amadey | c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5

Analysis

max time kernel
129s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe
Size

990KB
MD5

8188484f3d3d032b4098e97fa2b8afbf
SHA1

4123099183baebd2b8e3d0ac3c77412ab50fed3e
SHA256

c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5
SHA512

69e69957fe26f6888821a2be1933f63d5690cadca65cc28e7ef82cda680e934e93197d7710fc45f6e20eecd3cf79dcc5490f011b8b3fec203d321179e2d3dda2
SSDEEP

12288:9Mryy90VUc+uPcKNj3/h1MwqRcOxPKW/IjzPf6K5rBD9ZgFntNNgrjoMZc3GpE:HyePHbE3KWGbd5PZyNg/vq

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v5288ks.exetz7981.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v5288ks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v5288ks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v5288ks.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz7981.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v5288ks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v5288ks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz7981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz7981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v5288ks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz7981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz7981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz7981.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3580-212-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-213-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-215-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-217-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-219-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-221-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-223-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-225-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-227-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-229-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-231-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-233-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-235-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-237-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-239-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-241-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-243-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline
behavioral1/memory/3580-245-0x0000000007150000-0x000000000718F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y47GU97.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	y47GU97.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

Processes:

zap3767.exezap1594.exezap5309.exetz7981.exev5288ks.exew18DQ21.exexEkHb28.exey47GU97.exeoneetx.exeoneetx.exe

pid	process
4592	zap3767.exe
1836	zap1594.exe
4452	zap5309.exe
1596	tz7981.exe
3620	v5288ks.exe
3580	w18DQ21.exe
2528	xEkHb28.exe
944	y47GU97.exe
2468	oneetx.exe
3980	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

668 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
668	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz7981.exev5288ks.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz7981.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v5288ks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v5288ks.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exezap3767.exezap1594.exezap5309.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3767.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3767.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1594.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1594.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5309.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap5309.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

892 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2776 3620 WerFault.exe v5288ks.exe
4992 3580 WerFault.exe w18DQ21.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1164 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz7981.exev5288ks.exew18DQ21.exexEkHb28.exe

pid process

1596 tz7981.exe
1596 tz7981.exe
3620 v5288ks.exe
3620 v5288ks.exe
3580 w18DQ21.exe
3580 w18DQ21.exe
2528 xEkHb28.exe
2528 xEkHb28.exe

pid	process
892	sc.exe

pid	pid_target	process	target process
2776	3620	WerFault.exe	v5288ks.exe
4992	3580	WerFault.exe	w18DQ21.exe

pid	process
1164	schtasks.exe

pid	process
1596	tz7981.exe
1596	tz7981.exe
3620	v5288ks.exe
3620	v5288ks.exe
3580	w18DQ21.exe
3580	w18DQ21.exe
2528	xEkHb28.exe
2528	xEkHb28.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz7981.exev5288ks.exew18DQ21.exexEkHb28.exe

description	pid	process
Token: SeDebugPrivilege	1596	tz7981.exe
Token: SeDebugPrivilege	3620	v5288ks.exe
Token: SeDebugPrivilege	3580	w18DQ21.exe
Token: SeDebugPrivilege	2528	xEkHb28.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

y47GU97.exe

pid process

944 y47GU97.exe

pid	process
944	y47GU97.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exezap3767.exezap1594.exezap5309.exey47GU97.exeoneetx.execmd.exe

