amadey | 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2023, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe
Size

1.1MB
MD5

a96dfa7be7f331d373c47be877f61824
SHA1

aae2e7da7361c08fda17cae254373652972fff8a
SHA256

6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0
SHA512

d789dabceb2360af5a4ae8abdc753b986a21ced21195c9cc058ce38a44ac04631f7d110c2473e258c8f335946965325192dba43a25fb3402d49eb8949f64db67
SSDEEP

24576:tymNGaE56IFTZFKUroKuM3rNJ1ejqKp6akg37chLMDtB7S:IW4/NOUMnGejJp6aGde

Score

10^/10

amadey redline diro lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diro

185.161.248.90:4125

Attributes

auth_value
ae95bda0dd2e95169886a3a68138568b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr478950.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr478950.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr478950.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr478950.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr478950.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr478950.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	qu008673.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	si771996.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
840	un265952.exe
2316	un012339.exe
1724	pr478950.exe
3468	qu008673.exe
3156	1.exe
1252	rk700134.exe
3064	si771996.exe
3688	oneetx.exe
4704	oneetx.exe
4252	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
1512	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr478950.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr478950.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un012339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un012339.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un265952.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un265952.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2264	1724	WerFault.exe	85
3600	3468	WerFault.exe	91
2224	3064	WerFault.exe	97
3016	3064	WerFault.exe	97
3012	3064	WerFault.exe	97
4348	3064	WerFault.exe	97
4840	3064	WerFault.exe	97
4244	3064	WerFault.exe	97
3968	3064	WerFault.exe	97
2828	3064	WerFault.exe	97
4216	3064	WerFault.exe	97
4396	3064	WerFault.exe	97
3148	3688	WerFault.exe	118
3696	3688	WerFault.exe	118
2560	3688	WerFault.exe	118
2148	3688	WerFault.exe	118
4496	3688	WerFault.exe	118
3224	3688	WerFault.exe	118
3200	3688	WerFault.exe	118
2620	3688	WerFault.exe	118
2472	3688	WerFault.exe	118
3784	3688	WerFault.exe	118
3664	3688	WerFault.exe	118
1252	4704	WerFault.exe	147
1124	3688	WerFault.exe	118
4288	3688	WerFault.exe	118
4456	3688	WerFault.exe	118
3108	4252	WerFault.exe	157
4488	3688	WerFault.exe	118

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1724	pr478950.exe
1724	pr478950.exe
3156	1.exe
1252	rk700134.exe
3156	1.exe
1252	rk700134.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	pr478950.exe
Token: SeDebugPrivilege	3468	qu008673.exe
Token: SeDebugPrivilege	3156	1.exe
Token: SeDebugPrivilege	1252	rk700134.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	si771996.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 840	2072	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe	83
PID 2072 wrote to memory of 840	2072	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe	83
PID 2072 wrote to memory of 840	2072	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe	83
PID 840 wrote to memory of 2316	840	un265952.exe	84
PID 840 wrote to memory of 2316	840	un265952.exe	84
PID 840 wrote to memory of 2316	840	un265952.exe	84
PID 2316 wrote to memory of 1724	2316	un012339.exe	85
PID 2316 wrote to memory of 1724	2316	un012339.exe	85
PID 2316 wrote to memory of 1724	2316	un012339.exe	85
PID 2316 wrote to memory of 3468	2316	un012339.exe	91
PID 2316 wrote to memory of 3468	2316	un012339.exe	91
PID 2316 wrote to memory of 3468	2316	un012339.exe	91
PID 3468 wrote to memory of 3156	3468	qu008673.exe	92
PID 3468 wrote to memory of 3156	3468	qu008673.exe	92
PID 3468 wrote to memory of 3156	3468	qu008673.exe	92
PID 840 wrote to memory of 1252	840	un265952.exe	95
PID 840 wrote to memory of 1252	840	un265952.exe	95
PID 840 wrote to memory of 1252	840	un265952.exe	95
PID 2072 wrote to memory of 3064	2072	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe	97
PID 2072 wrote to memory of 3064	2072	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe	97
PID 2072 wrote to memory of 3064	2072	6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe	97
PID 3064 wrote to memory of 3688	3064	si771996.exe	118
PID 3064 wrote to memory of 3688	3064	si771996.exe	118
PID 3064 wrote to memory of 3688	3064	si771996.exe	118
PID 3688 wrote to memory of 396	3688	oneetx.exe	137
PID 3688 wrote to memory of 396	3688	oneetx.exe	137
PID 3688 wrote to memory of 396	3688	oneetx.exe	137
PID 3688 wrote to memory of 1512	3688	oneetx.exe	154
PID 3688 wrote to memory of 1512	3688	oneetx.exe	154
PID 3688 wrote to memory of 1512	3688	oneetx.exe	154

C:\Users\Admin\AppData\Local\Temp\6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe
"C:\Users\Admin\AppData\Local\Temp\6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265952.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265952.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un012339.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un012339.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr478950.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr478950.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1084
        5⤵
        Program crash
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu008673.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu008673.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1380
        5⤵
        Program crash
        
