amadey | c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300

Analysis

max time kernel
125s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe
Size

993KB
MD5

39800653e718d48dfa891e5d086be966
SHA1

7a068dd7ae7f8ff1eb8745dd39524d554c672631
SHA256

c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300
SHA512

72141799f648ec2c86ba42e2b6f29494026dd1d16fda6a3d2d90e6c6e4be8266d93e5df7486aa8b7a838b0c6ecd8fffcc9e56a389fd5a72cf15746b9cd0a56a3
SSDEEP

24576:LyDqPQ+JhQFlhQ8exBevVEybh8J37wf+q50g:+DqP/hQFluxiN8J3k7a

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz4329.exev0059LU.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4329.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v0059LU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v0059LU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v0059LU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v0059LU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v0059LU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v0059LU.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4329.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3464-214-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-215-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-217-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-219-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-221-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-223-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-225-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-227-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-229-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-231-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-235-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-233-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-237-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-239-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-241-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-243-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-245-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline
behavioral1/memory/3464-247-0x0000000007130000-0x000000000716F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y81Il21.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	y81Il21.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 11 IoCs

Processes:

zap6218.exezap5551.exezap6843.exetz4329.exev0059LU.exew79Hu11.exexBWEB80.exey81Il21.exeoneetx.exeoneetx.exeoneetx.exe

pid	process
5024	zap6218.exe
2464	zap5551.exe
3284	zap6843.exe
4116	tz4329.exe
3784	v0059LU.exe
3464	w79Hu11.exe
4684	xBWEB80.exe
3148	y81Il21.exe
2208	oneetx.exe
4316	oneetx.exe
2556	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2340 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2340	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz4329.exev0059LU.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4329.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v0059LU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v0059LU.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap6218.exezap5551.exezap6843.exec4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap6218.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5551.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap5551.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6843.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap6843.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6218.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2064 3784 WerFault.exe v0059LU.exe
2896 3464 WerFault.exe w79Hu11.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4448 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz4329.exev0059LU.exew79Hu11.exexBWEB80.exe

pid process

4116 tz4329.exe
4116 tz4329.exe
3784 v0059LU.exe
3784 v0059LU.exe
3464 w79Hu11.exe
3464 w79Hu11.exe
4684 xBWEB80.exe
4684 xBWEB80.exe

pid	pid_target	process	target process
2064	3784	WerFault.exe	v0059LU.exe
2896	3464	WerFault.exe	w79Hu11.exe

pid	process
4448	schtasks.exe

pid	process
4116	tz4329.exe
4116	tz4329.exe
3784	v0059LU.exe
3784	v0059LU.exe
3464	w79Hu11.exe
3464	w79Hu11.exe
4684	xBWEB80.exe
4684	xBWEB80.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz4329.exev0059LU.exew79Hu11.exexBWEB80.exe

description	pid	process
Token: SeDebugPrivilege	4116	tz4329.exe
Token: SeDebugPrivilege	3784	v0059LU.exe
Token: SeDebugPrivilege	3464	w79Hu11.exe
Token: SeDebugPrivilege	4684	xBWEB80.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

y81Il21.exe

pid process

3148 y81Il21.exe

pid	process
3148	y81Il21.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exezap6218.exezap5551.exezap6843.exey81Il21.exeoneetx.execmd.exe