description	pid	process	target process
PID 1220 wrote to memory of 4592	1220	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe	zap3767.exe
PID 1220 wrote to memory of 4592	1220	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe	zap3767.exe
PID 1220 wrote to memory of 4592	1220	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe	zap3767.exe
PID 4592 wrote to memory of 1836	4592	zap3767.exe	zap1594.exe
PID 4592 wrote to memory of 1836	4592	zap3767.exe	zap1594.exe
PID 4592 wrote to memory of 1836	4592	zap3767.exe	zap1594.exe
PID 1836 wrote to memory of 4452	1836	zap1594.exe	zap5309.exe
PID 1836 wrote to memory of 4452	1836	zap1594.exe	zap5309.exe
PID 1836 wrote to memory of 4452	1836	zap1594.exe	zap5309.exe
PID 4452 wrote to memory of 1596	4452	zap5309.exe	tz7981.exe
PID 4452 wrote to memory of 1596	4452	zap5309.exe	tz7981.exe
PID 4452 wrote to memory of 3620	4452	zap5309.exe	v5288ks.exe
PID 4452 wrote to memory of 3620	4452	zap5309.exe	v5288ks.exe
PID 4452 wrote to memory of 3620	4452	zap5309.exe	v5288ks.exe
PID 1836 wrote to memory of 3580	1836	zap1594.exe	w18DQ21.exe
PID 1836 wrote to memory of 3580	1836	zap1594.exe	w18DQ21.exe
PID 1836 wrote to memory of 3580	1836	zap1594.exe	w18DQ21.exe
PID 4592 wrote to memory of 2528	4592	zap3767.exe	xEkHb28.exe
PID 4592 wrote to memory of 2528	4592	zap3767.exe	xEkHb28.exe
PID 4592 wrote to memory of 2528	4592	zap3767.exe	xEkHb28.exe
PID 1220 wrote to memory of 944	1220	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe	y47GU97.exe
PID 1220 wrote to memory of 944	1220	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe	y47GU97.exe
PID 1220 wrote to memory of 944	1220	c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe	y47GU97.exe
PID 944 wrote to memory of 2468	944	y47GU97.exe	oneetx.exe
PID 944 wrote to memory of 2468	944	y47GU97.exe	oneetx.exe
PID 944 wrote to memory of 2468	944	y47GU97.exe	oneetx.exe
PID 2468 wrote to memory of 1164	2468	oneetx.exe	schtasks.exe
PID 2468 wrote to memory of 1164	2468	oneetx.exe	schtasks.exe
PID 2468 wrote to memory of 1164	2468	oneetx.exe	schtasks.exe
PID 2468 wrote to memory of 1248	2468	oneetx.exe	cmd.exe
PID 2468 wrote to memory of 1248	2468	oneetx.exe	cmd.exe
PID 2468 wrote to memory of 1248	2468	oneetx.exe	cmd.exe
PID 1248 wrote to memory of 4644	1248	cmd.exe	cmd.exe
PID 1248 wrote to memory of 4644	1248	cmd.exe	cmd.exe
PID 1248 wrote to memory of 4644	1248	cmd.exe	cmd.exe
PID 1248 wrote to memory of 5028	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 5028	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 5028	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3344	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3344	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3344	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3300	1248	cmd.exe	cmd.exe
PID 1248 wrote to memory of 3300	1248	cmd.exe	cmd.exe
PID 1248 wrote to memory of 3300	1248	cmd.exe	cmd.exe
PID 1248 wrote to memory of 2596	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 2596	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 2596	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3404	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3404	1248	cmd.exe	cacls.exe
PID 1248 wrote to memory of 3404	1248	cmd.exe	cacls.exe
PID 2468 wrote to memory of 668	2468	oneetx.exe	rundll32.exe
PID 2468 wrote to memory of 668	2468	oneetx.exe	rundll32.exe
PID 2468 wrote to memory of 668	2468	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe
"C:\Users\Admin\AppData\Local\Temp\c0d35ad814df036d2cadbf16624669b8dfe81eb55d889a2739882ba48090e0a5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3767.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3767.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4592

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1594.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1594.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5309.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5309.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7981.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7981.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5288ks.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5288ks.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 1080
6⤵
- Program crash
PID:2776

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18DQ21.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18DQ21.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 1376
5⤵
- Program crash
PID:4992

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEkHb28.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEkHb28.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47GU97.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47GU97.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:1164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4644

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:5028

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:3344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3300

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:N"
5⤵
PID:2596

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c5d2db5804" /P "Admin:R" /E
5⤵
PID:3404

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3620 -ip 3620
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3580 -ip 3580
1⤵
PID:3644

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47GU97.exe
Filesize
236KB

MD5
7b52e62c88aa2bb929231cdc176363fa

SHA1
7afc2fa05fa9e5faccc98ee9c597c984fde16200

SHA256
f08fd305c438ad19118fa5ef418c1ae8d0da34f6eab5dd1ae9e6027263aa32f0

SHA512
390b74a6afbd9bc4ac97ff00e47e8e13c2647bdc9db57e7570dc5f055d87cb8ff34e09dd1c62fcd2f5c8bb372d1727cad39a415550c27913ed6ea31f21f40118

