amadey | 29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2023, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe
Size

925KB
MD5

42970d83678a8e9126606938cc540a0d
SHA1

b22a7f75a93ca56613048e430fefbac860947231
SHA256

29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61
SHA512

d90d60237250afd0d2f9cb880b00459908836593681e8d75dc25772915ea8da93492524d1294fe1e935198ff32bfd6deb102087f8c22c1a249902fe8de646dbf
SSDEEP

24576:Tyy4E0G8nt6CWz4OEydpGddIMPyr9o+ow:myUpizZnG8a

Score

10^/10

amadey redline nahui rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

176.113.115.145:4125

Attributes

auth_value
b9ed10946d21e28d58d0c72c535cde6f

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr175956.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr175956.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr175956.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr175956.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr175956.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr175956.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral1/memory/2256-202-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-203-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-205-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-207-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-209-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-211-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-213-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-215-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-217-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-219-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-221-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-223-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-225-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-227-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-229-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-231-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-233-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline
behavioral1/memory/2256-235-0x0000000002520000-0x000000000255F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	si101180.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
4308	un558836.exe
632	un597174.exe
1492	pr175956.exe
2256	qu155570.exe
2284	rk503899.exe
4444	si101180.exe
1328	oneetx.exe
3328	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2084	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr175956.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr175956.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un558836.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un597174.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un597174.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un558836.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
3376	1492	WerFault.exe	86
4632	2256	WerFault.exe	89
4088	4444	WerFault.exe	94
3456	4444	WerFault.exe	94
3880	4444	WerFault.exe	94
5076	4444	WerFault.exe	94
4616	4444	WerFault.exe	94
2660	4444	WerFault.exe	94
3088	4444	WerFault.exe	94
4484	4444	WerFault.exe	94
5060	4444	WerFault.exe	94
2116	4444	WerFault.exe	94
4292	1328	WerFault.exe	113
3396	1328	WerFault.exe	113
2504	1328	WerFault.exe	113
3068	1328	WerFault.exe	113
228	1328	WerFault.exe	113
2044	1328	WerFault.exe	113
60	1328	WerFault.exe	113
4560	1328	WerFault.exe	113
1092	1328	WerFault.exe	113
4828	1328	WerFault.exe	113
4328	1328	WerFault.exe	113
4192	1328	WerFault.exe	113
3084	3328	WerFault.exe	142
4872	1328	WerFault.exe	113
4124	1328	WerFault.exe	113
3772	1328	WerFault.exe	113

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1492	pr175956.exe
1492	pr175956.exe
2256	qu155570.exe
2256	qu155570.exe
2284	rk503899.exe
2284	rk503899.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	pr175956.exe
Token: SeDebugPrivilege	2256	qu155570.exe
Token: SeDebugPrivilege	2284	rk503899.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4444	si101180.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4308	4372	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe	84
PID 4372 wrote to memory of 4308	4372	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe	84
PID 4372 wrote to memory of 4308	4372	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe	84
PID 4308 wrote to memory of 632	4308	un558836.exe	85
PID 4308 wrote to memory of 632	4308	un558836.exe	85
PID 4308 wrote to memory of 632	4308	un558836.exe	85
PID 632 wrote to memory of 1492	632	un597174.exe	86
PID 632 wrote to memory of 1492	632	un597174.exe	86
PID 632 wrote to memory of 1492	632	un597174.exe	86
PID 632 wrote to memory of 2256	632	un597174.exe	89
PID 632 wrote to memory of 2256	632	un597174.exe	89
PID 632 wrote to memory of 2256	632	un597174.exe	89
PID 4308 wrote to memory of 2284	4308	un558836.exe	93
PID 4308 wrote to memory of 2284	4308	un558836.exe	93
PID 4308 wrote to memory of 2284	4308	un558836.exe	93
PID 4372 wrote to memory of 4444	4372	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe	94
PID 4372 wrote to memory of 4444	4372	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe	94
PID 4372 wrote to memory of 4444	4372	29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe	94
PID 4444 wrote to memory of 1328	4444	si101180.exe	113
PID 4444 wrote to memory of 1328	4444	si101180.exe	113
PID 4444 wrote to memory of 1328	4444	si101180.exe	113
PID 1328 wrote to memory of 4452	1328	oneetx.exe	130
PID 1328 wrote to memory of 4452	1328	oneetx.exe	130
PID 1328 wrote to memory of 4452	1328	oneetx.exe	130
PID 1328 wrote to memory of 2084	1328	oneetx.exe	147
PID 1328 wrote to memory of 2084	1328	oneetx.exe	147
PID 1328 wrote to memory of 2084	1328	oneetx.exe	147

C:\Users\Admin\AppData\Local\Temp\29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe
"C:\Users\Admin\AppData\Local\Temp\29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un558836.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un558836.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un597174.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un597174.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175956.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175956.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1492
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1088
        5⤵
        Program crash
        
        PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu155570.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu155570.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1348
        5⤵
        Program crash
        
