amadey | 6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2023, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe
Size

1.1MB
MD5

b6ae544084d56591d6d7034322b674e3
SHA1

19b22f94b584b42705bb8f311d9beec055835109
SHA256

6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36
SHA512

bbfc22365c88e8d3adf5d75b5a774fe505fee4a150582920978b39a513be9ed294098ee6ad4065a7f522d69620576b4f5e5a69fcd0fd58b6ca93800424319a0c
SSDEEP

24576:Ky8i+56vtQgzbbaPNYGhOuS5eP8dXAShNYnUedcK6ZU9Qjb:RTe6zXaPy8Rqe+bhW3dcK64Q

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr609549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr609549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr609549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr609549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr609549.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr609549.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	si664141.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
2384	un951199.exe
2600	un930408.exe
1472	pr609549.exe
888	qu499500.exe
2016	rk839546.exe
3588	si664141.exe
1536	oneetx.exe
2876	oneetx.exe
3220	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
3852	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr609549.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr609549.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un930408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un930408.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un951199.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un951199.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
1276	1472	WerFault.exe	86
1028	888	WerFault.exe	92
760	3588	WerFault.exe	97
3316	3588	WerFault.exe	97
1516	3588	WerFault.exe	97
4672	3588	WerFault.exe	97
3752	3588	WerFault.exe	97
4548	3588	WerFault.exe	97
1060	3588	WerFault.exe	97
3192	3588	WerFault.exe	97
1068	3588	WerFault.exe	97
4988	3588	WerFault.exe	97
1780	1536	WerFault.exe	119
3908	1536	WerFault.exe	119
768	1536	WerFault.exe	119
644	1536	WerFault.exe	119
1824	1536	WerFault.exe	119
2156	1536	WerFault.exe	119
4216	1536	WerFault.exe	119
820	1536	WerFault.exe	119
2012	1536	WerFault.exe	119
3292	1536	WerFault.exe	119
2120	1536	WerFault.exe	119
2444	1536	WerFault.exe	119
3016	2876	WerFault.exe	149
4204	1536	WerFault.exe	119
3920	1536	WerFault.exe	119
684	1536	WerFault.exe	119
1760	3220	WerFault.exe	159
4328	1536	WerFault.exe	119

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1472	pr609549.exe
1472	pr609549.exe
888	qu499500.exe
888	qu499500.exe
2016	rk839546.exe
2016	rk839546.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	pr609549.exe
Token: SeDebugPrivilege	888	qu499500.exe
Token: SeDebugPrivilege	2016	rk839546.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3588	si664141.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2384	4596	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe	84
PID 4596 wrote to memory of 2384	4596	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe	84
PID 4596 wrote to memory of 2384	4596	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe	84
PID 2384 wrote to memory of 2600	2384	un951199.exe	85
PID 2384 wrote to memory of 2600	2384	un951199.exe	85
PID 2384 wrote to memory of 2600	2384	un951199.exe	85
PID 2600 wrote to memory of 1472	2600	un930408.exe	86
PID 2600 wrote to memory of 1472	2600	un930408.exe	86
PID 2600 wrote to memory of 1472	2600	un930408.exe	86
PID 2600 wrote to memory of 888	2600	un930408.exe	92
PID 2600 wrote to memory of 888	2600	un930408.exe	92
PID 2600 wrote to memory of 888	2600	un930408.exe	92
PID 2384 wrote to memory of 2016	2384	un951199.exe	95
PID 2384 wrote to memory of 2016	2384	un951199.exe	95
PID 2384 wrote to memory of 2016	2384	un951199.exe	95
PID 4596 wrote to memory of 3588	4596	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe	97
PID 4596 wrote to memory of 3588	4596	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe	97
PID 4596 wrote to memory of 3588	4596	6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe	97
PID 3588 wrote to memory of 1536	3588	si664141.exe	119
PID 3588 wrote to memory of 1536	3588	si664141.exe	119
PID 3588 wrote to memory of 1536	3588	si664141.exe	119
PID 1536 wrote to memory of 3336	1536	oneetx.exe	137
PID 1536 wrote to memory of 3336	1536	oneetx.exe	137
PID 1536 wrote to memory of 3336	1536	oneetx.exe	137
PID 1536 wrote to memory of 3852	1536	oneetx.exe	156
PID 1536 wrote to memory of 3852	1536	oneetx.exe	156
PID 1536 wrote to memory of 3852	1536	oneetx.exe	156

C:\Users\Admin\AppData\Local\Temp\6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe
"C:\Users\Admin\AppData\Local\Temp\6ff0d834172b219646fd303252547721abb395d65f7fc437d58dc09075067e36.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un951199.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un951199.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un930408.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un930408.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr609549.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr609549.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1088
        5⤵
        Program crash
        
        PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu499500.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu499500.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 1324
        5⤵
        Program crash
        
