amadey | e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9

Analysis

max time kernel
142s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe
Size

992KB
MD5

aefe81e59ff1fd0c5f8af5b8cefdb4fb
SHA1

9ec5553f4779a2e1d18027cef4d086a5486930b9
SHA256

e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9
SHA512

23e6437ac6fbb0812f07e7495dbe53b5b4096487371d5cffd87599be6fcf5394c5a2fa339a5e6c6e8c00116e89391c800c8d93a5a06d6b7fdcb326eee47c5289
SSDEEP

24576:eygQk5OeVl/TkJz4/0eFwTZEeH2K9u3vKM2MUg4lHxO/QryWvnV:tJkn/u4/0eFwTM/FzUVhEMX

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz5037.exev8982kB.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz5037.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz5037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v8982kB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v8982kB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v8982kB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v8982kB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz5037.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz5037.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz5037.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz5037.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v8982kB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v8982kB.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/636-210-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-208-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-213-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-216-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-218-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-220-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-222-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-224-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-226-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-228-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-230-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-232-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-234-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-236-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-238-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-240-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-242-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-244-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/636-1125-0x00000000073A0000-0x00000000073B0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y02nd35.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	y02nd35.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 11 IoCs

Processes:

zap9254.exezap4516.exezap0398.exetz5037.exev8982kB.exew46px50.exexANCk42.exey02nd35.exeoneetx.exeoneetx.exeoneetx.exe

pid	process
4152	zap9254.exe
1372	zap4516.exe
2624	zap0398.exe
1592	tz5037.exe
1228	v8982kB.exe
636	w46px50.exe
3732	xANCk42.exe
3576	y02nd35.exe
4484	oneetx.exe
3000	oneetx.exe
3288	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2292 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2292	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz5037.exev8982kB.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz5037.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v8982kB.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v8982kB.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap9254.exezap4516.exezap0398.exee8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9254.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap4516.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap4516.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0398.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap0398.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1656 1228 WerFault.exe v8982kB.exe
3892 636 WerFault.exe w46px50.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5060 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz5037.exev8982kB.exew46px50.exexANCk42.exe

pid process

1592 tz5037.exe
1592 tz5037.exe
1228 v8982kB.exe
1228 v8982kB.exe
636 w46px50.exe
636 w46px50.exe
3732 xANCk42.exe
3732 xANCk42.exe

pid	pid_target	process	target process
1656	1228	WerFault.exe	v8982kB.exe
3892	636	WerFault.exe	w46px50.exe

pid	process
5060	schtasks.exe

pid	process
1592	tz5037.exe
1592	tz5037.exe
1228	v8982kB.exe
1228	v8982kB.exe
636	w46px50.exe
636	w46px50.exe
3732	xANCk42.exe
3732	xANCk42.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz5037.exev8982kB.exew46px50.exexANCk42.exe

description	pid	process
Token: SeDebugPrivilege	1592	tz5037.exe
Token: SeDebugPrivilege	1228	v8982kB.exe
Token: SeDebugPrivilege	636	w46px50.exe
Token: SeDebugPrivilege	3732	xANCk42.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

y02nd35.exe

pid process

3576 y02nd35.exe

pid	process
3576	y02nd35.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exezap9254.exezap4516.exezap0398.exey02nd35.exeoneetx.execmd.exe