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47GU97.exe
Filesize
236KB

MD5
7b52e62c88aa2bb929231cdc176363fa

SHA1
7afc2fa05fa9e5faccc98ee9c597c984fde16200

SHA256
f08fd305c438ad19118fa5ef418c1ae8d0da34f6eab5dd1ae9e6027263aa32f0

SHA512
390b74a6afbd9bc4ac97ff00e47e8e13c2647bdc9db57e7570dc5f055d87cb8ff34e09dd1c62fcd2f5c8bb372d1727cad39a415550c27913ed6ea31f21f40118

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3767.exe
Filesize
808KB

MD5
ae02ef8fc85ea20d782ffd84c1ceaeb8

SHA1
ed3b9e9e0615b12d67c712084197cce18d2b527d

SHA256
bfd5ae9bc209eae1095eafc3faa3f1cfb2d1dbe4e5952494755f9ec55c4264c8

SHA512
d6a7c285ce8b6e87f1d99d7ecc6f67b4ae230d2047e549be251ec65820019c172e6916d688660b4f47909c89658df013ad696d8d2e6cdeaa3a806bef6ce5accf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3767.exe
Filesize
808KB

MD5
ae02ef8fc85ea20d782ffd84c1ceaeb8

SHA1
ed3b9e9e0615b12d67c712084197cce18d2b527d

SHA256
bfd5ae9bc209eae1095eafc3faa3f1cfb2d1dbe4e5952494755f9ec55c4264c8

SHA512
d6a7c285ce8b6e87f1d99d7ecc6f67b4ae230d2047e549be251ec65820019c172e6916d688660b4f47909c89658df013ad696d8d2e6cdeaa3a806bef6ce5accf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEkHb28.exe
Filesize
175KB

MD5
ca0d0bdc54b9d4e74af76466509dceee

SHA1
550fa14c74f3f4377a81d3ef366bbb9869a85a7a

SHA256
720ae1ca3ea657b2523759e66b93325b5e4d2dc7447fc79b9a747c3e358499a7

SHA512
48d2850a767bd766e786104970046ea40bc4fac91aad930b6be51712ab1d4a958f2ee9420e1c8b95105cf490eb900a5812d4d55856795ab1de2e269f32d632d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xEkHb28.exe
Filesize
175KB

MD5
ca0d0bdc54b9d4e74af76466509dceee

SHA1
550fa14c74f3f4377a81d3ef366bbb9869a85a7a

SHA256
720ae1ca3ea657b2523759e66b93325b5e4d2dc7447fc79b9a747c3e358499a7

SHA512
48d2850a767bd766e786104970046ea40bc4fac91aad930b6be51712ab1d4a958f2ee9420e1c8b95105cf490eb900a5812d4d55856795ab1de2e269f32d632d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1594.exe
Filesize
666KB

MD5
33843516010791e559b43f017aecf3c1

SHA1
6800e4f710463928836363032d8f8d120951eecc

SHA256
5965792fe205e7704bb8e7bf082cdc96b18ccba93983e782050129e0291c0b2a

SHA512
740c915cd715fb6f29cf9b5812b2c30d257e1ddc07d4dfbef5459216dc73b3093f6ef926b02f7f5b75b4ed9bc09e7b070bc9f444e0d89300946efb25fe8323eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1594.exe
Filesize
666KB

MD5
33843516010791e559b43f017aecf3c1

SHA1
6800e4f710463928836363032d8f8d120951eecc

SHA256
5965792fe205e7704bb8e7bf082cdc96b18ccba93983e782050129e0291c0b2a

SHA512
740c915cd715fb6f29cf9b5812b2c30d257e1ddc07d4dfbef5459216dc73b3093f6ef926b02f7f5b75b4ed9bc09e7b070bc9f444e0d89300946efb25fe8323eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18DQ21.exe
Filesize
355KB

