amadey | db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2023 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe
Size

983KB
MD5

7aa3b73956f8d86470af9cc345d87d32
SHA1

c428851ee25dcefe587827e717814a25f5f52c99
SHA256

db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456
SHA512

67701a64d0264018a3f7df072023e48b7665362ec29b4b760c60c05c43dce5f3f0a7e161cb7d41b4e2186c539b4cb9a19fbd77d290cb3bf345e9c5f5201a24fb
SSDEEP

24576:Oy78GGCHRl9tvMwwCgeu0XJcjHY1ockYiggApcZ4a41m6:dAGPRbt4Cg7jHYGck8XENQm

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr994462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr994462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr994462.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr994462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr994462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr994462.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	si464544.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
1072	un699203.exe
4608	un991099.exe
396	pr994462.exe
1928	qu249777.exe
1360	rk183908.exe
992	si464544.exe
4244	oneetx.exe
4780	oneetx.exe
3820	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr994462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr994462.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un699203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un699203.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un991099.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un991099.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
3460	396	WerFault.exe	85
2200	1928	WerFault.exe	91
3272	992	WerFault.exe	95
4584	992	WerFault.exe	95
5056	992	WerFault.exe	95
3136	992	WerFault.exe	95
3820	992	WerFault.exe	95
2400	992	WerFault.exe	95
1552	992	WerFault.exe	95
4932	992	WerFault.exe	95
1436	992	WerFault.exe	95
3456	992	WerFault.exe	95
768	4244	WerFault.exe	115
2108	4244	WerFault.exe	115
4620	4244	WerFault.exe	115
1020	4244	WerFault.exe	115
2768	4244	WerFault.exe	115
1724	4244	WerFault.exe	115
4316	4244	WerFault.exe	115
4400	4244	WerFault.exe	115
1444	4244	WerFault.exe	115
3124	4244	WerFault.exe	115
2312	4244	WerFault.exe	115
4768	4780	WerFault.exe	146
4776	4244	WerFault.exe	115
3004	4244	WerFault.exe	115
5056	4244	WerFault.exe	115
2208	3820	WerFault.exe	156
2892	4244	WerFault.exe	115

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
396	pr994462.exe
396	pr994462.exe
1928	qu249777.exe
1928	qu249777.exe
1360	rk183908.exe
1360	rk183908.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	pr994462.exe
Token: SeDebugPrivilege	1928	qu249777.exe
Token: SeDebugPrivilege	1360	rk183908.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	si464544.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 1072	3148	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe	83
PID 3148 wrote to memory of 1072	3148	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe	83
PID 3148 wrote to memory of 1072	3148	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe	83
PID 1072 wrote to memory of 4608	1072	un699203.exe	84
PID 1072 wrote to memory of 4608	1072	un699203.exe	84
PID 1072 wrote to memory of 4608	1072	un699203.exe	84
PID 4608 wrote to memory of 396	4608	un991099.exe	85
PID 4608 wrote to memory of 396	4608	un991099.exe	85
PID 4608 wrote to memory of 396	4608	un991099.exe	85
PID 4608 wrote to memory of 1928	4608	un991099.exe	91
PID 4608 wrote to memory of 1928	4608	un991099.exe	91
PID 4608 wrote to memory of 1928	4608	un991099.exe	91
PID 1072 wrote to memory of 1360	1072	un699203.exe	94
PID 1072 wrote to memory of 1360	1072	un699203.exe	94
PID 1072 wrote to memory of 1360	1072	un699203.exe	94
PID 3148 wrote to memory of 992	3148	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe	95
PID 3148 wrote to memory of 992	3148	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe	95
PID 3148 wrote to memory of 992	3148	db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe	95
PID 992 wrote to memory of 4244	992	si464544.exe	115
PID 992 wrote to memory of 4244	992	si464544.exe	115
PID 992 wrote to memory of 4244	992	si464544.exe	115
PID 4244 wrote to memory of 3284	4244	oneetx.exe	132
PID 4244 wrote to memory of 3284	4244	oneetx.exe	132
PID 4244 wrote to memory of 3284	4244	oneetx.exe	132
PID 4244 wrote to memory of 2492	4244	oneetx.exe	153
PID 4244 wrote to memory of 2492	4244	oneetx.exe	153
PID 4244 wrote to memory of 2492	4244	oneetx.exe	153

C:\Users\Admin\AppData\Local\Temp\db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe
"C:\Users\Admin\AppData\Local\Temp\db07d4ba800eb14221f810cb087756b1fdf2b8a4ba378e916f894b05a2327456.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699203.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699203.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un991099.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un991099.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr994462.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr994462.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1084
        5⤵
        Program crash
        
        PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu249777.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu249777.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 1944
        5⤵
        Program crash
        
        PID:2200
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk183908.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk183908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464544.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464544.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 712
    3⤵
    - Program crash
    PID:3272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 796
    3⤵
    - Program crash
    PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 796
    3⤵
    - Program crash
    PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 956
    3⤵
    - Program crash
    PID:3136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 968
    3⤵
    - Program crash
    PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 968
    3⤵
    - Program crash
    PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1220
    3⤵
    - Program crash
    PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1224
    3⤵
    - Program crash
    PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1320
    3⤵
    - Program crash
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 708
      4⤵
      Program crash
      PID:768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 888
      4⤵
      Program crash
      PID:2108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 924
      4⤵
      Program crash
      PID:4620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1104
      4⤵
      Program crash
      PID:1020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1112
      4⤵
      Program crash
      PID:2768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1112
      4⤵
      Program crash
      PID:1724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1120
      4⤵
      Program crash
      PID:4316
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1028
      4⤵
      Program crash
      PID:4400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 740
      4⤵
      Program crash
      PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 912
      4⤵
      Program crash
      PID:3124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 712
      4⤵
      Program crash
      PID:2312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1080
      4⤵
      Program crash
      PID:4776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1604
      4⤵
      Program crash
      PID:3004
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1368
      4⤵
      Program crash
      PID:5056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1620
      4⤵
      Program crash
      PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 764
    3⤵
    - Program crash
    PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 396 -ip 396
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1928 -ip 1928
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 992 -ip 992
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 992 -ip 992
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 992 -ip 992
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 992 -ip 992
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 992 -ip 992
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 992 -ip 992
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 992 -ip 992
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 992 -ip 992
1⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 992 -ip 992
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 992 -ip 992
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4244 -ip 4244
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4244 -ip 4244
1⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4244 -ip 4244
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4244 -ip 4244
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4244 -ip 4244
1⤵
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4244 -ip 4244
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4244 -ip 4244
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4244 -ip 4244
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4244 -ip 4244
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4244 -ip 4244
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4244 -ip 4244
1⤵
PID:2808

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 428
  2⤵
  - Program crash
  PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4780 -ip 4780
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4244 -ip 4244
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4244 -ip 4244
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4244 -ip 4244
1⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 424
  2⤵
  - Program crash
  PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3820 -ip 3820
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4244 -ip 4244
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464544.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si464544.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699203.exe

Filesize
709KB

MD5
1616e6865c61c1cd579e631174c1c45b

SHA1
b253e129291e9c562dcbef4eeb8c091861152382

SHA256
fdeba16fd23e64ffb368993315b44c081ff95b1f47a53d7714e230cdcbdd5314

SHA512
f7f943a0cb0629e27aac0a8c316a4aab1c47ac2c03ad42091cb83dfa1fe2d2a4670b2ba99e8fee11234d6734a385fe97565fc5cd6efba3458afb85f7e3ea1dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699203.exe

Filesize
709KB

MD5
1616e6865c61c1cd579e631174c1c45b

SHA1
b253e129291e9c562dcbef4eeb8c091861152382

SHA256
fdeba16fd23e64ffb368993315b44c081ff95b1f47a53d7714e230cdcbdd5314

SHA512
f7f943a0cb0629e27aac0a8c316a4aab1c47ac2c03ad42091cb83dfa1fe2d2a4670b2ba99e8fee11234d6734a385fe97565fc5cd6efba3458afb85f7e3ea1dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk183908.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk183908.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un991099.exe

Filesize
555KB

MD5
5994a19f99e03efb210bd95e9168bf66

SHA1
d90813e7d371789501185e0254c1f5017cd727b8

SHA256
78457380dbee6eb34c8efa72f424e8740b86b227550946699d71fb2672dc0932

SHA512
d58c470422742a6724196b36dfc795cea95dcdf32656458a8097a7717b0da8aea273df121b03d91d642b52a32395fc941df074d0f87422a91bf9e11623ccd5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un991099.exe

Filesize
555KB

MD5
5994a19f99e03efb210bd95e9168bf66

SHA1
d90813e7d371789501185e0254c1f5017cd727b8

SHA256
78457380dbee6eb34c8efa72f424e8740b86b227550946699d71fb2672dc0932

SHA512
d58c470422742a6724196b36dfc795cea95dcdf32656458a8097a7717b0da8aea273df121b03d91d642b52a32395fc941df074d0f87422a91bf9e11623ccd5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr994462.exe