        PID:3600
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk700134.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk700134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si771996.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si771996.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 696
    3⤵
    - Program crash
    PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 780
    3⤵
    - Program crash
    PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 856
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 960
    3⤵
    - Program crash
    PID:4348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 868
    3⤵
    - Program crash
    PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 980
    3⤵
    - Program crash
    PID:4244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1204
    3⤵
    - Program crash
    PID:3968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1204
    3⤵
    - Program crash
    PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1312
    3⤵
    - Program crash
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 692
      4⤵
      Program crash
      PID:3148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 828
      4⤵
      Program crash
      PID:3696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 876
      4⤵
      Program crash
      PID:2560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1052
      4⤵
      Program crash
      PID:2148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1060
      4⤵
      Program crash
      PID:4496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1060
      4⤵
      Program crash
      PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1120
      4⤵
      Program crash
      PID:3200
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 992
      4⤵
      Program crash
      PID:2620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 776
      4⤵
      Program crash
      PID:2472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 728
      4⤵
      Program crash
      PID:3784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1272
      4⤵
      Program crash
      PID:3664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1080
      4⤵
      Program crash
      PID:1124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1564
      4⤵
      Program crash
      PID:4288
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1144
      4⤵
      Program crash
      PID:4456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1636
      4⤵
      Program crash
      PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1412
    3⤵
    - Program crash
    PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1724 -ip 1724
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3468 -ip 3468
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3064 -ip 3064
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3064 -ip 3064
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3064 -ip 3064
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3064 -ip 3064
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3064 -ip 3064
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3064 -ip 3064
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3064 -ip 3064
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3064 -ip 3064
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3064 -ip 3064
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3064 -ip 3064
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3688 -ip 3688
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3688 -ip 3688
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3688 -ip 3688
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3688 -ip 3688
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3688 -ip 3688
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3688 -ip 3688
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3688 -ip 3688
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3688 -ip 3688
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3688 -ip 3688
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3688 -ip 3688
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3688 -ip 3688
1⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 312
  2⤵
  - Program crash
  PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4704 -ip 4704
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3688 -ip 3688
1⤵
PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3688 -ip 3688
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3688 -ip 3688
1⤵
PID:4936

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 312
  2⤵
  - Program crash
  PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4252 -ip 4252
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3688 -ip 3688
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si771996.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si771996.exe

Filesize
253KB

MD5
1c4b687ff7f7f7b8b0d0a3b1bf2cd568

SHA1
442fd0c94a574490bdec94a7a8c05e231205f530

SHA256
255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932

SHA512
2e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265952.exe

Filesize
807KB

MD5
6bd72bbcaf55179727fa2e354c48fd31

SHA1
83050f1f687164f9055ea9118534a19b8c030298

SHA256
2a011d6cddc56f15fbdc671ecac1e7ec09549af34ac544fb455a719b2019cdc9

SHA512
8a108e9f383e0a0d8322cdaf75a3f9b3e65b450d1c039b35ba8f6037e93b57574e9b24714d0b0db805ba71e72c45f001b791e1d72f1e2840ec4d195035e1be89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265952.exe

Filesize
807KB

MD5
6bd72bbcaf55179727fa2e354c48fd31

SHA1
83050f1f687164f9055ea9118534a19b8c030298

SHA256
2a011d6cddc56f15fbdc671ecac1e7ec09549af34ac544fb455a719b2019cdc9

SHA512
8a108e9f383e0a0d8322cdaf75a3f9b3e65b450d1c039b35ba8f6037e93b57574e9b24714d0b0db805ba71e72c45f001b791e1d72f1e2840ec4d195035e1be89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk700134.exe

Filesize
168KB

MD5
696bf18686dec69626a25fdd50e8988c

SHA1
d19c4d20bf55bd7919342330ab4508fc54dba0d9

SHA256
02a4ce8d44f7b99a7fcf3c01761d66088d746a5794e27e1a9cae6302f985108c

SHA512
aafc2992fc8f70e74da96f0946050b219938f08b1820567b7664e4d51b066282652fcf9b32e567fb60c20e44b723210c2d883d12d88c6d1adf426ed312794f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk700134.exe

Filesize
168KB

MD5
696bf18686dec69626a25fdd50e8988c

SHA1
d19c4d20bf55bd7919342330ab4508fc54dba0d9

SHA256
02a4ce8d44f7b99a7fcf3c01761d66088d746a5794e27e1a9cae6302f985108c

SHA512
aafc2992fc8f70e74da96f0946050b219938f08b1820567b7664e4d51b066282652fcf9b32e567fb60c20e44b723210c2d883d12d88c6d1adf426ed312794f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un012339.exe

Filesize
653KB

MD5
36aefed915b8fda610b5494c0af1302b

SHA1
d80c19828a7ab867ed362625afdac7de36fe91a5

SHA256
9a752e53bb82b0101cbde8e1f46a28019ea8ada2d97ab2097578038f5fcddcc4

SHA512
763010a1d1c4448cf5bb18570d967765b2288d20549396fb236c6be276955890cb18883830a95efa2189f64e8d34044c49297f8ae3dbc50f5aeed13a0c70fccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un012339.exe