description	pid	process	target process
PID 3660 wrote to memory of 5024	3660	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe	zap6218.exe
PID 3660 wrote to memory of 5024	3660	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe	zap6218.exe
PID 3660 wrote to memory of 5024	3660	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe	zap6218.exe
PID 5024 wrote to memory of 2464	5024	zap6218.exe	zap5551.exe
PID 5024 wrote to memory of 2464	5024	zap6218.exe	zap5551.exe
PID 5024 wrote to memory of 2464	5024	zap6218.exe	zap5551.exe
PID 2464 wrote to memory of 3284	2464	zap5551.exe	zap6843.exe
PID 2464 wrote to memory of 3284	2464	zap5551.exe	zap6843.exe
PID 2464 wrote to memory of 3284	2464	zap5551.exe	zap6843.exe
PID 3284 wrote to memory of 4116	3284	zap6843.exe	tz4329.exe
PID 3284 wrote to memory of 4116	3284	zap6843.exe	tz4329.exe
PID 3284 wrote to memory of 3784	3284	zap6843.exe	v0059LU.exe
PID 3284 wrote to memory of 3784	3284	zap6843.exe	v0059LU.exe
PID 3284 wrote to memory of 3784	3284	zap6843.exe	v0059LU.exe
PID 2464 wrote to memory of 3464	2464	zap5551.exe	w79Hu11.exe
PID 2464 wrote to memory of 3464	2464	zap5551.exe	w79Hu11.exe
PID 2464 wrote to memory of 3464	2464	zap5551.exe	w79Hu11.exe
PID 5024 wrote to memory of 4684	5024	zap6218.exe	xBWEB80.exe
PID 5024 wrote to memory of 4684	5024	zap6218.exe	xBWEB80.exe
PID 5024 wrote to memory of 4684	5024	zap6218.exe	xBWEB80.exe
PID 3660 wrote to memory of 3148	3660	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe	y81Il21.exe
PID 3660 wrote to memory of 3148	3660	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe	y81Il21.exe
PID 3660 wrote to memory of 3148	3660	c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe	y81Il21.exe
PID 3148 wrote to memory of 2208	3148	y81Il21.exe	oneetx.exe
PID 3148 wrote to memory of 2208	3148	y81Il21.exe	oneetx.exe
PID 3148 wrote to memory of 2208	3148	y81Il21.exe	oneetx.exe
PID 2208 wrote to memory of 4448	2208	oneetx.exe	schtasks.exe
PID 2208 wrote to memory of 4448	2208	oneetx.exe	schtasks.exe
PID 2208 wrote to memory of 4448	2208	oneetx.exe	schtasks.exe
PID 2208 wrote to memory of 3388	2208	oneetx.exe	cmd.exe
PID 2208 wrote to memory of 3388	2208	oneetx.exe	cmd.exe
PID 2208 wrote to memory of 3388	2208	oneetx.exe	cmd.exe
PID 3388 wrote to memory of 3584	3388	cmd.exe	cmd.exe
PID 3388 wrote to memory of 3584	3388	cmd.exe	cmd.exe
PID 3388 wrote to memory of 3584	3388	cmd.exe	cmd.exe
PID 3388 wrote to memory of 3864	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 3864	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 3864	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 2012	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 2012	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 2012	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 368	3388	cmd.exe	cmd.exe
PID 3388 wrote to memory of 368	3388	cmd.exe	cmd.exe
PID 3388 wrote to memory of 368	3388	cmd.exe	cmd.exe
PID 3388 wrote to memory of 1784	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 1784	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 1784	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 232	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 232	3388	cmd.exe	cacls.exe
PID 3388 wrote to memory of 232	3388	cmd.exe	cacls.exe
PID 2208 wrote to memory of 2340	2208	oneetx.exe	rundll32.exe
PID 2208 wrote to memory of 2340	2208	oneetx.exe	rundll32.exe
PID 2208 wrote to memory of 2340	2208	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe
"C:\Users\Admin\AppData\Local\Temp\c4480c5871b70d40883df15b44572b44880d5cf6a399bcdbec51328f3313b300.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3660

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6218.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6218.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5551.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5551.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2464

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6843.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6843.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3284

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4329.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4329.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0059LU.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0059LU.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1080
6⤵
- Program crash
PID:2064

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79Hu11.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79Hu11.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1348
5⤵
- Program crash
PID:2896

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBWEB80.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBWEB80.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81Il21.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81Il21.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3148

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:4448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3584

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:3864

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:368

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:N"
5⤵
PID:1784

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:R" /E
5⤵
PID:232

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3784 -ip 3784
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3464 -ip 3464
1⤵
PID:3816

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:2556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81Il21.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81Il21.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6218.exe
Filesize
809KB

MD5
01c237babf0c0bc61f6ca7d5786b2ac0

SHA1
dc14267b52b8209b4d83e9d8c55f20154deed8c4

SHA256
44e09522086f94d7d98bc756cfdf1d7eb412bad33305249129ebca02ac05fd40

SHA512
dfa348e216cb067e4abc4efc0a033348dbd5c97e31202c10f810953159a39a994d1118a978efc2aab40e10e95855f8cee10aaec113e6c4f2cf31d51a5b31bbb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6218.exe
Filesize
809KB

