amadey | c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2023, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe
Size

1.1MB
MD5

c9a64d77c42c8ea17c74b374d7600a7e
SHA1

07c724386ab5f7b17216190ed2d3aef417d6f918
SHA256

c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e
SHA512

277582a869a82fd52ca42532acc412128474c36a429e4591a5ffc336a2185b4318f449e0e61fe02d1f965179698baeafaf97decb62ccb86f0efbf33a3faaee33
SSDEEP

12288:Ty90Ra7lhH4un0LXdEQINSUgsSmad9FWgDsoxm6LlIF6Y/x5gsmtwQv648lp+LA2:Ty37vH5+uoCadDxhxInPmmdeyAiTO

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr349282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr349282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr349282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr349282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr349282.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr349282.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	si316126.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
1436	un062862.exe
2072	un395275.exe
4044	pr349282.exe
2568	qu622518.exe
4976	rk456027.exe
3388	si316126.exe
1408	oneetx.exe
1552	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
432	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr349282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr349282.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un062862.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un062862.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un395275.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un395275.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
3956	4044	WerFault.exe	87
1404	2568	WerFault.exe	93
1716	3388	WerFault.exe	98
2412	3388	WerFault.exe	98
2948	3388	WerFault.exe	98
4336	3388	WerFault.exe	98
3896	3388	WerFault.exe	98
232	3388	WerFault.exe	98
3032	3388	WerFault.exe	98
5112	3388	WerFault.exe	98
3168	3388	WerFault.exe	98
1500	3388	WerFault.exe	98
4192	1408	WerFault.exe	118
1964	1408	WerFault.exe	118
536	1408	WerFault.exe	118
3384	1408	WerFault.exe	118
4676	1408	WerFault.exe	118
5004	1408	WerFault.exe	118
3064	1408	WerFault.exe	118
1664	1408	WerFault.exe	118
4980	1408	WerFault.exe	118
5080	1408	WerFault.exe	118
3744	1408	WerFault.exe	118
4596	1408	WerFault.exe	118
4416	1408	WerFault.exe	118
2948	1408	WerFault.exe	118
376	1552	WerFault.exe	155
4448	1408	WerFault.exe	118

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4044	pr349282.exe
4044	pr349282.exe
2568	qu622518.exe
2568	qu622518.exe
4976	rk456027.exe
4976	rk456027.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4044	pr349282.exe
Token: SeDebugPrivilege	2568	qu622518.exe
Token: SeDebugPrivilege	4976	rk456027.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3388	si316126.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1436	2740	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe	85
PID 2740 wrote to memory of 1436	2740	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe	85
PID 2740 wrote to memory of 1436	2740	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe	85
PID 1436 wrote to memory of 2072	1436	un062862.exe	86
PID 1436 wrote to memory of 2072	1436	un062862.exe	86
PID 1436 wrote to memory of 2072	1436	un062862.exe	86
PID 2072 wrote to memory of 4044	2072	un395275.exe	87
PID 2072 wrote to memory of 4044	2072	un395275.exe	87
PID 2072 wrote to memory of 4044	2072	un395275.exe	87
PID 2072 wrote to memory of 2568	2072	un395275.exe	93
PID 2072 wrote to memory of 2568	2072	un395275.exe	93
PID 2072 wrote to memory of 2568	2072	un395275.exe	93
PID 1436 wrote to memory of 4976	1436	un062862.exe	96
PID 1436 wrote to memory of 4976	1436	un062862.exe	96
PID 1436 wrote to memory of 4976	1436	un062862.exe	96
PID 2740 wrote to memory of 3388	2740	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe	98
PID 2740 wrote to memory of 3388	2740	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe	98
PID 2740 wrote to memory of 3388	2740	c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe	98
PID 3388 wrote to memory of 1408	3388	si316126.exe	118
PID 3388 wrote to memory of 1408	3388	si316126.exe	118
PID 3388 wrote to memory of 1408	3388	si316126.exe	118
PID 1408 wrote to memory of 2664	1408	oneetx.exe	138
PID 1408 wrote to memory of 2664	1408	oneetx.exe	138
PID 1408 wrote to memory of 2664	1408	oneetx.exe	138
PID 1408 wrote to memory of 432	1408	oneetx.exe	152
PID 1408 wrote to memory of 432	1408	oneetx.exe	152
PID 1408 wrote to memory of 432	1408	oneetx.exe	152

