amadey | 17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2023, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe
Size

1.1MB
MD5

dcd3daa4bb8b8784157f22b05abc0aeb
SHA1

0260902249474fbd25340b09e32d422da6b07c59
SHA256

17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18
SHA512

8d298f2ac8897f5b9862df36aeda1436b4a55752ec015a1877ab6a54bda799445fc6ddb81d40a250f539623c39ebb225c09dc3cd86f8273d8f6abf2e179adc43
SSDEEP

24576:ByRSYQbtdeGeb0KGEF3AoyPWm3pQVqcpoZMn+j/g:0jQeGHKn+ok3pQ8cg

Score

10^/10

amadey redline diro lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diro

185.161.248.90:4125

Attributes

auth_value
ae95bda0dd2e95169886a3a68138568b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr284693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr284693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr284693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr284693.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr284693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr284693.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	qu044670.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	si699257.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
3516	un252026.exe
2984	un397031.exe
2172	pr284693.exe
4936	qu044670.exe
3676	1.exe
5052	rk409685.exe
5036	si699257.exe
928	oneetx.exe
3520	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2348	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr284693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr284693.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un397031.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un397031.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un252026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un252026.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
4648	2172	WerFault.exe	86
3356	4936	WerFault.exe	95
3616	5036	WerFault.exe	102
4920	5036	WerFault.exe	102
2124	5036	WerFault.exe	102
2664	5036	WerFault.exe	102
3708	5036	WerFault.exe	102
3664	5036	WerFault.exe	102
3784	5036	WerFault.exe	102
2076	5036	WerFault.exe	102
4864	5036	WerFault.exe	102
4852	928	WerFault.exe	121
4280	928	WerFault.exe	121
828	928	WerFault.exe	121
436	928	WerFault.exe	121
864	928	WerFault.exe	121
4624	928	WerFault.exe	121
4448	928	WerFault.exe	121
3764	928	WerFault.exe	121
3080	928	WerFault.exe	121
2108	928	WerFault.exe	121
3688	928	WerFault.exe	121
4536	5036	WerFault.exe	102
1768	928	WerFault.exe	121
4496	928	WerFault.exe	121
3660	928	WerFault.exe	121
4952	3520	WerFault.exe	150
3816	928	WerFault.exe	121

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2172	pr284693.exe
2172	pr284693.exe
5052	rk409685.exe
5052	rk409685.exe
3676	1.exe
3676	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	pr284693.exe
Token: SeDebugPrivilege	4936	qu044670.exe
Token: SeDebugPrivilege	5052	rk409685.exe
Token: SeDebugPrivilege	3676	1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	si699257.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3516	2028	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe	84
PID 2028 wrote to memory of 3516	2028	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe	84
PID 2028 wrote to memory of 3516	2028	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe	84
PID 3516 wrote to memory of 2984	3516	un252026.exe	85
PID 3516 wrote to memory of 2984	3516	un252026.exe	85
PID 3516 wrote to memory of 2984	3516	un252026.exe	85
PID 2984 wrote to memory of 2172	2984	un397031.exe	86
PID 2984 wrote to memory of 2172	2984	un397031.exe	86
PID 2984 wrote to memory of 2172	2984	un397031.exe	86
PID 2984 wrote to memory of 4936	2984	un397031.exe	95
PID 2984 wrote to memory of 4936	2984	un397031.exe	95
PID 2984 wrote to memory of 4936	2984	un397031.exe	95
PID 4936 wrote to memory of 3676	4936	qu044670.exe	97
PID 4936 wrote to memory of 3676	4936	qu044670.exe	97
PID 4936 wrote to memory of 3676	4936	qu044670.exe	97
PID 3516 wrote to memory of 5052	3516	un252026.exe	100
PID 3516 wrote to memory of 5052	3516	un252026.exe	100
PID 3516 wrote to memory of 5052	3516	un252026.exe	100
PID 2028 wrote to memory of 5036	2028	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe	102
PID 2028 wrote to memory of 5036	2028	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe	102
PID 2028 wrote to memory of 5036	2028	17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe	102
PID 5036 wrote to memory of 928	5036	si699257.exe	121
PID 5036 wrote to memory of 928	5036	si699257.exe	121
PID 5036 wrote to memory of 928	5036	si699257.exe	121
PID 928 wrote to memory of 2024	928	oneetx.exe	136
PID 928 wrote to memory of 2024	928	oneetx.exe	136
PID 928 wrote to memory of 2024	928	oneetx.exe	136
PID 928 wrote to memory of 2348	928	oneetx.exe	153
PID 928 wrote to memory of 2348	928	oneetx.exe	153
PID 928 wrote to memory of 2348	928	oneetx.exe	153