        PID:1028
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk839546.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk839546.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si664141.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si664141.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 696
    3⤵
    - Program crash
    PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 780
    3⤵
    - Program crash
    PID:3316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 808
    3⤵
    - Program crash
    PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 976
    3⤵
    - Program crash
    PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 996
    3⤵
    - Program crash
    PID:3752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 984
    3⤵
    - Program crash
    PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1220
    3⤵
    - Program crash
    PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1240
    3⤵
    - Program crash
    PID:3192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1320
    3⤵
    - Program crash
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 692
      4⤵
      Program crash
      PID:1780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 836
      4⤵
      Program crash
      PID:3908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 976
      4⤵
      Program crash
      PID:768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 868
      4⤵
      Program crash
      PID:644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 984
      4⤵
      Program crash
      PID:1824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1108
      4⤵
      Program crash
      PID:2156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1128
      4⤵
      Program crash
      PID:4216
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1020
      4⤵
      Program crash
      PID:820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 692
      4⤵
      Program crash
      PID:2012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1020
      4⤵
      Program crash
      PID:3292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 776
      4⤵
      Program crash
      PID:2120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1504
      4⤵
      Program crash
      PID:2444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1160
      4⤵
      Program crash
      PID:4204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1632
      4⤵
      Program crash
      PID:3920
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:3852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 760
      4⤵
      Program crash
      PID:684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1648
      4⤵
      Program crash
      PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1760
    3⤵
    - Program crash
    PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1472 -ip 1472
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 888 -ip 888
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3588 -ip 3588
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3588 -ip 3588
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3588 -ip 3588
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3588 -ip 3588
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3588 -ip 3588
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3588 -ip 3588
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3588 -ip 3588
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3588 -ip 3588
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3588 -ip 3588
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1536 -ip 1536
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1536 -ip 1536
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1536 -ip 1536
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1536 -ip 1536
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1536 -ip 1536
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1536 -ip 1536
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1536 -ip 1536
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1536 -ip 1536
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1536 -ip 1536
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1536 -ip 1536
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1536 -ip 1536
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1536 -ip 1536
1⤵
PID:4440

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 312
  2⤵
  - Program crash
  PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2876 -ip 2876
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1536 -ip 1536
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1536 -ip 1536
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1536 -ip 1536
1⤵
PID:2176

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 312
  2⤵
  - Program crash
  PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3220 -ip 3220
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1536 -ip 1536
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si664141.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si664141.exe

Filesize
396KB

MD5
886f67abb465e64a178c5a9f465fae0c

SHA1
d9b9deab1f4526a9204122509bf4eec058085fd7

SHA256
4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333

SHA512
cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un951199.exe

Filesize
759KB

MD5
9e9d8433e8d8ef0a0f8631f5709170b2

SHA1
8b416125ebfbb94a07b30501fa1cba74f20fdff0

SHA256
f76acec5328920277c7d8a4de9fe7e296e26d43dd257b6489974b587cd37219f

SHA512
373e718f1d540886213cf4eeba198cce17a7ad4dbaf4bf8d151a8bc2e10cd7984627be3b3784f12678a7a822f084bcebcf1cb3a9f2255cd929002c12ee4b5fd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un951199.exe

Filesize
759KB

MD5
9e9d8433e8d8ef0a0f8631f5709170b2

SHA1
8b416125ebfbb94a07b30501fa1cba74f20fdff0

SHA256
f76acec5328920277c7d8a4de9fe7e296e26d43dd257b6489974b587cd37219f

SHA512
373e718f1d540886213cf4eeba198cce17a7ad4dbaf4bf8d151a8bc2e10cd7984627be3b3784f12678a7a822f084bcebcf1cb3a9f2255cd929002c12ee4b5fd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk839546.exe

Filesize
136KB

MD5
22f8f3e2a8eb6e789e6e5ebeb5e822ec

SHA1
d244dc6bf7b5b9e56fc388562c2e63985bdd197a

SHA256
f46df64e4c198afcc0b1bc9be348f660e398d66d93d1dba01059ff3663ed9cb5

SHA512
839108e922d38e64d6e9d9f9bf8b7251aea899237d880d53f88d3333cbc2090de8a5d044a070623f46129c9b932b3c7345b5128d3cff84f10d8c44acc714b4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk839546.exe

Filesize
136KB

MD5
22f8f3e2a8eb6e789e6e5ebeb5e822ec

SHA1
d244dc6bf7b5b9e56fc388562c2e63985bdd197a

SHA256
f46df64e4c198afcc0b1bc9be348f660e398d66d93d1dba01059ff3663ed9cb5

SHA512
839108e922d38e64d6e9d9f9bf8b7251aea899237d880d53f88d3333cbc2090de8a5d044a070623f46129c9b932b3c7345b5128d3cff84f10d8c44acc714b4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un930408.exe

Filesize
605KB

MD5
5241811aedb0f41ef643ff6c42294a54

SHA1
ea0ff16034cf7beb4f930114d494acad56a62fcd

SHA256
8dcd0f8a494e044b3b476327b0697d124b4352e1c686d8f2573c208558e4f02e

SHA512
45351fab0d454cd4518ea539a151018a97394aac06a07b2e6b6c865b2282c90a4fa30a292682812c8c6a26554e7cd5dbec3782a84009a834a1fe504d786a7adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un930408.exe