C:\Users\Admin\AppData\Local\Temp\c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe
"C:\Users\Admin\AppData\Local\Temp\c6ee925f86d52471e052854182af14fa5b7e02dbf095d0f20d509fbc2bb74d2e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un062862.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un062862.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un395275.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un395275.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr349282.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr349282.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 1084
        5⤵
        Program crash
        
        PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu622518.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu622518.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1900
        5⤵
        Program crash
        
        PID:1404
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk456027.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk456027.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si316126.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si316126.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 696
    3⤵
    - Program crash
    PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 784
    3⤵
    - Program crash
    PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 800
    3⤵
    - Program crash
    PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 952
    3⤵
    - Program crash
    PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 980
    3⤵
    - Program crash
    PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1008
    3⤵
    - Program crash
    PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1220
    3⤵
    - Program crash
    PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1252
    3⤵
    - Program crash
    PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1328
    3⤵
    - Program crash
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 692
      4⤵
      Program crash
      PID:4192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 848
      4⤵
      Program crash
      PID:1964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 892
      4⤵
      Program crash
      PID:536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1052
      4⤵
      Program crash
      PID:3384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1060
      4⤵
      Program crash
      PID:4676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1084
      4⤵
      Program crash
      PID:5004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1128
      4⤵
      Program crash
      PID:3064
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 992
      4⤵
      Program crash
      PID:1664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 764
      4⤵
      Program crash
      PID:4980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 692
      4⤵
      Program crash
      PID:5080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 684
      4⤵
      Program crash
      PID:3744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1124
      4⤵
      Program crash
      PID:4596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1612
      4⤵
      Program crash
      PID:4416
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1588
      4⤵
      Program crash
      PID:2948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1628
      4⤵
      Program crash
      PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1360
    3⤵
    - Program crash
    PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4044 -ip 4044
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2568 -ip 2568
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3388 -ip 3388
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3388 -ip 3388
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3388 -ip 3388
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3388 -ip 3388
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3388 -ip 3388
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3388 -ip 3388
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3388 -ip 3388
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3388 -ip 3388
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3388 -ip 3388
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3388 -ip 3388
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1408 -ip 1408
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1408 -ip 1408
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1408 -ip 1408
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1408 -ip 1408
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1408 -ip 1408
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1408 -ip 1408
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1408 -ip 1408
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1408 -ip 1408
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1408 -ip 1408
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1408 -ip 1408
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1408 -ip 1408
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1408 -ip 1408
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1408 -ip 1408
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1408 -ip 1408
1⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 312
  2⤵
  - Program crash
  PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1552 -ip 1552
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1408 -ip 1408
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
395KB

MD5
11c04d845186853c329f9976c66cad0e

SHA1
50cc07655709334f93436401694c328096d29e2f

SHA256
e5f8885773d9b1c058c6ef64eab507cbe2fe75d7fc08ab12fe2b1418f7e947e5

SHA512
c50856d4df2be9166c2f1812f076f81929206b38396368786c23b2b1069dee56cd6ff6de5edf66c5946ce1c67f2025dc16640ea252de9d27b6afb298b2bf7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
395KB

MD5
11c04d845186853c329f9976c66cad0e

SHA1
50cc07655709334f93436401694c328096d29e2f

SHA256
e5f8885773d9b1c058c6ef64eab507cbe2fe75d7fc08ab12fe2b1418f7e947e5

SHA512
c50856d4df2be9166c2f1812f076f81929206b38396368786c23b2b1069dee56cd6ff6de5edf66c5946ce1c67f2025dc16640ea252de9d27b6afb298b2bf7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
395KB

MD5
11c04d845186853c329f9976c66cad0e

SHA1
50cc07655709334f93436401694c328096d29e2f

SHA256
e5f8885773d9b1c058c6ef64eab507cbe2fe75d7fc08ab12fe2b1418f7e947e5

SHA512
c50856d4df2be9166c2f1812f076f81929206b38396368786c23b2b1069dee56cd6ff6de5edf66c5946ce1c67f2025dc16640ea252de9d27b6afb298b2bf7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
395KB

MD5
11c04d845186853c329f9976c66cad0e

SHA1
50cc07655709334f93436401694c328096d29e2f

SHA256
e5f8885773d9b1c058c6ef64eab507cbe2fe75d7fc08ab12fe2b1418f7e947e5

SHA512
c50856d4df2be9166c2f1812f076f81929206b38396368786c23b2b1069dee56cd6ff6de5edf66c5946ce1c67f2025dc16640ea252de9d27b6afb298b2bf7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si316126.exe