MD5
01c237babf0c0bc61f6ca7d5786b2ac0

SHA1
dc14267b52b8209b4d83e9d8c55f20154deed8c4

SHA256
44e09522086f94d7d98bc756cfdf1d7eb412bad33305249129ebca02ac05fd40

SHA512
dfa348e216cb067e4abc4efc0a033348dbd5c97e31202c10f810953159a39a994d1118a978efc2aab40e10e95855f8cee10aaec113e6c4f2cf31d51a5b31bbb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBWEB80.exe
Filesize
175KB

MD5
928b1f652f70bfa29e50f77dc7559a70

SHA1
009127e770d9ff7377190a81275cef28dc8deb5d

SHA256
c06a4cb1e80cd628c6f2e1e6a6704978ac2f4cfff48165411695c81f3c14eafc

SHA512
e051ef6ca4fb594375cb44c7902fbcd13b4d56d14b79c3e28705435518825dd242d2a1bf1128db6e287dc431b8b33ed0bed5f792a94a7f4a549a69dee6b69773

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xBWEB80.exe
Filesize
175KB

MD5
928b1f652f70bfa29e50f77dc7559a70

SHA1
009127e770d9ff7377190a81275cef28dc8deb5d

SHA256
c06a4cb1e80cd628c6f2e1e6a6704978ac2f4cfff48165411695c81f3c14eafc

SHA512
e051ef6ca4fb594375cb44c7902fbcd13b4d56d14b79c3e28705435518825dd242d2a1bf1128db6e287dc431b8b33ed0bed5f792a94a7f4a549a69dee6b69773

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5551.exe
Filesize
666KB

MD5
9980d39ee78d0267551009b246af28d8

SHA1
8574aed68d347aeaa54147fda05e4a9a0b7d4bca

SHA256
497e36396c4da316fa78801323bd9cc0ceecddf083699d58251fd8335ca94fd5

SHA512
9aca1b303ae6e4c0d6a362154fe9614586bd463557475c5f215f89850b8d764cbe8b037b7eecbaa76dd70ea0e89586a9b7c6c20efb722eaae1502807e782bd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5551.exe
Filesize
666KB

MD5
9980d39ee78d0267551009b246af28d8

SHA1
8574aed68d347aeaa54147fda05e4a9a0b7d4bca

SHA256
497e36396c4da316fa78801323bd9cc0ceecddf083699d58251fd8335ca94fd5

SHA512
9aca1b303ae6e4c0d6a362154fe9614586bd463557475c5f215f89850b8d764cbe8b037b7eecbaa76dd70ea0e89586a9b7c6c20efb722eaae1502807e782bd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79Hu11.exe
Filesize
355KB

MD5
c085a9a9088b47ceefed9a6be8ec1f6b

SHA1
b72eea0331f634793990143237b180ac8a1e7d1a

SHA256
3308b85eead0ea29d28751f5f96dbf10e7fb1486140f145cfbff4f4a3126918a

SHA512
540c86a8dc9f3d2f5cab4640aa729495f0582860b7e524ff2f5a6cbdd361498421c64b7e26ce74fd2e7fe41cf7c1d86b3db118d888fc1ba0a1d712a165e64368

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79Hu11.exe
Filesize
355KB

MD5
c085a9a9088b47ceefed9a6be8ec1f6b

SHA1
b72eea0331f634793990143237b180ac8a1e7d1a

SHA256
3308b85eead0ea29d28751f5f96dbf10e7fb1486140f145cfbff4f4a3126918a

SHA512
540c86a8dc9f3d2f5cab4640aa729495f0582860b7e524ff2f5a6cbdd361498421c64b7e26ce74fd2e7fe41cf7c1d86b3db118d888fc1ba0a1d712a165e64368

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6843.exe
Filesize
329KB

MD5
732523efae6f1436dfba6fc7e6c1e4c7

SHA1
a7cad832ab1f7d7979fc50e15847768adeeb405c

SHA256
fb015c0ed6001ce826405a38a690216541c29eb198b15489d6a7ced6296680d9

SHA512
0028bbed28fc01078db9332e95c735b7a7876241f7a8541a8ac9184e885d3dca3f19be557c18b7d19328f942d64e62080f93dd32d5ee995a238ae86725bc35ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6843.exe
Filesize
329KB

MD5
732523efae6f1436dfba6fc7e6c1e4c7

SHA1
a7cad832ab1f7d7979fc50e15847768adeeb405c

SHA256
fb015c0ed6001ce826405a38a690216541c29eb198b15489d6a7ced6296680d9

SHA512
0028bbed28fc01078db9332e95c735b7a7876241f7a8541a8ac9184e885d3dca3f19be557c18b7d19328f942d64e62080f93dd32d5ee995a238ae86725bc35ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4329.exe
Filesize
12KB