        PID:4632
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk503899.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk503899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si101180.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si101180.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 696
    3⤵
    - Program crash
    PID:4088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 780
    3⤵
    - Program crash
    PID:3456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 796
    3⤵
    - Program crash
    PID:3880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 952
    3⤵
    - Program crash
    PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 984
    3⤵
    - Program crash
    PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 984
    3⤵
    - Program crash
    PID:2660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1208
    3⤵
    - Program crash
    PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1228
    3⤵
    - Program crash
    PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1316
    3⤵
    - Program crash
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 692
      4⤵
      Program crash
      PID:4292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 724
      4⤵
      Program crash
      PID:3396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 892
      4⤵
      Program crash
      PID:2504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1052
      4⤵
      Program crash
      PID:3068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1060
      4⤵
      Program crash
      PID:228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1060
      4⤵
      Program crash
      PID:2044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1120
      4⤵
      Program crash
      PID:60
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 992
      4⤵
      Program crash
      PID:4560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 784
      4⤵
      Program crash
      PID:1092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 888
      4⤵
      Program crash
      PID:4828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 692
      4⤵
      Program crash
      PID:4328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1104
      4⤵
      Program crash
      PID:4192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1660
      4⤵
      Program crash
      PID:4872
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1148
      4⤵
      Program crash
      PID:4124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1676
      4⤵
      Program crash
      PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1376
    3⤵
    - Program crash
    PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1492 -ip 1492
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2256 -ip 2256
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4444 -ip 4444
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4444 -ip 4444
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4444 -ip 4444
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4444 -ip 4444
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4444 -ip 4444
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4444 -ip 4444
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4444 -ip 4444
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4444 -ip 4444
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4444 -ip 4444
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4444 -ip 4444
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1328 -ip 1328
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1328 -ip 1328
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1328 -ip 1328
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1328 -ip 1328
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1328 -ip 1328
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1328 -ip 1328
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1328 -ip 1328
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1328 -ip 1328
1⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1328 -ip 1328
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1328 -ip 1328
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1328 -ip 1328
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1328 -ip 1328
1⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 316
  2⤵
  - Program crash
  PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3328 -ip 3328
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1328 -ip 1328
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1328 -ip 1328
1⤵
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1328 -ip 1328
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
6300508e058abec227185450c3c9547c

SHA1
41910122c84dcbdb2efa6c91378ce68731819d07

SHA256
ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c

SHA512
2216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
6300508e058abec227185450c3c9547c

SHA1
41910122c84dcbdb2efa6c91378ce68731819d07

SHA256
ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c

SHA512
2216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
6300508e058abec227185450c3c9547c

SHA1
41910122c84dcbdb2efa6c91378ce68731819d07

SHA256
ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c

SHA512
2216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
6300508e058abec227185450c3c9547c

SHA1
41910122c84dcbdb2efa6c91378ce68731819d07

SHA256
ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c

SHA512
2216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si101180.exe

Filesize
230KB

MD5
6300508e058abec227185450c3c9547c

SHA1
41910122c84dcbdb2efa6c91378ce68731819d07

SHA256
ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c

SHA512
2216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si101180.exe

Filesize
230KB

MD5
6300508e058abec227185450c3c9547c

SHA1
41910122c84dcbdb2efa6c91378ce68731819d07

SHA256
ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c

SHA512
2216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un558836.exe

Filesize
660KB

MD5
582adbf115967ad07b9987c5c3c5854d

SHA1
090982d4999e8b3f4fd3511d74d27c630cd41c5b

SHA256
45b7e49f62e249f6b213acca564d239c863791c2e181e9d1254fc6d6514e9630

SHA512
6d83c8afe7a1b7153fa38a1efa6e1b44337d6e288e622b3218be184ba290f04ec5d7a81846e9e22fb962afd2a33c11e6b6142a9a2931cf18c7d33777386d3458

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un558836.exe

Filesize
660KB

MD5
582adbf115967ad07b9987c5c3c5854d

SHA1
090982d4999e8b3f4fd3511d74d27c630cd41c5b

SHA256
45b7e49f62e249f6b213acca564d239c863791c2e181e9d1254fc6d6514e9630

SHA512
6d83c8afe7a1b7153fa38a1efa6e1b44337d6e288e622b3218be184ba290f04ec5d7a81846e9e22fb962afd2a33c11e6b6142a9a2931cf18c7d33777386d3458

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk503899.exe

Filesize
175KB

MD5
b2e599dec0856d70ebb2ab2327ae6442

SHA1
300323436b47ddafa78cb7e835deb1ab09f13698

SHA256
b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

SHA512
c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk503899.exe

Filesize
175KB

MD5
b2e599dec0856d70ebb2ab2327ae6442

SHA1
300323436b47ddafa78cb7e835deb1ab09f13698

SHA256
b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

SHA512
c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un597174.exe

Filesize
518KB

MD5
d78cc6f7995b354650eb453377828fcc

SHA1
618d208b465c1476c32193a74b8ae47777c7a8df

SHA256
475825110d158b5505586cfcc9dfb3d11b5c210bde4e3c408904c632497bb75d

SHA512
d990ba3c6b8e2894618da3c2dfccd652f65d3810b6a99fe3fc780e118d270193646aecc05dac872617b69ef099cf9485167c0efc3f8c99f79eea767565ef64c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un597174.exe