description	pid	process	target process
PID 3996 wrote to memory of 4152	3996	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe	zap9254.exe
PID 3996 wrote to memory of 4152	3996	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe	zap9254.exe
PID 3996 wrote to memory of 4152	3996	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe	zap9254.exe
PID 4152 wrote to memory of 1372	4152	zap9254.exe	zap4516.exe
PID 4152 wrote to memory of 1372	4152	zap9254.exe	zap4516.exe
PID 4152 wrote to memory of 1372	4152	zap9254.exe	zap4516.exe
PID 1372 wrote to memory of 2624	1372	zap4516.exe	zap0398.exe
PID 1372 wrote to memory of 2624	1372	zap4516.exe	zap0398.exe
PID 1372 wrote to memory of 2624	1372	zap4516.exe	zap0398.exe
PID 2624 wrote to memory of 1592	2624	zap0398.exe	tz5037.exe
PID 2624 wrote to memory of 1592	2624	zap0398.exe	tz5037.exe
PID 2624 wrote to memory of 1228	2624	zap0398.exe	v8982kB.exe
PID 2624 wrote to memory of 1228	2624	zap0398.exe	v8982kB.exe
PID 2624 wrote to memory of 1228	2624	zap0398.exe	v8982kB.exe
PID 1372 wrote to memory of 636	1372	zap4516.exe	w46px50.exe
PID 1372 wrote to memory of 636	1372	zap4516.exe	w46px50.exe
PID 1372 wrote to memory of 636	1372	zap4516.exe	w46px50.exe
PID 4152 wrote to memory of 3732	4152	zap9254.exe	xANCk42.exe
PID 4152 wrote to memory of 3732	4152	zap9254.exe	xANCk42.exe
PID 4152 wrote to memory of 3732	4152	zap9254.exe	xANCk42.exe
PID 3996 wrote to memory of 3576	3996	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe	y02nd35.exe
PID 3996 wrote to memory of 3576	3996	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe	y02nd35.exe
PID 3996 wrote to memory of 3576	3996	e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe	y02nd35.exe
PID 3576 wrote to memory of 4484	3576	y02nd35.exe	oneetx.exe
PID 3576 wrote to memory of 4484	3576	y02nd35.exe	oneetx.exe
PID 3576 wrote to memory of 4484	3576	y02nd35.exe	oneetx.exe
PID 4484 wrote to memory of 5060	4484	oneetx.exe	schtasks.exe
PID 4484 wrote to memory of 5060	4484	oneetx.exe	schtasks.exe
PID 4484 wrote to memory of 5060	4484	oneetx.exe	schtasks.exe
PID 4484 wrote to memory of 4144	4484	oneetx.exe	cmd.exe
PID 4484 wrote to memory of 4144	4484	oneetx.exe	cmd.exe
PID 4484 wrote to memory of 4144	4484	oneetx.exe	cmd.exe
PID 4144 wrote to memory of 4076	4144	cmd.exe	cmd.exe
PID 4144 wrote to memory of 4076	4144	cmd.exe	cmd.exe
PID 4144 wrote to memory of 4076	4144	cmd.exe	cmd.exe
PID 4144 wrote to memory of 2224	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 2224	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 2224	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 400	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 400	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 400	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 3688	4144	cmd.exe	cmd.exe
PID 4144 wrote to memory of 3688	4144	cmd.exe	cmd.exe
PID 4144 wrote to memory of 3688	4144	cmd.exe	cmd.exe
PID 4144 wrote to memory of 3808	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 3808	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 3808	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 2768	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 2768	4144	cmd.exe	cacls.exe
PID 4144 wrote to memory of 2768	4144	cmd.exe	cacls.exe
PID 4484 wrote to memory of 2292	4484	oneetx.exe	rundll32.exe
PID 4484 wrote to memory of 2292	4484	oneetx.exe	rundll32.exe
PID 4484 wrote to memory of 2292	4484	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe
"C:\Users\Admin\AppData\Local\Temp\e8cd33b9b2d6594e3ff45b1d61e75f62f5ed8edb4929ab64c0a151eeb7e61dc9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3996

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9254.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9254.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4516.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4516.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0398.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0398.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5037.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5037.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8982kB.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8982kB.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1080
6⤵
- Program crash
PID:1656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46px50.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46px50.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1472
5⤵
- Program crash
PID:3892

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xANCk42.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xANCk42.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02nd35.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02nd35.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:5060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4076

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:2224

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3688

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:N"
5⤵
PID:3808

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:R" /E
5⤵
PID:2768

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1228 -ip 1228
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 636 -ip 636
1⤵
PID:2392

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:3288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02nd35.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02nd35.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9254.exe
Filesize
808KB

MD5
1786c3487606c5ec217b7f66a468c4c6

SHA1
64477cfc47650722756de197e669ee0378216726

SHA256
8e41cb7d80407f576aa3ccdfe4480eccf929ec4e714cb319cf2deb59e49efc3f

SHA512
c4f6a164a1072d5e8464d0bcdb72481b350198881a1f6755d40c70daf9c20acd4d621999be628431031783ce852046e347169b0ac67c0b15075f80b5f2215a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9254.exe
Filesize
808KB

MD5
1786c3487606c5ec217b7f66a468c4c6

SHA1
64477cfc47650722756de197e669ee0378216726

SHA256
8e41cb7d80407f576aa3ccdfe4480eccf929ec4e714cb319cf2deb59e49efc3f

SHA512
c4f6a164a1072d5e8464d0bcdb72481b350198881a1f6755d40c70daf9c20acd4d621999be628431031783ce852046e347169b0ac67c0b15075f80b5f2215a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xANCk42.exe
Filesize
175KB