C:\Users\Admin\AppData\Local\Temp\17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe
"C:\Users\Admin\AppData\Local\Temp\17fd92d82a53135e298587e33a7d269ea357ff5ed866f5e3f1825b88ac555d18.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un252026.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un252026.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un397031.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un397031.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr284693.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr284693.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 1084
        5⤵
        Program crash
        
        PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu044670.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu044670.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1380
        5⤵
        Program crash
        
        PID:3356
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk409685.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk409685.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si699257.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si699257.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 696
    3⤵
    - Program crash
    PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 780
    3⤵
    - Program crash
    PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 856
    3⤵
    - Program crash
    PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 968
    3⤵
    - Program crash
    PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 856
    3⤵
    - Program crash
    PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 856
    3⤵
    - Program crash
    PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1216
    3⤵
    - Program crash
    PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1216
    3⤵
    - Program crash
    PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1312
    3⤵
    - Program crash
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 692
      4⤵
      Program crash
      PID:4852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 856
      4⤵
      Program crash
      PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 888
      4⤵
      Program crash
      PID:828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1052
      4⤵
      Program crash
      PID:436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1072
      4⤵
      Program crash
      PID:864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1072
      4⤵
      Program crash
      PID:4624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1100
      4⤵
      Program crash
      PID:4448
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 996
      4⤵
      Program crash
      PID:3764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 848
      4⤵
      Program crash
      PID:3080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1260
      4⤵
      Program crash
      PID:2108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1304
      4⤵
      Program crash
      PID:3688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1104
      4⤵
      Program crash
      PID:1768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1652
      4⤵
      Program crash
      PID:4496
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1580
      4⤵
      Program crash
      PID:3660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1668
      4⤵
      Program crash
      PID:3816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1752
    3⤵
    - Program crash
    PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2172 -ip 2172
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4936 -ip 4936
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5036 -ip 5036
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5036 -ip 5036
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5036 -ip 5036
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5036 -ip 5036
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5036 -ip 5036
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5036 -ip 5036
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5036 -ip 5036
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5036 -ip 5036
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5036 -ip 5036
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 928 -ip 928
1⤵
PID:488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 928 -ip 928
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 928 -ip 928
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 928 -ip 928
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 928 -ip 928
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 928 -ip 928
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 928 -ip 928
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 928 -ip 928
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 928 -ip 928
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 928 -ip 928
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 928 -ip 928
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5036 -ip 5036
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 928 -ip 928
1⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 312
  2⤵
  - Program crash
  PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 928 -ip 928
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 928 -ip 928
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3520 -ip 3520
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 928 -ip 928
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
270KB

MD5
0f5e12a3ec9afedeeb828dd9f77fb54e

SHA1
ec95fe1e937e91f82172402552abff0f13ebb38b

SHA256
291e3f01cff765c4ed0006e0a16402180879ae6db613285b73a74dd7dec149d6

SHA512
9869b49de53eb5b18554c2c5500973ecf59f40227ae2b7efa1bd06a6678c68c446814b79457025d5dac57f21a7886d2f7db7f4a840f0a7010be0372a01defad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
270KB

MD5
0f5e12a3ec9afedeeb828dd9f77fb54e

SHA1
ec95fe1e937e91f82172402552abff0f13ebb38b

SHA256
291e3f01cff765c4ed0006e0a16402180879ae6db613285b73a74dd7dec149d6

SHA512
9869b49de53eb5b18554c2c5500973ecf59f40227ae2b7efa1bd06a6678c68c446814b79457025d5dac57f21a7886d2f7db7f4a840f0a7010be0372a01defad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
270KB

MD5
0f5e12a3ec9afedeeb828dd9f77fb54e

SHA1
ec95fe1e937e91f82172402552abff0f13ebb38b

SHA256
291e3f01cff765c4ed0006e0a16402180879ae6db613285b73a74dd7dec149d6

SHA512
9869b49de53eb5b18554c2c5500973ecf59f40227ae2b7efa1bd06a6678c68c446814b79457025d5dac57f21a7886d2f7db7f4a840f0a7010be0372a01defad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
270KB

