amadey | 46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4

Analysis

max time kernel
147s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe
Size

1.1MB
MD5

52128df1c3f885289e245ba0d7ecdffe
SHA1

eba9091567a40fa88f9f7a2bfa7ea2b3ade242fc
SHA256

46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4
SHA512

ceeda6701dda78c603c37ec10f1f84d04d109c4c17b4561c8f5a902ddf1098e3f23570045d0f87717a68d13ecf3a4d30396d6553e3229940151360597110c1d1
SSDEEP

24576:eyg5qBzdBeVdtaB5a33KrBWbkQVSqFcbgd6lwE6wNQBqE:tJBHqtaBn18k/DkdVdfB

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr234977.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr234977.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr234977.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr234977.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr234977.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr234977.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	si882993.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
1896	un524925.exe
4912	un245053.exe
2252	pr234977.exe
2144	qu560630.exe
3536	rk762433.exe
3992	si882993.exe
1140	oneetx.exe
4080	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
4688	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr234977.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr234977.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un245053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un245053.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un524925.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un524925.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
3916	2252	WerFault.exe	86
4708	2144	WerFault.exe	92
4472	3992	WerFault.exe	97
2712	3992	WerFault.exe	97
840	3992	WerFault.exe	97
1272	3992	WerFault.exe	97
2044	3992	WerFault.exe	97
4356	3992	WerFault.exe	97
3768	3992	WerFault.exe	97
4208	3992	WerFault.exe	97
216	3992	WerFault.exe	97
2636	3992	WerFault.exe	97
3404	1140	WerFault.exe	117
3552	1140	WerFault.exe	117
4460	1140	WerFault.exe	117
4348	1140	WerFault.exe	117
5076	1140	WerFault.exe	117
4696	1140	WerFault.exe	117
1264	1140	WerFault.exe	117
3912	1140	WerFault.exe	117
5004	1140	WerFault.exe	117
5068	1140	WerFault.exe	117
1956	1140	WerFault.exe	117
1252	1140	WerFault.exe	117
1876	1140	WerFault.exe	117
3152	1140	WerFault.exe	117
4076	1140	WerFault.exe	117
4208	4080	WerFault.exe	156
2272	1140	WerFault.exe	117

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2252	pr234977.exe
2252	pr234977.exe
2144	qu560630.exe
2144	qu560630.exe
3536	rk762433.exe
3536	rk762433.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	pr234977.exe
Token: SeDebugPrivilege	2144	qu560630.exe
Token: SeDebugPrivilege	3536	rk762433.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3992	si882993.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1896	3364	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe	84
PID 3364 wrote to memory of 1896	3364	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe	84
PID 3364 wrote to memory of 1896	3364	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe	84
PID 1896 wrote to memory of 4912	1896	un524925.exe	85
PID 1896 wrote to memory of 4912	1896	un524925.exe	85
PID 1896 wrote to memory of 4912	1896	un524925.exe	85
PID 4912 wrote to memory of 2252	4912	un245053.exe	86
PID 4912 wrote to memory of 2252	4912	un245053.exe	86
PID 4912 wrote to memory of 2252	4912	un245053.exe	86
PID 4912 wrote to memory of 2144	4912	un245053.exe	92
PID 4912 wrote to memory of 2144	4912	un245053.exe	92
PID 4912 wrote to memory of 2144	4912	un245053.exe	92
PID 1896 wrote to memory of 3536	1896	un524925.exe	95
PID 1896 wrote to memory of 3536	1896	un524925.exe	95
PID 1896 wrote to memory of 3536	1896	un524925.exe	95
PID 3364 wrote to memory of 3992	3364	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe	97
PID 3364 wrote to memory of 3992	3364	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe	97
PID 3364 wrote to memory of 3992	3364	46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe	97
PID 3992 wrote to memory of 1140	3992	si882993.exe	117
PID 3992 wrote to memory of 1140	3992	si882993.exe	117
PID 3992 wrote to memory of 1140	3992	si882993.exe	117
PID 1140 wrote to memory of 1396	1140	oneetx.exe	136
PID 1140 wrote to memory of 1396	1140	oneetx.exe	136
PID 1140 wrote to memory of 1396	1140	oneetx.exe	136
PID 1140 wrote to memory of 4688	1140	oneetx.exe	153
PID 1140 wrote to memory of 4688	1140	oneetx.exe	153
PID 1140 wrote to memory of 4688	1140	oneetx.exe	153