MD5
ec5349866d540724f6d8d6b066923087

SHA1
9428cad0f2c6b087074013f85f720cc456fd8478

SHA256
36de17fd8292251d382b7a610df65c78de4e7337a7ca498610203446d8083ddb

SHA512
272017eaf0c4649275694d1a5c7714897b7f752875fb50da0e8f71a05c84b913ce7d73c6fc6f5c3d62c2a563a58fb25758140dea5045675e517eb07fc496e34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xANCk42.exe
Filesize
175KB

MD5
ec5349866d540724f6d8d6b066923087

SHA1
9428cad0f2c6b087074013f85f720cc456fd8478

SHA256
36de17fd8292251d382b7a610df65c78de4e7337a7ca498610203446d8083ddb

SHA512
272017eaf0c4649275694d1a5c7714897b7f752875fb50da0e8f71a05c84b913ce7d73c6fc6f5c3d62c2a563a58fb25758140dea5045675e517eb07fc496e34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4516.exe
Filesize
666KB

MD5
f2cf63686ee5a21aa071d8fe93d22fc5

SHA1
ee0dc79746a093c89781ea98d82d4aaccff20980

SHA256
f8bfd53d5a2db71f286c38dff444483105fcba066d4cd68820c04e2cdfc10ff1

SHA512
24264c61d224106ee83368543f3a9f6c48bddff2b7bcb98dc462924a012cb6e7de8001f0d942a2a152afc86a058b611a96f366c5003421efd99fa7b7fb768ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap4516.exe
Filesize
666KB

MD5
f2cf63686ee5a21aa071d8fe93d22fc5

SHA1
ee0dc79746a093c89781ea98d82d4aaccff20980

SHA256
f8bfd53d5a2db71f286c38dff444483105fcba066d4cd68820c04e2cdfc10ff1

SHA512
24264c61d224106ee83368543f3a9f6c48bddff2b7bcb98dc462924a012cb6e7de8001f0d942a2a152afc86a058b611a96f366c5003421efd99fa7b7fb768ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46px50.exe
Filesize
355KB

MD5
afd6251b4f806be8b95edbeb38130273

SHA1
323dda747e708779d8b7e36b021826d6983c6b51

SHA256
c3574a376e278842b5038f564e79ba8121c0ffd5928d00b2c0bcf64155641e10

SHA512
8aa98fb5d3d3e5ce20ba741e00f5499c8de342a089bbc0e43dd0c34a501ca36b7ed5188893d2ee6e400449a648efad1584b078f1ca871acf39134d7564fc5efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46px50.exe
Filesize
355KB

MD5
afd6251b4f806be8b95edbeb38130273

SHA1
323dda747e708779d8b7e36b021826d6983c6b51

SHA256
c3574a376e278842b5038f564e79ba8121c0ffd5928d00b2c0bcf64155641e10

SHA512
8aa98fb5d3d3e5ce20ba741e00f5499c8de342a089bbc0e43dd0c34a501ca36b7ed5188893d2ee6e400449a648efad1584b078f1ca871acf39134d7564fc5efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0398.exe
Filesize
329KB

MD5
c394da7a2f104fad98a2c843e4867c95

SHA1
82d1c406d1effc1af61024a5ed1eef322c884602

SHA256
e4c6eff234ad013d8d31b7cf5ccac49316e05ae36b9ca825a46f3a6943032912

SHA512
81a36fcb71505efa159c2796ffa1e379768faf51c3f1814f1735f37175115089a858837490886f890cdfdc786b332a7a6248427be55e4b35c489c9ea3b1d3df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0398.exe
Filesize
329KB

MD5
c394da7a2f104fad98a2c843e4867c95

SHA1
82d1c406d1effc1af61024a5ed1eef322c884602

SHA256
e4c6eff234ad013d8d31b7cf5ccac49316e05ae36b9ca825a46f3a6943032912

SHA512
81a36fcb71505efa159c2796ffa1e379768faf51c3f1814f1735f37175115089a858837490886f890cdfdc786b332a7a6248427be55e4b35c489c9ea3b1d3df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5037.exe
Filesize
12KB