Filesize
518KB

MD5
d78cc6f7995b354650eb453377828fcc

SHA1
618d208b465c1476c32193a74b8ae47777c7a8df

SHA256
475825110d158b5505586cfcc9dfb3d11b5c210bde4e3c408904c632497bb75d

SHA512
d990ba3c6b8e2894618da3c2dfccd652f65d3810b6a99fe3fc780e118d270193646aecc05dac872617b69ef099cf9485167c0efc3f8c99f79eea767565ef64c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175956.exe

Filesize
238KB

MD5
7a1f12177564299f21b21b1e3b29b629

SHA1
dd94f0ea5aa61e461d2f2401e7fe877ef97f4ca1

SHA256
f6e88e53d2d76efcf4d6c7b96e0007a872e4e21d8a1a7ba6e56efc87c446c317

SHA512
1e977b8d4ef018802f40505f5ba5f655e0caa286527d925d1ddde60cabcaf6c574d3e5bdd7dbfde36498934aa21afff50f39e15f5b6095948dab561fc8120d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr175956.exe

Filesize
238KB

MD5
7a1f12177564299f21b21b1e3b29b629

SHA1
dd94f0ea5aa61e461d2f2401e7fe877ef97f4ca1

SHA256
f6e88e53d2d76efcf4d6c7b96e0007a872e4e21d8a1a7ba6e56efc87c446c317

SHA512
1e977b8d4ef018802f40505f5ba5f655e0caa286527d925d1ddde60cabcaf6c574d3e5bdd7dbfde36498934aa21afff50f39e15f5b6095948dab561fc8120d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu155570.exe

Filesize
297KB

MD5
8063ad15c31dc847df332b073af990f0

SHA1
242ccd94fa56f41c52d0d35834db67ac3b69c69e

SHA256
8c93eca0eec2466093ae8a71050cdbb1418bd73754b79933cdc766eb41f81b9a

SHA512
aa50761b07dbe24e5750854999390d36a58b498f983f003722e2c7e3024a2b92af6192b93fbfa58a57286c900b04078c81e2c4c78a4b0b46b3e7386d47aa8d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu155570.exe

Filesize
297KB

MD5
8063ad15c31dc847df332b073af990f0

SHA1
242ccd94fa56f41c52d0d35834db67ac3b69c69e

SHA256
8c93eca0eec2466093ae8a71050cdbb1418bd73754b79933cdc766eb41f81b9a

SHA512
aa50761b07dbe24e5750854999390d36a58b498f983f003722e2c7e3024a2b92af6192b93fbfa58a57286c900b04078c81e2c4c78a4b0b46b3e7386d47aa8d17

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1492-171-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-190-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1492-167-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-173-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-175-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-177-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-179-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-181-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-183-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-185-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-187-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-188-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1492-189-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1492-169-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-191-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1492-193-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1492-165-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-163-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-161-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-160-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/1492-159-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1492-158-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1492-157-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1492-156-0x0000000004BC0000-0x0000000005164000-memory.dmp

Filesize
5.6MB

Download
memory/1492-155-0x00000000004B0000-0x00000000004DD000-memory.dmp

Filesize
180KB

Download
memory/2256-205-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-1114-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-215-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-217-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-219-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-221-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-223-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-225-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-227-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-229-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-231-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-233-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-235-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-1108-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/2256-1109-0x0000000005760000-0x000000000586A000-memory.dmp

Filesize
1.0MB

Download
memory/2256-1110-0x00000000058A0000-0x00000000058B2000-memory.dmp

Filesize
72KB

Download
memory/2256-1111-0x00000000058C0000-0x00000000058FC000-memory.dmp

Filesize
240KB

Download
memory/2256-1112-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-1115-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-213-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-1116-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-1117-0x0000000005BB0000-0x0000000005C42000-memory.dmp

Filesize
584KB

Download
memory/2256-1118-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Filesize
408KB

Download
memory/2256-1119-0x0000000006450000-0x00000000064C6000-memory.dmp

Filesize
472KB

Download
memory/2256-1120-0x00000000064E0000-0x0000000006530000-memory.dmp

Filesize
320KB

Download
memory/2256-1121-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-1122-0x0000000006560000-0x0000000006722000-memory.dmp

Filesize
1.8MB

Download
memory/2256-1123-0x0000000006730000-0x0000000006C5C000-memory.dmp

Filesize
5.2MB

Download
memory/2256-198-0x00000000004C0000-0x000000000050B000-memory.dmp

Filesize
300KB

Download
memory/2256-211-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-199-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-200-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2256-209-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-207-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-203-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-202-0x0000000002520000-0x000000000255F000-memory.dmp

Filesize
252KB

Download
memory/2256-201-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/2284-1130-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/2284-1129-0x0000000000460000-0x0000000000492000-memory.dmp

Filesize
200KB

Download
memory/4444-1136-0x00000000004B0000-0x00000000004EB000-memory.dmp

Filesize
236KB

Download