Filesize
605KB

MD5
5241811aedb0f41ef643ff6c42294a54

SHA1
ea0ff16034cf7beb4f930114d494acad56a62fcd

SHA256
8dcd0f8a494e044b3b476327b0697d124b4352e1c686d8f2573c208558e4f02e

SHA512
45351fab0d454cd4518ea539a151018a97394aac06a07b2e6b6c865b2282c90a4fa30a292682812c8c6a26554e7cd5dbec3782a84009a834a1fe504d786a7adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr609549.exe

Filesize
404KB

MD5
53451f68dbe54be00950edbffc358e07

SHA1
50e109a65fd70c55d9878266a423426f476616d6

SHA256
5f80e4d9179558b0349600d6ed4b2ee76069df9dbc283621215734cfa86af823

SHA512
8e8ff684e5dd988d29a83e655a23681a2226903c3b16fe3dc8b511960a6c6b43c4ffbf4c10e13f757d9749887f329d5cd28c55daea177703492816e6d986b009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr609549.exe

Filesize
404KB

MD5
53451f68dbe54be00950edbffc358e07

SHA1
50e109a65fd70c55d9878266a423426f476616d6

SHA256
5f80e4d9179558b0349600d6ed4b2ee76069df9dbc283621215734cfa86af823

SHA512
8e8ff684e5dd988d29a83e655a23681a2226903c3b16fe3dc8b511960a6c6b43c4ffbf4c10e13f757d9749887f329d5cd28c55daea177703492816e6d986b009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu499500.exe

Filesize
486KB

MD5
5da3fba8c9ad87fd693844ef8458d474

SHA1
7e1d50824b735510937ff09378466cbb5d0b4cb2

SHA256
1d671cf5ffd11e1b0b0281246d8dddb4674fa6ba668930827a1ace57cc9b576f

SHA512
4164ebad3686171095bfcc9e6cbba8b070e465203ef404bb0ec375301fc47d85717352845c2e4d54d86c69554f9d264573d1afcfa99df2adbff9669e87fbccc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu499500.exe

Filesize
486KB

MD5
5da3fba8c9ad87fd693844ef8458d474

SHA1
7e1d50824b735510937ff09378466cbb5d0b4cb2

SHA256
1d671cf5ffd11e1b0b0281246d8dddb4674fa6ba668930827a1ace57cc9b576f

SHA512
4164ebad3686171095bfcc9e6cbba8b070e465203ef404bb0ec375301fc47d85717352845c2e4d54d86c69554f9d264573d1afcfa99df2adbff9669e87fbccc1

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/888-999-0x0000000008BB0000-0x0000000008C42000-memory.dmp

Filesize
584KB

Download
memory/888-413-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/888-1004-0x00000000096C0000-0x00000000096DE000-memory.dmp

Filesize
120KB

Download
memory/888-1003-0x0000000009090000-0x00000000095BC000-memory.dmp

Filesize
5.2MB

Download
memory/888-1002-0x0000000008EB0000-0x0000000009072000-memory.dmp

Filesize
1.8MB

Download
memory/888-1001-0x0000000008DD0000-0x0000000008E46000-memory.dmp

Filesize
472KB

Download
memory/888-1000-0x0000000008D80000-0x0000000008DD0000-memory.dmp

Filesize
320KB

Download
memory/888-998-0x00000000084F0000-0x0000000008556000-memory.dmp

Filesize
408KB

Download
memory/888-997-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/888-996-0x0000000008210000-0x000000000824C000-memory.dmp

Filesize
240KB

Download
memory/888-995-0x0000000008100000-0x000000000820A000-memory.dmp

Filesize
1.0MB

Download
memory/888-197-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-198-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-200-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-204-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-202-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-206-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-208-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-210-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-212-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-214-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-216-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-218-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-220-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-222-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-224-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-226-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-228-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-230-0x0000000004F60000-0x0000000004F95000-memory.dmp

Filesize
212KB

Download
memory/888-406-0x0000000000970000-0x00000000009B6000-memory.dmp

Filesize
280KB

Download
memory/888-409-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/888-994-0x0000000005050000-0x0000000005062000-memory.dmp

Filesize
72KB

Download
memory/888-411-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/888-993-0x0000000007AE0000-0x00000000080F8000-memory.dmp

Filesize
6.1MB

Download
memory/1472-170-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1472-158-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-179-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-192-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/1472-190-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1472-175-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-189-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1472-188-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/1472-187-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-185-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-183-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-155-0x00000000009A0000-0x00000000009CD000-memory.dmp

Filesize
180KB

Download
memory/1472-177-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-181-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-173-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-171-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-167-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1472-156-0x0000000004EF0000-0x0000000005494000-memory.dmp

Filesize
5.6MB

Download
memory/1472-168-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-165-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1472-164-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-162-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-160-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1472-157-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/2016-1011-0x0000000000BA0000-0x0000000000BC8000-memory.dmp

Filesize
160KB

Download
memory/2016-1012-0x0000000007930000-0x0000000007940000-memory.dmp

Filesize
64KB

Download
memory/3588-1018-0x0000000002440000-0x000000000247B000-memory.dmp

Filesize
236KB

Download