MD5
1f777e8e9e6ec5577212882e33f34c5f

SHA1
b7fb11eda76b11d1d28459b4d364b31e15c27273

SHA256
b684bb2b56adcb87b0d556bee5fbd673399cd5fc5d68b5a3d12a56d590c0a233

SHA512
0e53c5f2ee9841136d6a180ac73172457a3ace0e64b1b0ef0a0a0e2aa7109818e152a43cfef3612cfa3a7b8daf6c76d60982d6dddd2248f973023ba5660f3a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5037.exe
Filesize
12KB

MD5
1f777e8e9e6ec5577212882e33f34c5f

SHA1
b7fb11eda76b11d1d28459b4d364b31e15c27273

SHA256
b684bb2b56adcb87b0d556bee5fbd673399cd5fc5d68b5a3d12a56d590c0a233

SHA512
0e53c5f2ee9841136d6a180ac73172457a3ace0e64b1b0ef0a0a0e2aa7109818e152a43cfef3612cfa3a7b8daf6c76d60982d6dddd2248f973023ba5660f3a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8982kB.exe
Filesize
284KB

MD5
4bf65de57940707c084aa7504eba82b4

SHA1
a6f3ef44bbf2a8fed61779df1a9b49f7ed7158ff

SHA256
7cb213af66d063c76f2b675a5002a362c4d39b3be9d3bb27d1dc1e1386436d86

SHA512
3fda6ff83e494ee8c2e724957a0c82c76dff240f445c4bf8407af458edc8baa3aba510712d3fb8b29047f105528e49631ae409f7bf81e03499f3b5e7b2160555

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8982kB.exe
Filesize
284KB

MD5
4bf65de57940707c084aa7504eba82b4

SHA1
a6f3ef44bbf2a8fed61779df1a9b49f7ed7158ff

SHA256
7cb213af66d063c76f2b675a5002a362c4d39b3be9d3bb27d1dc1e1386436d86

SHA512
3fda6ff83e494ee8c2e724957a0c82c76dff240f445c4bf8407af458edc8baa3aba510712d3fb8b29047f105528e49631ae409f7bf81e03499f3b5e7b2160555

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
af1b6854569dffbdccd6e7dae7432708

SHA1
e4fc7bc772d3aaf3090ab27e04440555d1413c27

SHA256
99b1d71c1ce13ec6c3334e1f0616afa12cda0aadfb33292fe663acbb64ea7d2a

SHA512
2179b578e6feb749355845394442d1e242457ac826b4e2ab178c8982bdc8a1567bfc6d51cd2512f6c00121a69ad0b518a4a7d9ef440be56624dfd38f1fa1dc1d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/636-1124-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-244-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-1132-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/636-1131-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/636-1130-0x0000000008FA0000-0x00000000094CC000-memory.dmp

Filesize
5.2MB

Download
memory/636-1129-0x0000000008DD0000-0x0000000008F92000-memory.dmp

Filesize
1.8MB

Download
memory/636-1128-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-1127-0x0000000008A90000-0x0000000008B22000-memory.dmp

Filesize
584KB

Download
memory/636-1126-0x00000000083C0000-0x0000000008426000-memory.dmp

Filesize
408KB

Download
memory/636-1125-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-209-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-210-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-208-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-207-0x0000000002C50000-0x0000000002C9B000-memory.dmp

Filesize
300KB

Download
memory/636-211-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-213-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-214-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-216-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-218-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-220-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-222-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-224-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-226-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-228-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-230-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-232-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-234-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-236-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-238-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-240-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-242-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/636-1123-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-1117-0x0000000007960000-0x0000000007F78000-memory.dmp

Filesize
6.1MB

Download
memory/636-1118-0x0000000007F80000-0x000000000808A000-memory.dmp

Filesize
1.0MB

Download
memory/636-1119-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/636-1120-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/636-1121-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1228-172-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-202-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/1228-167-0x0000000002CF0000-0x0000000002D1D000-memory.dmp

Filesize
180KB

Download
memory/1228-190-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-168-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/1228-200-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/1228-199-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/1228-178-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-196-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-194-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-184-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-182-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-188-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-186-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-198-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-180-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-176-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-174-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-192-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-171-0x00000000070E0000-0x00000000070F2000-memory.dmp

Filesize
72KB

Download
memory/1228-170-0x00000000071F0000-0x0000000007794000-memory.dmp

Filesize
5.6MB

Download
memory/1228-169-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/1592-161-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/3732-1140-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/3732-1139-0x0000000000800000-0x0000000000832000-memory.dmp

Filesize
200KB

Download