MD5
5439cdbea1d9b33d7a59908dec2e3e56

SHA1
8ed52859077c0e55931a554e74a67a22e00877f2

SHA256
c8f6dbf3da261654ec68f1db0f8ec1744ee38917886889eda1b477a3aa1d6bbe

SHA512
ab128cf19944ce93fcbe872ebe6de8bdd3ff60bc5648100c21c6eed1cfd591badb6d6ae796c0c2b91f618d19c6c5671d7561bfcde2a1e7c5b0c2fc5eb503735d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4329.exe
Filesize
12KB

MD5
5439cdbea1d9b33d7a59908dec2e3e56

SHA1
8ed52859077c0e55931a554e74a67a22e00877f2

SHA256
c8f6dbf3da261654ec68f1db0f8ec1744ee38917886889eda1b477a3aa1d6bbe

SHA512
ab128cf19944ce93fcbe872ebe6de8bdd3ff60bc5648100c21c6eed1cfd591badb6d6ae796c0c2b91f618d19c6c5671d7561bfcde2a1e7c5b0c2fc5eb503735d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0059LU.exe
Filesize
296KB

MD5
78f9c3b6e3de10cb523c6c1a3cbdc9c9

SHA1
c10bd326544271198e9ac69fb5c5f1b0acc725cf

SHA256
65f3364f6bf5906b8e47633aae6b738c35a1000edcea76b2dac469c5bdd588ad

SHA512
adfc471e5df73732924f56c5bb74a681ff72870982390d56864d7184aba54cee656fa9980a0f02f2a49260bc9ddf047cdef98664cbf8e12de1a72bbec2b20282

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0059LU.exe
Filesize
296KB

MD5
78f9c3b6e3de10cb523c6c1a3cbdc9c9

SHA1
c10bd326544271198e9ac69fb5c5f1b0acc725cf

SHA256
65f3364f6bf5906b8e47633aae6b738c35a1000edcea76b2dac469c5bdd588ad

SHA512
adfc471e5df73732924f56c5bb74a681ff72870982390d56864d7184aba54cee656fa9980a0f02f2a49260bc9ddf047cdef98664cbf8e12de1a72bbec2b20282

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
ff99b2a3af6c9fd8e041f1d5738119f5

SHA1
63082650a0f7434eff08a7eea097265f1c0c93d7

SHA256
24bed3a23e28f049f488e163a21df813f5ab74dbe593f4469e3f14a23794fd1c

SHA512
4029192f6fbdbcd5b64050d63846f9eb59965cb30477eefc1dd5244a7bf8bec4971709541a37a3f2539da7f7b357d0c033a418e7f1d4ab8cebf8167adf1e3db4

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/3464-1127-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-245-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-1135-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/3464-1134-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/3464-1133-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-1132-0x0000000008E60000-0x000000000938C000-memory.dmp

Filesize
5.2MB

Download
memory/3464-1131-0x0000000008C80000-0x0000000008E42000-memory.dmp

Filesize
1.8MB

Download
memory/3464-1130-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/3464-1129-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/3464-1128-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-1126-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-1124-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-1123-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/3464-210-0x00000000047F0000-0x000000000483B000-memory.dmp

Filesize
300KB

Download
memory/3464-212-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-211-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-213-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3464-214-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-215-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-217-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-219-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-221-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-223-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-225-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-227-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-229-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-231-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-235-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-233-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-237-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-239-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-241-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-243-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-1122-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/3464-247-0x0000000007130000-0x000000000716F000-memory.dmp

Filesize
252KB

Download
memory/3464-1120-0x00000000078E0000-0x0000000007EF8000-memory.dmp

Filesize
6.1MB

Download
memory/3464-1121-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/3784-183-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-168-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3784-191-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-205-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/3784-187-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-204-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3784-203-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3784-201-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3784-200-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/3784-199-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3784-198-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3784-197-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-195-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-189-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-179-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-167-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

Filesize
180KB

Download
memory/3784-185-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-181-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-193-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-177-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-175-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-173-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-171-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-170-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/3784-169-0x0000000007240000-0x00000000077E4000-memory.dmp

Filesize
5.6MB

Download
memory/4116-161-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/4684-1143-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/4684-1142-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download