C:\Users\Admin\AppData\Local\Temp\46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe
"C:\Users\Admin\AppData\Local\Temp\46eef9428206f9323a75686d3660d205664e676ab805720ebd413a113d4c0ed4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un524925.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un524925.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un245053.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un245053.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr234977.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr234977.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 1080
        5⤵
        Program crash
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu560630.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu560630.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1984
        5⤵
        Program crash
        
        PID:4708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk762433.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk762433.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si882993.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si882993.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 696
    3⤵
    - Program crash
    PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 780
    3⤵
    - Program crash
    PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 856
    3⤵
    - Program crash
    PID:840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 976
    3⤵
    - Program crash
    PID:1272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 864
    3⤵
    - Program crash
    PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 864
    3⤵
    - Program crash
    PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1220
    3⤵
    - Program crash
    PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1208
    3⤵
    - Program crash
    PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1320
    3⤵
    - Program crash
    PID:216
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 692
      4⤵
      Program crash
      PID:3404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 836
      4⤵
      Program crash
      PID:3552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 848
      4⤵
      Program crash
      PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1052
      4⤵
      Program crash
      PID:4348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1092
      4⤵
      Program crash
      PID:5076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1052
      4⤵
      Program crash
      PID:4696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1112
      4⤵
      Program crash
      PID:1264
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1004
      4⤵
      Program crash
      PID:3912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1264
      4⤵
      Program crash
      PID:5004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 756
      4⤵
      Program crash
      PID:5068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 744
      4⤵
      Program crash
      PID:1956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1436
      4⤵
      Program crash
      PID:1252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1088
      4⤵
      Program crash
      PID:1876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1644
      4⤵
      Program crash
      PID:3152
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1372
      4⤵
      Program crash
      PID:4076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1660
      4⤵
      Program crash
      PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 748
    3⤵
    - Program crash
    PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2252 -ip 2252
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2144 -ip 2144
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3992 -ip 3992
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3992 -ip 3992
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3992 -ip 3992
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3992 -ip 3992
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3992 -ip 3992
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3992 -ip 3992
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3992 -ip 3992
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3992 -ip 3992
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3992 -ip 3992
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3992 -ip 3992
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1140 -ip 1140
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1140 -ip 1140
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1140 -ip 1140
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1140 -ip 1140
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1140 -ip 1140
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1140 -ip 1140
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1140 -ip 1140
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1140 -ip 1140
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1140 -ip 1140
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1140 -ip 1140
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1140 -ip 1140
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1140 -ip 1140
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1140 -ip 1140
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1140 -ip 1140
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1140 -ip 1140
1⤵
PID:4960

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 312
  2⤵
  - Program crash
  PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4080 -ip 4080
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1140 -ip 1140
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
390KB

MD5
5ed9270ca56d41db87987823290dfa15

SHA1
89f81232efb22eb536efd30fa52ed8710601b592

SHA256
74c8d2e808ec0734e30d03e29b9a17b020bdbe85b6584c1aa501ba892ae4a054

SHA512
e612b392272b0b6cf27582286e1ac92a5609bb51f72af0c8acdb489ad6e3ab1ecba5470cf391015dab06dc67c01726da60f3bc9da68dfd3e2f84b2716443d4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
390KB

MD5
5ed9270ca56d41db87987823290dfa15

SHA1
89f81232efb22eb536efd30fa52ed8710601b592

SHA256
74c8d2e808ec0734e30d03e29b9a17b020bdbe85b6584c1aa501ba892ae4a054

SHA512
e612b392272b0b6cf27582286e1ac92a5609bb51f72af0c8acdb489ad6e3ab1ecba5470cf391015dab06dc67c01726da60f3bc9da68dfd3e2f84b2716443d4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
390KB

MD5
5ed9270ca56d41db87987823290dfa15

SHA1
89f81232efb22eb536efd30fa52ed8710601b592

SHA256
74c8d2e808ec0734e30d03e29b9a17b020bdbe85b6584c1aa501ba892ae4a054

SHA512
e612b392272b0b6cf27582286e1ac92a5609bb51f72af0c8acdb489ad6e3ab1ecba5470cf391015dab06dc67c01726da60f3bc9da68dfd3e2f84b2716443d4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
390KB

MD5
5ed9270ca56d41db87987823290dfa15

SHA1
89f81232efb22eb536efd30fa52ed8710601b592

SHA256
74c8d2e808ec0734e30d03e29b9a17b020bdbe85b6584c1aa501ba892ae4a054

SHA512
e612b392272b0b6cf27582286e1ac92a5609bb51f72af0c8acdb489ad6e3ab1ecba5470cf391015dab06dc67c01726da60f3bc9da68dfd3e2f84b2716443d4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si882993.exe