MD5
2776aa999704267a17a303fea3070dce

SHA1
49d42e63bab4117cb2a9a03eb80e53b14194b155

SHA256
65a7434be39c3cb93aab4f98d9659f81884acab2034d32103244eab75c675676

SHA512
f5dc5783b3e784b29e6f77b3ff467dfa8ecb613a6e8a36365924ed88c50c7cf4891fa9900fe4244a9302856227e8c27a709a3d60f6f2be0fda6b7030f7e92fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18DQ21.exe
Filesize
355KB

MD5
2776aa999704267a17a303fea3070dce

SHA1
49d42e63bab4117cb2a9a03eb80e53b14194b155

SHA256
65a7434be39c3cb93aab4f98d9659f81884acab2034d32103244eab75c675676

SHA512
f5dc5783b3e784b29e6f77b3ff467dfa8ecb613a6e8a36365924ed88c50c7cf4891fa9900fe4244a9302856227e8c27a709a3d60f6f2be0fda6b7030f7e92fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5309.exe
Filesize
330KB

MD5
2e80a48a6e55597abeec3baa73446c00

SHA1
72d14f4022c807f7342e0bef6c4558d72e3cca3a

SHA256
7e801e7f43a78992b06e15822738d606ed27440984bb0fcdc89e9fd8316829dd

SHA512
081954ff1836defa9804a6f5a3899432187da15c41530405d38dd2c581c7ebdf329cb10f10e9a1e9737720ce75e0fec2a9476fa737f11e5918d29fe15974e60f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5309.exe
Filesize
330KB

MD5
2e80a48a6e55597abeec3baa73446c00

SHA1
72d14f4022c807f7342e0bef6c4558d72e3cca3a

SHA256
7e801e7f43a78992b06e15822738d606ed27440984bb0fcdc89e9fd8316829dd

SHA512
081954ff1836defa9804a6f5a3899432187da15c41530405d38dd2c581c7ebdf329cb10f10e9a1e9737720ce75e0fec2a9476fa737f11e5918d29fe15974e60f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7981.exe
Filesize
12KB

MD5
21a0cc396b582b48b44076a049896226

SHA1
9a5f233be63c81d5faaa4daef24da3c9483304a2

SHA256
36cec915f12a7124e7190d37c1792063f0fac1d31e03339eb633c3fed680f9b5

SHA512
0d6fba8e6975841b767b36a5587f8221b1af7c4cd10f4d6b3a527e9ccf00f8f53a6d55b7d0ce474fecfb68ff22ca1e9ea6837476222f4504660077b17c714f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7981.exe
Filesize
12KB

MD5
21a0cc396b582b48b44076a049896226

SHA1
9a5f233be63c81d5faaa4daef24da3c9483304a2

SHA256
36cec915f12a7124e7190d37c1792063f0fac1d31e03339eb633c3fed680f9b5

SHA512
0d6fba8e6975841b767b36a5587f8221b1af7c4cd10f4d6b3a527e9ccf00f8f53a6d55b7d0ce474fecfb68ff22ca1e9ea6837476222f4504660077b17c714f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5288ks.exe
Filesize
284KB

MD5
14fd76de75d1bdbedf0d6ae75b9d94bc

SHA1
0719fd6832573d05e26dc8c69457fb194b985137

SHA256
d2b955a2d7f3f5b31c84f807853fb6937b52143988afb32ecb2a076f3b0bf0ba

SHA512
172c051e146e970b46c5788d2499839a3a10d1484f7c9e3645214c4507c2f99ac47b2c634d5f2a151b4c734f49bcc8b1e7c7875ed87f95c44fe90742d6c1dc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5288ks.exe
Filesize
284KB

MD5
14fd76de75d1bdbedf0d6ae75b9d94bc

SHA1
0719fd6832573d05e26dc8c69457fb194b985137

SHA256
d2b955a2d7f3f5b31c84f807853fb6937b52143988afb32ecb2a076f3b0bf0ba

SHA512
172c051e146e970b46c5788d2499839a3a10d1484f7c9e3645214c4507c2f99ac47b2c634d5f2a151b4c734f49bcc8b1e7c7875ed87f95c44fe90742d6c1dc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7b52e62c88aa2bb929231cdc176363fa