Filesize
653KB

MD5
36aefed915b8fda610b5494c0af1302b

SHA1
d80c19828a7ab867ed362625afdac7de36fe91a5

SHA256
9a752e53bb82b0101cbde8e1f46a28019ea8ada2d97ab2097578038f5fcddcc4

SHA512
763010a1d1c4448cf5bb18570d967765b2288d20549396fb236c6be276955890cb18883830a95efa2189f64e8d34044c49297f8ae3dbc50f5aeed13a0c70fccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr478950.exe

Filesize
262KB

MD5
4add0b2c188b70f959cb924cabd54d76

SHA1
67d7b243717b9dc40459ae3c80f81ef283cc07b4

SHA256
03e850143d3408de50b1f4a6c18623942315b936672a154c9a7c3bb2f314eec9

SHA512
1b121196f725e62f642c911312b236c6ae9c9767c8f010c3dd48019a361ad7b575582d6b037ea0ee84e7a4b5c4e06465e9bfb377debd41171b63b06bbe0657a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr478950.exe

Filesize
262KB

MD5
4add0b2c188b70f959cb924cabd54d76

SHA1
67d7b243717b9dc40459ae3c80f81ef283cc07b4

SHA256
03e850143d3408de50b1f4a6c18623942315b936672a154c9a7c3bb2f314eec9

SHA512
1b121196f725e62f642c911312b236c6ae9c9767c8f010c3dd48019a361ad7b575582d6b037ea0ee84e7a4b5c4e06465e9bfb377debd41171b63b06bbe0657a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu008673.exe

Filesize
445KB

MD5
ad09ead49cb3077017ce06fbe5fcd57f

SHA1
e78d1811365a524d3ea9d92c991baf777c061916

SHA256
5030902c98382910a8fa52854c8b738be7e264d03e0ae661afbfaac26f74ae85

SHA512
230f95846bcf40a902f82d8ef62e41e07ef0321c76aee9442ad199f10061f7caeb2c2ffafc4d3a915ca8633f416a715b02412f622687451a01656b030e1db38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu008673.exe

Filesize
445KB

MD5
ad09ead49cb3077017ce06fbe5fcd57f

SHA1
e78d1811365a524d3ea9d92c991baf777c061916

SHA256
5030902c98382910a8fa52854c8b738be7e264d03e0ae661afbfaac26f74ae85

SHA512
230f95846bcf40a902f82d8ef62e41e07ef0321c76aee9442ad199f10061f7caeb2c2ffafc4d3a915ca8633f416a715b02412f622687451a01656b030e1db38f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/1252-2371-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/1252-2369-0x0000000005950000-0x00000000059C6000-memory.dmp

Filesize
472KB

Download
memory/1252-2370-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/1252-2372-0x00000000069E0000-0x0000000006BA2000-memory.dmp

Filesize
1.8MB

Download
memory/1252-2374-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/1252-2373-0x0000000008EA0000-0x00000000093CC000-memory.dmp

Filesize
5.2MB

Download
memory/1252-2367-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/1252-2366-0x0000000000C90000-0x0000000000CC0000-memory.dmp

Filesize
192KB

Download
memory/1724-166-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-176-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-192-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1724-190-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1724-189-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1724-188-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1724-187-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-184-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-185-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1724-182-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-155-0x0000000000610000-0x000000000063D000-memory.dmp

Filesize
180KB

Download
memory/1724-180-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-178-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-193-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1724-174-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-172-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-170-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-168-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-164-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-162-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-160-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-159-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/1724-158-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/1724-157-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1724-156-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/3064-2383-0x0000000000600000-0x000000000063B000-memory.dmp

Filesize
236KB

Download
memory/3156-2365-0x0000000004A80000-0x0000000004ABC000-memory.dmp

Filesize
240KB

Download
memory/3156-2368-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3156-2358-0x0000000005210000-0x0000000005828000-memory.dmp

Filesize
6.1MB

Download
memory/3156-2359-0x0000000004D00000-0x0000000004E0A000-memory.dmp

Filesize
1.0MB

Download
memory/3156-2360-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3156-2376-0x0000000005FA0000-0x0000000005FF0000-memory.dmp

Filesize
320KB

Download
memory/3156-2375-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3156-2357-0x00000000001E0000-0x000000000020E000-memory.dmp

Filesize
184KB

Download
memory/3468-223-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-219-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-233-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-231-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-228-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3468-226-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3468-224-0x0000000000590000-0x00000000005EB000-memory.dmp

Filesize
364KB

Download
memory/3468-227-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-221-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-235-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-2345-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3468-229-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3468-217-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-213-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-215-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-211-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-209-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-207-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-205-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-203-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-201-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-199-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download
memory/3468-198-0x00000000051E0000-0x0000000005240000-memory.dmp

Filesize
384KB

Download