Filesize
390KB

MD5
5ed9270ca56d41db87987823290dfa15

SHA1
89f81232efb22eb536efd30fa52ed8710601b592

SHA256
74c8d2e808ec0734e30d03e29b9a17b020bdbe85b6584c1aa501ba892ae4a054

SHA512
e612b392272b0b6cf27582286e1ac92a5609bb51f72af0c8acdb489ad6e3ab1ecba5470cf391015dab06dc67c01726da60f3bc9da68dfd3e2f84b2716443d4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si882993.exe

Filesize
390KB

MD5
5ed9270ca56d41db87987823290dfa15

SHA1
89f81232efb22eb536efd30fa52ed8710601b592

SHA256
74c8d2e808ec0734e30d03e29b9a17b020bdbe85b6584c1aa501ba892ae4a054

SHA512
e612b392272b0b6cf27582286e1ac92a5609bb51f72af0c8acdb489ad6e3ab1ecba5470cf391015dab06dc67c01726da60f3bc9da68dfd3e2f84b2716443d4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un524925.exe

Filesize
763KB

MD5
5ab58d4dfdbf37ef7325580d7c740d9c

SHA1
d1a2636b269d8d8df3655fbe4546c7f0da72eead

SHA256
e8c68387cb8da6b1fd26c498fb166b3358567d60f186d41c6cae2246f80c0246

SHA512
b6e080d3fde05765c83ddb54640cecafa2ce25a522fb9ee18e36a8189e247f46b417d2ab4ba02ef4a92febacf7b0c5460781680343196b68a043c3ec674d866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un524925.exe

Filesize
763KB

MD5
5ab58d4dfdbf37ef7325580d7c740d9c

SHA1
d1a2636b269d8d8df3655fbe4546c7f0da72eead

SHA256
e8c68387cb8da6b1fd26c498fb166b3358567d60f186d41c6cae2246f80c0246

SHA512
b6e080d3fde05765c83ddb54640cecafa2ce25a522fb9ee18e36a8189e247f46b417d2ab4ba02ef4a92febacf7b0c5460781680343196b68a043c3ec674d866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk762433.exe

Filesize
136KB

MD5
1bff4919f9c14b0392b89a04a4b9b35a

SHA1
06f2ef796cb23a531d060b24f5db3dd04675c0d9

SHA256
7a8d11085856ad2e162fda2ce65d74d64e8d57b8aaf9ceefe72fb62a6eb85fa9

SHA512
c4494b86e336bdeb67bfda7d7fd410f2923a6ec4ed362a08cfeb3b924aee5ae1a0bdc409ae13be373173c95966ea63a59fd51a6c9d7a4e20e746eea72dbdd70f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk762433.exe

Filesize
136KB

MD5
1bff4919f9c14b0392b89a04a4b9b35a

SHA1
06f2ef796cb23a531d060b24f5db3dd04675c0d9

SHA256
7a8d11085856ad2e162fda2ce65d74d64e8d57b8aaf9ceefe72fb62a6eb85fa9

SHA512
c4494b86e336bdeb67bfda7d7fd410f2923a6ec4ed362a08cfeb3b924aee5ae1a0bdc409ae13be373173c95966ea63a59fd51a6c9d7a4e20e746eea72dbdd70f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un245053.exe

Filesize
609KB

MD5
a9776f85be63bc2308080667150a59c7

SHA1
c488802ba763f2198eee5e53b271abe1397b1ee9

SHA256
dd713306876c594ed241904c1b75525a304f1b5db434d8f323b0bbca7195e2fe

SHA512
fe9db28f340670bb004c85f7bfe6d4d52a21546167f326af3aca9e7d76c33fcf58903ae47f182a20f78af06229d644b4593e82dcab0f39d232af2dcd670ebca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un245053.exe

Filesize
609KB

MD5
a9776f85be63bc2308080667150a59c7

SHA1
c488802ba763f2198eee5e53b271abe1397b1ee9

SHA256
dd713306876c594ed241904c1b75525a304f1b5db434d8f323b0bbca7195e2fe

SHA512
fe9db28f340670bb004c85f7bfe6d4d52a21546167f326af3aca9e7d76c33fcf58903ae47f182a20f78af06229d644b4593e82dcab0f39d232af2dcd670ebca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr234977.exe