Filesize
255KB

MD5
a9d72ea0618fd5e3952c41a98593331a

SHA1
00ae87ff44ea267c07384f3b6b530910544fe690

SHA256
0d483b36d0e0e55fe83c0aaf85e650478f7377a0373ec71ecafe6a68f7f0c260

SHA512
22bf3978b6327a0457849c7cdb15c8fb0f79817e8b69d1f6a003e87c6f5a8a657aca4ebdfa827bbde38f6f9820aa192ee1abdff52496a6504ae4a5773ea24fc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr994462.exe

Filesize
255KB

MD5
a9d72ea0618fd5e3952c41a98593331a

SHA1
00ae87ff44ea267c07384f3b6b530910544fe690

SHA256
0d483b36d0e0e55fe83c0aaf85e650478f7377a0373ec71ecafe6a68f7f0c260

SHA512
22bf3978b6327a0457849c7cdb15c8fb0f79817e8b69d1f6a003e87c6f5a8a657aca4ebdfa827bbde38f6f9820aa192ee1abdff52496a6504ae4a5773ea24fc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu249777.exe

Filesize
337KB

MD5
8a482c24ce7f3baf5753ead900991257

SHA1
43fa489e0cdefa23519b980252aa293659a651b8

SHA256
df84266dee60df71c157f9c9b0fcb6fac9a36a31e5a22492c952a6383047eb89

SHA512
e9fdd3a27673912a8b0e00814078c03a940153ac0a387c4f211ee4bd5322ec16259530d5717f3f90db87cd02903725b14463bc980f64869812691bfa508ebdd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu249777.exe

Filesize
337KB

MD5
8a482c24ce7f3baf5753ead900991257

SHA1
43fa489e0cdefa23519b980252aa293659a651b8

SHA256
df84266dee60df71c157f9c9b0fcb6fac9a36a31e5a22492c952a6383047eb89

SHA512
e9fdd3a27673912a8b0e00814078c03a940153ac0a387c4f211ee4bd5322ec16259530d5717f3f90db87cd02903725b14463bc980f64869812691bfa508ebdd6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/396-157-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-193-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/396-175-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/396-179-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-177-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-181-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-183-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-185-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-187-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-188-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/396-191-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/396-190-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/396-192-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/396-174-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-155-0x0000000000610000-0x000000000063D000-memory.dmp

Filesize
180KB

Download
memory/396-173-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/396-171-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/396-170-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-168-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-166-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-164-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-162-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-160-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-158-0x00000000026D0000-0x00000000026E2000-memory.dmp

Filesize
72KB

Download
memory/396-156-0x0000000004C30000-0x00000000051D4000-memory.dmp

Filesize
5.6MB

Download
memory/992-1018-0x0000000000840000-0x000000000087B000-memory.dmp

Filesize
236KB

Download
memory/1360-1012-0x0000000007610000-0x0000000007620000-memory.dmp

Filesize
64KB

Download
memory/1360-1011-0x0000000000830000-0x0000000000858000-memory.dmp

Filesize
160KB

Download
memory/1928-205-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-221-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-223-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-225-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-227-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-229-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-231-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-233-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-235-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-994-0x0000000007660000-0x0000000007C78000-memory.dmp

Filesize
6.1MB

Download
memory/1928-995-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

Filesize
72KB

Download
memory/1928-996-0x0000000007C80000-0x0000000007D8A000-memory.dmp

Filesize
1.0MB

Download
memory/1928-997-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1928-998-0x0000000007D90000-0x0000000007DCC000-memory.dmp

Filesize
240KB

Download
memory/1928-999-0x0000000008060000-0x00000000080C6000-memory.dmp

Filesize
408KB

Download
memory/1928-1000-0x0000000008720000-0x00000000087B2000-memory.dmp

Filesize
584KB

Download
memory/1928-1001-0x00000000088F0000-0x0000000008966000-memory.dmp

Filesize
472KB

Download
memory/1928-1002-0x00000000089C0000-0x0000000008B82000-memory.dmp

Filesize
1.8MB

Download
memory/1928-219-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-216-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1928-217-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-215-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1928-213-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1928-211-0x0000000000630000-0x0000000000676000-memory.dmp

Filesize
280KB

Download
memory/1928-212-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-209-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-207-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-203-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-198-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-201-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-199-0x00000000025F0000-0x0000000002625000-memory.dmp

Filesize
212KB

Download
memory/1928-1003-0x0000000008BB0000-0x00000000090DC000-memory.dmp

Filesize
5.2MB

Download
memory/1928-1004-0x0000000009320000-0x000000000933E000-memory.dmp

Filesize
120KB

Download
memory/1928-1005-0x0000000004690000-0x00000000046E0000-memory.dmp

Filesize
320KB

Download