Filesize
395KB

MD5
11c04d845186853c329f9976c66cad0e

SHA1
50cc07655709334f93436401694c328096d29e2f

SHA256
e5f8885773d9b1c058c6ef64eab507cbe2fe75d7fc08ab12fe2b1418f7e947e5

SHA512
c50856d4df2be9166c2f1812f076f81929206b38396368786c23b2b1069dee56cd6ff6de5edf66c5946ce1c67f2025dc16640ea252de9d27b6afb298b2bf7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si316126.exe

Filesize
395KB

MD5
11c04d845186853c329f9976c66cad0e

SHA1
50cc07655709334f93436401694c328096d29e2f

SHA256
e5f8885773d9b1c058c6ef64eab507cbe2fe75d7fc08ab12fe2b1418f7e947e5

SHA512
c50856d4df2be9166c2f1812f076f81929206b38396368786c23b2b1069dee56cd6ff6de5edf66c5946ce1c67f2025dc16640ea252de9d27b6afb298b2bf7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un062862.exe

Filesize
759KB

MD5
2dbc17e96b3ae235a9c15b09c6b951a4

SHA1
dcd6b479fecee91d8865aec7590e552e0cc0f83a

SHA256
696cb8a736230d314d4623e5b515cb2ba40f5c93134200857fa4e433290304a9

SHA512
f868272ca13ae77eb5d180872dd0b14a5f7d844bf804e081fdd0949be0ca65955c97b62628ce3c44b6bde7c845bc28e1e56e1835b4a5ef09ab4046abfa22d1c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un062862.exe

Filesize
759KB

MD5
2dbc17e96b3ae235a9c15b09c6b951a4

SHA1
dcd6b479fecee91d8865aec7590e552e0cc0f83a

SHA256
696cb8a736230d314d4623e5b515cb2ba40f5c93134200857fa4e433290304a9

SHA512
f868272ca13ae77eb5d180872dd0b14a5f7d844bf804e081fdd0949be0ca65955c97b62628ce3c44b6bde7c845bc28e1e56e1835b4a5ef09ab4046abfa22d1c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk456027.exe

Filesize
136KB

MD5
bf4b6a0b5d38e5e70706a4b69916b9cd

SHA1
616e7258ab6ed5c24db58ce97f87324e74213ea5

SHA256
2dc04e623c3d66e553a6a11ca4b0ec9974e2a09aae6740f291f1a3580117b600

SHA512
d39033be9b8e45c7a81418a239ecf1eccedba84ae2aec402a223788bb08a420c4ef32b9b9bea94640429ab2fd978903dd057487dc8c8cf4a2d080f14f5fa7801

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk456027.exe

Filesize
136KB

MD5
bf4b6a0b5d38e5e70706a4b69916b9cd

SHA1
616e7258ab6ed5c24db58ce97f87324e74213ea5

SHA256
2dc04e623c3d66e553a6a11ca4b0ec9974e2a09aae6740f291f1a3580117b600

SHA512
d39033be9b8e45c7a81418a239ecf1eccedba84ae2aec402a223788bb08a420c4ef32b9b9bea94640429ab2fd978903dd057487dc8c8cf4a2d080f14f5fa7801

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un395275.exe

Filesize
604KB

MD5
3ee64bd3dada1baa7beeb025b7a259e2

SHA1
d526753bd6cea92f6dc234d08d697a5722068b69

SHA256
cc6cc5fa2f627af0e6f0d52686392370d65b93183c51fbc83a0102334833ce59

SHA512
ce192e959f67f68c4a5259e572fed6de24751e245579ac1440db33d8d580a282da6cb8ae0f99f3238ce9a2d477a04f8ef20c70cea58447ca1cf72619bf9ce6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un395275.exe

Filesize
604KB

MD5
3ee64bd3dada1baa7beeb025b7a259e2

SHA1
d526753bd6cea92f6dc234d08d697a5722068b69

SHA256
cc6cc5fa2f627af0e6f0d52686392370d65b93183c51fbc83a0102334833ce59

SHA512
ce192e959f67f68c4a5259e572fed6de24751e245579ac1440db33d8d580a282da6cb8ae0f99f3238ce9a2d477a04f8ef20c70cea58447ca1cf72619bf9ce6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr349282.exe