Filesize
399KB

MD5
c75caf05124803d482d071f998ea0f9c

SHA1
8d87b1c1899bf8d55fb868235048f2a485430a77

SHA256
ffaa2b813c067d0aaf94c557eb006a52335c96d7c1789b31e4a617228c1791c0

SHA512
057c69b3a463e127021f69f95d1db5aa1a7579493f5dd18c76615408010a08e5696ade842f562defeeddf1fa54f75a8e32cdc158974a9ec116fd1ee30bd5b924

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr234977.exe

Filesize
399KB

MD5
c75caf05124803d482d071f998ea0f9c

SHA1
8d87b1c1899bf8d55fb868235048f2a485430a77

SHA256
ffaa2b813c067d0aaf94c557eb006a52335c96d7c1789b31e4a617228c1791c0

SHA512
057c69b3a463e127021f69f95d1db5aa1a7579493f5dd18c76615408010a08e5696ade842f562defeeddf1fa54f75a8e32cdc158974a9ec116fd1ee30bd5b924

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu560630.exe

Filesize
481KB

MD5
4dab43da6410567481224800377a3206

SHA1
85d0ccb2fcb8287ba0d8257d747940f9e2beff28

SHA256
8629d853a48404a4e2e38a79504161a3ea08e7b86d2a44f1fdd5a3b4827680e2

SHA512
3af330a58fe9176b190c01ed4be814cfe322bf0af6393108fc24820bfdd071903d20e8ce53518ebcfcde5494c2a3c86d3a09328981d21daf07eb8849a7deb113

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu560630.exe

Filesize
481KB

MD5
4dab43da6410567481224800377a3206

SHA1
85d0ccb2fcb8287ba0d8257d747940f9e2beff28

SHA256
8629d853a48404a4e2e38a79504161a3ea08e7b86d2a44f1fdd5a3b4827680e2

SHA512
3af330a58fe9176b190c01ed4be814cfe322bf0af6393108fc24820bfdd071903d20e8ce53518ebcfcde5494c2a3c86d3a09328981d21daf07eb8849a7deb113

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2144-999-0x0000000008C30000-0x0000000008C80000-memory.dmp

Filesize
320KB

Download
memory/2144-229-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-1008-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2144-1007-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2144-1006-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2144-1003-0x0000000009590000-0x00000000095AE000-memory.dmp

Filesize
120KB

Download
memory/2144-1002-0x0000000008F50000-0x000000000947C000-memory.dmp

Filesize
5.2MB

Download
memory/2144-1001-0x0000000008D70000-0x0000000008F32000-memory.dmp

Filesize
1.8MB

Download
memory/2144-1000-0x0000000008C90000-0x0000000008D06000-memory.dmp

Filesize
472KB

Download
memory/2144-998-0x0000000008A80000-0x0000000008B12000-memory.dmp

Filesize
584KB

Download
memory/2144-997-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/2144-996-0x0000000008100000-0x000000000813C000-memory.dmp

Filesize
240KB

Download
memory/2144-197-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-198-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-200-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-202-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-204-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-206-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-208-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-210-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-214-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2144-216-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2144-213-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-217-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-212-0x0000000000AC0000-0x0000000000B06000-memory.dmp

Filesize
280KB

Download
memory/2144-219-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-221-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-223-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-225-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-227-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-231-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-995-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2144-233-0x00000000028C0000-0x00000000028F5000-memory.dmp

Filesize
212KB

Download
memory/2144-992-0x00000000078C0000-0x0000000007ED8000-memory.dmp

Filesize
6.1MB

Download
memory/2144-993-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/2144-994-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/2252-171-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-158-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2252-177-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-192-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/2252-173-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-190-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2252-189-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2252-188-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/2252-187-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-185-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-183-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-155-0x0000000000A90000-0x0000000000ABD000-memory.dmp

Filesize
180KB

Download
memory/2252-175-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-179-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-181-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-156-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2252-167-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-165-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-169-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-163-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-160-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-161-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2252-159-0x0000000005030000-0x00000000055D4000-memory.dmp

Filesize
5.6MB

Download
memory/2252-157-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/3536-1014-0x0000000007830000-0x0000000007840000-memory.dmp

Filesize
64KB

Download
memory/3536-1013-0x0000000000680000-0x00000000006A8000-memory.dmp

Filesize
160KB

Download
memory/3992-1020-0x00000000024A0000-0x00000000024DB000-memory.dmp

Filesize
236KB

Download