MD5
0f5e12a3ec9afedeeb828dd9f77fb54e

SHA1
ec95fe1e937e91f82172402552abff0f13ebb38b

SHA256
291e3f01cff765c4ed0006e0a16402180879ae6db613285b73a74dd7dec149d6

SHA512
9869b49de53eb5b18554c2c5500973ecf59f40227ae2b7efa1bd06a6678c68c446814b79457025d5dac57f21a7886d2f7db7f4a840f0a7010be0372a01defad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si699257.exe

Filesize
270KB

MD5
0f5e12a3ec9afedeeb828dd9f77fb54e

SHA1
ec95fe1e937e91f82172402552abff0f13ebb38b

SHA256
291e3f01cff765c4ed0006e0a16402180879ae6db613285b73a74dd7dec149d6

SHA512
9869b49de53eb5b18554c2c5500973ecf59f40227ae2b7efa1bd06a6678c68c446814b79457025d5dac57f21a7886d2f7db7f4a840f0a7010be0372a01defad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si699257.exe

Filesize
270KB

MD5
0f5e12a3ec9afedeeb828dd9f77fb54e

SHA1
ec95fe1e937e91f82172402552abff0f13ebb38b

SHA256
291e3f01cff765c4ed0006e0a16402180879ae6db613285b73a74dd7dec149d6

SHA512
9869b49de53eb5b18554c2c5500973ecf59f40227ae2b7efa1bd06a6678c68c446814b79457025d5dac57f21a7886d2f7db7f4a840f0a7010be0372a01defad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un252026.exe

Filesize
809KB

MD5
ac4c44401e3138a307de062193f70ad1

SHA1
5e5ae528a8152d7b230b88039c6d6a8bb900c2e8

SHA256
e97f0db65d18c0bc41f332368a936d2989ca71f304a3155165953491667885b0

SHA512
616bd818dac5658a55704a34b5281ec068c2779c065ce3459cf9ffd6e221e1c536639f6ad4edb384b84d5947068a070ecf366e0ea8974bd5bc345d5ade74ca13

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un252026.exe

Filesize
809KB

MD5
ac4c44401e3138a307de062193f70ad1

SHA1
5e5ae528a8152d7b230b88039c6d6a8bb900c2e8

SHA256
e97f0db65d18c0bc41f332368a936d2989ca71f304a3155165953491667885b0

SHA512
616bd818dac5658a55704a34b5281ec068c2779c065ce3459cf9ffd6e221e1c536639f6ad4edb384b84d5947068a070ecf366e0ea8974bd5bc345d5ade74ca13

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk409685.exe

Filesize
168KB

MD5
2109748a971f5d79a5a6e985e2516aab

SHA1
1af57d42353557652c0f75685c18528907b78fbf

SHA256
ad390225b6e5a9643397b58c5b66aeffcdf7c1cae86b794dee8e96ad91d2551d

SHA512
fb095d4641d36245ca94c40b5d9c1218819fd1f175fdd8112a953b3fbb3b8dafb77f85f11cdcf9ed9a15b0df125616fb7b18ab2fdd7e5ae943f8d7c97b9dffd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk409685.exe

Filesize
168KB

MD5
2109748a971f5d79a5a6e985e2516aab

SHA1
1af57d42353557652c0f75685c18528907b78fbf

SHA256
ad390225b6e5a9643397b58c5b66aeffcdf7c1cae86b794dee8e96ad91d2551d

SHA512
fb095d4641d36245ca94c40b5d9c1218819fd1f175fdd8112a953b3fbb3b8dafb77f85f11cdcf9ed9a15b0df125616fb7b18ab2fdd7e5ae943f8d7c97b9dffd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un397031.exe

Filesize
655KB

MD5
1f02f8813988af69ee250c98a32f97ad

SHA1
e7f85d09b2f2a40fae332a27d79fa2d23994d7e7

SHA256
57017c110e007883a698c428946363f131d940e059776b7ce7897f42b7e2db79

SHA512
4fe1a9d30316de1f16451c131d0a4cf6d9f38fe0a3dca8a6744330ef9d4b1143ba92a46cdc024ef013ee529fe1cdbf3c97afe86da453d35bc8b6a4d0271a7028

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un397031.exe

Filesize
655KB

MD5
1f02f8813988af69ee250c98a32f97ad

SHA1
e7f85d09b2f2a40fae332a27d79fa2d23994d7e7

SHA256
57017c110e007883a698c428946363f131d940e059776b7ce7897f42b7e2db79

SHA512
4fe1a9d30316de1f16451c131d0a4cf6d9f38fe0a3dca8a6744330ef9d4b1143ba92a46cdc024ef013ee529fe1cdbf3c97afe86da453d35bc8b6a4d0271a7028