Filesize
404KB

MD5
61e1d4d8b6183d20f1eb9f23992394d1

SHA1
a28dbcf7ec066c54706641fe5da1935d8725ea1f

SHA256
3646246567253fdc0b1b55bdd20ee244935401ba6182f97c6e822be75b6b54fe

SHA512
6fbc8a965b82c33a97aa77f2f2efeffdbcdf5e07a7f75a37ebda8f4e2dff5ab7b0d700a811c365f9d629fa4f24085edee71816fc24f1e74b1d51900d7a9575b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr349282.exe

Filesize
404KB

MD5
61e1d4d8b6183d20f1eb9f23992394d1

SHA1
a28dbcf7ec066c54706641fe5da1935d8725ea1f

SHA256
3646246567253fdc0b1b55bdd20ee244935401ba6182f97c6e822be75b6b54fe

SHA512
6fbc8a965b82c33a97aa77f2f2efeffdbcdf5e07a7f75a37ebda8f4e2dff5ab7b0d700a811c365f9d629fa4f24085edee71816fc24f1e74b1d51900d7a9575b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu622518.exe

Filesize
487KB

MD5
1091732dd653f3bde46f0b8b1ab46b24

SHA1
32ffd50743e3a66fab2ac07aaf17abafa33ed0f2

SHA256
bd080cf1e8265f2d296d91048e1f6b58c4ce8c8f3388d356d01a05263a7d4fd0

SHA512
6331bd9b0361999813e93de15f2342d369705b42820895f184066f596381ce1796d4b9dfae82b29de99a0a681be250507b50cb71a87d4deaf13f0b6c9725d4cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu622518.exe

Filesize
487KB

MD5
1091732dd653f3bde46f0b8b1ab46b24

SHA1
32ffd50743e3a66fab2ac07aaf17abafa33ed0f2

SHA256
bd080cf1e8265f2d296d91048e1f6b58c4ce8c8f3388d356d01a05263a7d4fd0

SHA512
6331bd9b0361999813e93de15f2342d369705b42820895f184066f596381ce1796d4b9dfae82b29de99a0a681be250507b50cb71a87d4deaf13f0b6c9725d4cc

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2568-999-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/2568-232-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-1005-0x0000000009020000-0x000000000954C000-memory.dmp

Filesize
5.2MB

Download
memory/2568-1004-0x0000000008E10000-0x0000000008FD2000-memory.dmp

Filesize
1.8MB

Download
memory/2568-1003-0x0000000008D70000-0x0000000008D8E000-memory.dmp

Filesize
120KB

Download
memory/2568-1002-0x0000000008CB0000-0x0000000008D26000-memory.dmp

Filesize
472KB

Download
memory/2568-1001-0x0000000008C60000-0x0000000008CB0000-memory.dmp

Filesize
320KB

Download
memory/2568-1000-0x0000000008B60000-0x0000000008BF2000-memory.dmp

Filesize
584KB

Download
memory/2568-998-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/2568-997-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/2568-996-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/2568-995-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/2568-994-0x00000000078E0000-0x0000000007EF8000-memory.dmp

Filesize
6.1MB

Download
memory/2568-339-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/2568-200-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-199-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-202-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-204-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-206-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-208-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-210-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-212-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-214-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-216-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-218-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-220-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-222-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-224-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-226-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-228-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-230-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/2568-336-0x00000000024A0000-0x00000000024E6000-memory.dmp

Filesize
280KB

Download
memory/2568-337-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3388-1018-0x0000000000C20000-0x0000000000C5B000-memory.dmp

Filesize
236KB

Download
memory/4044-171-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-160-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-194-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/4044-192-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4044-169-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-190-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4044-173-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-189-0x0000000000890000-0x00000000008BD000-memory.dmp

Filesize
180KB

Download
memory/4044-188-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/4044-187-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-185-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-183-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-177-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-181-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-191-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4044-155-0x0000000000890000-0x00000000008BD000-memory.dmp

Filesize
180KB

Download
memory/4044-156-0x0000000004E20000-0x00000000053C4000-memory.dmp

Filesize
5.6MB

Download
memory/4044-167-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-165-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-175-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-157-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4044-163-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-159-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4044-179-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4044-161-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/4044-158-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4976-1012-0x0000000007DD0000-0x0000000007DE0000-memory.dmp

Filesize
64KB

Download
memory/4976-1011-0x0000000000D60000-0x0000000000D88000-memory.dmp

Filesize
160KB

Download