SHA1
7afc2fa05fa9e5faccc98ee9c597c984fde16200

SHA256
f08fd305c438ad19118fa5ef418c1ae8d0da34f6eab5dd1ae9e6027263aa32f0

SHA512
390b74a6afbd9bc4ac97ff00e47e8e13c2647bdc9db57e7570dc5f055d87cb8ff34e09dd1c62fcd2f5c8bb372d1727cad39a415550c27913ed6ea31f21f40118

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7b52e62c88aa2bb929231cdc176363fa

SHA1
7afc2fa05fa9e5faccc98ee9c597c984fde16200

SHA256
f08fd305c438ad19118fa5ef418c1ae8d0da34f6eab5dd1ae9e6027263aa32f0

SHA512
390b74a6afbd9bc4ac97ff00e47e8e13c2647bdc9db57e7570dc5f055d87cb8ff34e09dd1c62fcd2f5c8bb372d1727cad39a415550c27913ed6ea31f21f40118

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7b52e62c88aa2bb929231cdc176363fa

SHA1
7afc2fa05fa9e5faccc98ee9c597c984fde16200

SHA256
f08fd305c438ad19118fa5ef418c1ae8d0da34f6eab5dd1ae9e6027263aa32f0

SHA512
390b74a6afbd9bc4ac97ff00e47e8e13c2647bdc9db57e7570dc5f055d87cb8ff34e09dd1c62fcd2f5c8bb372d1727cad39a415550c27913ed6ea31f21f40118

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
Filesize
236KB

MD5
7b52e62c88aa2bb929231cdc176363fa

SHA1
7afc2fa05fa9e5faccc98ee9c597c984fde16200

SHA256
f08fd305c438ad19118fa5ef418c1ae8d0da34f6eab5dd1ae9e6027263aa32f0

SHA512
390b74a6afbd9bc4ac97ff00e47e8e13c2647bdc9db57e7570dc5f055d87cb8ff34e09dd1c62fcd2f5c8bb372d1727cad39a415550c27913ed6ea31f21f40118

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1596-161-0x0000000000A80000-0x0000000000A8A000-memory.dmp

Filesize
40KB

Download
memory/2528-1141-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/2528-1140-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/2528-1139-0x0000000000190000-0x00000000001C2000-memory.dmp

Filesize
200KB

Download
memory/3580-1127-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-245-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-1133-0x0000000008F70000-0x000000000949C000-memory.dmp

Filesize
5.2MB

Download
memory/3580-1132-0x0000000008DA0000-0x0000000008F62000-memory.dmp

Filesize
1.8MB

Download
memory/3580-1131-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-1130-0x0000000008D10000-0x0000000008D60000-memory.dmp

Filesize
320KB

Download
memory/3580-1129-0x0000000008C80000-0x0000000008CF6000-memory.dmp

Filesize
472KB

Download
memory/3580-1128-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-1126-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-209-0x00000000047E0000-0x000000000482B000-memory.dmp

Filesize
300KB

Download
memory/3580-210-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-211-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-212-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-213-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-215-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-217-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-219-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-221-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-223-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-225-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-227-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-229-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-231-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-233-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-235-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-237-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-239-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-241-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-243-0x0000000007150000-0x000000000718F000-memory.dmp

Filesize
252KB

Download
memory/3580-1125-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/3580-1118-0x00000000077F0000-0x0000000007E08000-memory.dmp

Filesize
6.1MB

Download
memory/3580-1119-0x0000000007E30000-0x0000000007F3A000-memory.dmp

Filesize
1.0MB

Download
memory/3580-1120-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/3580-1121-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/3580-1122-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/3580-1124-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/3620-183-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-169-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3620-191-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-195-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-204-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/3620-202-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3620-201-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3620-200-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/3620-199-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-189-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-167-0x0000000007270000-0x0000000007814000-memory.dmp

Filesize
5.6MB

Download
memory/3620-193-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-179-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-181-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-197-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-177-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-173-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-175-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-172-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-171-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3620-170-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/3620-185-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download
memory/3620-168-0x0000000002E00000-0x0000000002E2D000-memory.dmp

Filesize
180KB

Download
memory/3620-187-0x0000000004B90000-0x0000000004BA2000-memory.dmp

Filesize
72KB

Download