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr284693.exe

Filesize
261KB

MD5
5460891b1309a437e01f122affdf3644

SHA1
9021334b3d9a3f9e3fdb83b78aeebb72e7c8ea70

SHA256
676bbfa2a6e13e41578fcfa9cc55a36e0015edc705a3bac6411f35c792c26c7d

SHA512
360270819343dc218c217db52f1887485598b40fbb45d88776f547bd56fb1ed139aa2e0a52361a0da9519c8d721eee948eb5256a69a71ebd0d692261bc6a11f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr284693.exe

Filesize
261KB

MD5
5460891b1309a437e01f122affdf3644

SHA1
9021334b3d9a3f9e3fdb83b78aeebb72e7c8ea70

SHA256
676bbfa2a6e13e41578fcfa9cc55a36e0015edc705a3bac6411f35c792c26c7d

SHA512
360270819343dc218c217db52f1887485598b40fbb45d88776f547bd56fb1ed139aa2e0a52361a0da9519c8d721eee948eb5256a69a71ebd0d692261bc6a11f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu044670.exe

Filesize
445KB

MD5
4246920b12cea80e3b6e47168165710f

SHA1
a892c5b38cbf52bad22373ea59b3ef87113e9268

SHA256
9f8775f47d50df58d49d68fa8751bd0e2de47607cfdc42d5e7a5eb3902568dc0

SHA512
de7da86fd7cc585416e99f3831def3fba0837293809c8ab4ca4bd63b996c1e65f06768dfa078064e6a4573b5322b00b260a4b156dc63fa9ae905f08fe0524d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu044670.exe

Filesize
445KB

MD5
4246920b12cea80e3b6e47168165710f

SHA1
a892c5b38cbf52bad22373ea59b3ef87113e9268

SHA256
9f8775f47d50df58d49d68fa8751bd0e2de47607cfdc42d5e7a5eb3902568dc0

SHA512
de7da86fd7cc585416e99f3831def3fba0837293809c8ab4ca4bd63b996c1e65f06768dfa078064e6a4573b5322b00b260a4b156dc63fa9ae905f08fe0524d32

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/2172-163-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-175-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-187-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2172-188-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2172-189-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2172-191-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2172-192-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2172-193-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2172-185-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-183-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-181-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-179-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-177-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-186-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2172-173-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-171-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-169-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-167-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-165-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-161-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-159-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-158-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2172-157-0x0000000004D00000-0x00000000052A4000-memory.dmp

Filesize
5.6MB

Download
memory/2172-156-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2172-155-0x0000000000640000-0x000000000066D000-memory.dmp

Filesize
180KB

Download
memory/3676-2367-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download
memory/3676-2358-0x0000000005160000-0x0000000005778000-memory.dmp

Filesize
6.1MB

Download
memory/3676-2375-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download
memory/3676-2374-0x00000000083F0000-0x000000000891C000-memory.dmp

Filesize
5.2MB

Download
memory/3676-2373-0x0000000005F40000-0x0000000006102000-memory.dmp

Filesize
1.8MB

Download
memory/3676-2371-0x00000000050B0000-0x0000000005116000-memory.dmp

Filesize
408KB

Download
memory/3676-2370-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/3676-2369-0x0000000004EF0000-0x0000000004F66000-memory.dmp

Filesize
472KB

Download
memory/3676-2365-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download
memory/3676-2360-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3676-2356-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/3676-2359-0x0000000004C50000-0x0000000004D5A000-memory.dmp

Filesize
1.0MB

Download
memory/4936-216-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4936-231-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-221-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-220-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4936-218-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-198-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-217-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4936-225-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-199-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-223-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-235-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-233-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-201-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-2357-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4936-229-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-227-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-203-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-213-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-214-0x0000000002030000-0x000000000208B000-memory.dmp

Filesize
364KB

Download
memory/4936-205-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-211-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-209-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/4936-207-0x00000000051C0000-0x0000000005220000-memory.dmp

Filesize
384KB

Download
memory/5036-2383-0x0000000001FF0000-0x000000000202B000-memory.dmp

Filesize
236KB

Download
memory/5052-2376-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/5052-2372-0x0000000006880000-0x00000000068D0000-memory.dmp

Filesize
320KB

Download
memory/5052-2368-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/5052-2366-0x0000000000D60000-0x0000000000D90000-memory.dmp

Filesize
192KB

Download