731f45bdaeb87d621daf61bc01aac26493a715b5f44c6736b1359a7d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7bd82f353b23fc060b6a6e5ec2314559

SHA1
59b4235396e3e4d84066e6d26e7cafc35b171d41

SHA256
d6b8f4ca2c90cfea62526867bff6369fecdad85039fd5e847ba336e9f002aa2e

SHA512
dd2a3674a4b9e9ba555eedd158570634e25cf4b9edeca5681db21066954e470159f876731f45bdaeb87d621daf61bc01aac26493a715b5f44c6736b1359a7d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7bd82f353b23fc060b6a6e5ec2314559

SHA1
59b4235396e3e4d84066e6d26e7cafc35b171d41

SHA256
d6b8f4ca2c90cfea62526867bff6369fecdad85039fd5e847ba336e9f002aa2e

SHA512
dd2a3674a4b9e9ba555eedd158570634e25cf4b9edeca5681db21066954e470159f876731f45bdaeb87d621daf61bc01aac26493a715b5f44c6736b1359a7d90

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/712-161-0x00000000007B0000-0x00000000007BA000-memory.dmp

Filesize
40KB

Download
memory/1596-1124-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/1596-244-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-1132-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-1131-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/1596-1130-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/1596-1129-0x0000000008FA0000-0x00000000094CC000-memory.dmp

Filesize
5.2MB

Download
memory/1596-1128-0x0000000008DC0000-0x0000000008F82000-memory.dmp

Filesize
1.8MB

Download
memory/1596-1127-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-1126-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-1125-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-207-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-208-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-210-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-212-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-215-0x0000000002D10000-0x0000000002D5B000-memory.dmp

Filesize
300KB

Download
memory/1596-214-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-218-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-219-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-220-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-217-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-222-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-224-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-226-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-228-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-230-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-234-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-236-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-238-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-240-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-232-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-242-0x0000000007140000-0x000000000717F000-memory.dmp

Filesize
252KB

Download
memory/1596-1123-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/1596-1117-0x0000000007900000-0x0000000007F18000-memory.dmp

Filesize
6.1MB

Download
memory/1596-1118-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/1596-1119-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/1596-1120-0x0000000007240000-0x0000000007250000-memory.dmp

Filesize
64KB

Download
memory/1596-1121-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1948-1138-0x0000000000F30000-0x0000000000F62000-memory.dmp

Filesize
200KB

Download
memory/1948-1139-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/4260-199-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/4260-202-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/4260-187-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-200-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/4260-193-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-198-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/4260-197-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-195-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-181-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-183-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-167-0x0000000007210000-0x00000000077B4000-memory.dmp

Filesize
5.6MB

Download
memory/4260-191-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-185-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-179-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-177-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-175-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-173-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-171-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-170-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4260-169-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/4260-168-0x0000000002E50000-0x0000000002E7D000-memory.dmp

Filesize
180KB

Download
memory/4260-189-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download