amadey | 25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2023 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe
Size

982KB
MD5

6a0858cfbab00fd52083b750c51e077c
SHA1

6f52274e466492610c21dee6043eb652c19aa138
SHA256

25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0
SHA512

e87e0f2bbb4f1245b01d8eb9f01d6e4a883152c6a6fcdb8c9d39d8970a37b7ea900251548231bad74de62e696f7398eb0cded1b6d64246db9d4e43188d1ae0c9
SSDEEP

24576:wyX5MEO1eqqZ91aLsvF/+mueaQtaJ3rwwLgfPUN:3X5MeBseaQI3S

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr967863.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr967863.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr967863.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr967863.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr967863.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr967863.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	si197914.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
1700	un822194.exe
3956	un458190.exe
3836	pr967863.exe
1404	qu225612.exe
4848	rk124341.exe
1020	si197914.exe
3324	oneetx.exe
3804	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
3164	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr967863.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr967863.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un822194.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un458190.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un458190.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un822194.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
4728	3836	WerFault.exe	85
3228	1404	WerFault.exe	91
3536	1020	WerFault.exe	95
1868	1020	WerFault.exe	95
4424	1020	WerFault.exe	95
2540	1020	WerFault.exe	95
1648	1020	WerFault.exe	95
1064	1020	WerFault.exe	95
1876	1020	WerFault.exe	95
4008	1020	WerFault.exe	95
4464	1020	WerFault.exe	95
3980	1020	WerFault.exe	95
3908	3324	WerFault.exe	115
3860	3324	WerFault.exe	115
860	3324	WerFault.exe	115
3340	3324	WerFault.exe	115
312	3324	WerFault.exe	115
3296	3324	WerFault.exe	115
4256	3324	WerFault.exe	115
4204	3324	WerFault.exe	115
3468	3324	WerFault.exe	115
404	3324	WerFault.exe	115
1324	3324	WerFault.exe	115
2612	3324	WerFault.exe	115
3020	3324	WerFault.exe	115
2740	3324	WerFault.exe	115
4872	3804	WerFault.exe	153
5036	3324	WerFault.exe	115

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3836	pr967863.exe
3836	pr967863.exe
1404	qu225612.exe
1404	qu225612.exe
4848	rk124341.exe
4848	rk124341.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	pr967863.exe
Token: SeDebugPrivilege	1404	qu225612.exe
Token: SeDebugPrivilege	4848	rk124341.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1020	si197914.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1700	1608	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe	83
PID 1608 wrote to memory of 1700	1608	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe	83
PID 1608 wrote to memory of 1700	1608	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe	83
PID 1700 wrote to memory of 3956	1700	un822194.exe	84
PID 1700 wrote to memory of 3956	1700	un822194.exe	84
PID 1700 wrote to memory of 3956	1700	un822194.exe	84
PID 3956 wrote to memory of 3836	3956	un458190.exe	85
PID 3956 wrote to memory of 3836	3956	un458190.exe	85
PID 3956 wrote to memory of 3836	3956	un458190.exe	85
PID 3956 wrote to memory of 1404	3956	un458190.exe	91
PID 3956 wrote to memory of 1404	3956	un458190.exe	91
PID 3956 wrote to memory of 1404	3956	un458190.exe	91
PID 1700 wrote to memory of 4848	1700	un822194.exe	94
PID 1700 wrote to memory of 4848	1700	un822194.exe	94
PID 1700 wrote to memory of 4848	1700	un822194.exe	94
PID 1608 wrote to memory of 1020	1608	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe	95
PID 1608 wrote to memory of 1020	1608	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe	95
PID 1608 wrote to memory of 1020	1608	25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe	95
PID 1020 wrote to memory of 3324	1020	si197914.exe	115
PID 1020 wrote to memory of 3324	1020	si197914.exe	115
PID 1020 wrote to memory of 3324	1020	si197914.exe	115
PID 3324 wrote to memory of 3840	3324	oneetx.exe	133
PID 3324 wrote to memory of 3840	3324	oneetx.exe	133
PID 3324 wrote to memory of 3840	3324	oneetx.exe	133
PID 3324 wrote to memory of 3164	3324	oneetx.exe	150
PID 3324 wrote to memory of 3164	3324	oneetx.exe	150
PID 3324 wrote to memory of 3164	3324	oneetx.exe	150

C:\Users\Admin\AppData\Local\Temp\25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe
"C:\Users\Admin\AppData\Local\Temp\25cb422c469c32f4541270c36fb1528c0c0738839260601f6d9c7a5d014682f0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822194.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822194.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un458190.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un458190.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr967863.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr967863.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1088
        5⤵
        Program crash
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu225612.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu225612.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1340
        5⤵
        Program crash
        
        PID:3228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk124341.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk124341.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si197914.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si197914.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 712
    3⤵
    - Program crash
    PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 780
    3⤵
    - Program crash
    PID:1868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 828
    3⤵
    - Program crash
    PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 972
    3⤵
    - Program crash
    PID:2540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 964
    3⤵
    - Program crash
    PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 964
    3⤵
    - Program crash
    PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1220
    3⤵
    - Program crash
    PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1256
    3⤵
    - Program crash
    PID:4008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1320
    3⤵
    - Program crash
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 708
      4⤵
      Program crash
      PID:3908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 880
      4⤵
      Program crash
      PID:3860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 940
      4⤵
      Program crash
      PID:860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1056
      4⤵
      Program crash
      PID:3340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1076
      4⤵
      Program crash
      PID:312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1076
      4⤵
      Program crash
      PID:3296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1112
      4⤵
      Program crash
      PID:4256
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 952
      4⤵
      Program crash
      PID:4204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 744
      4⤵
      Program crash
      PID:3468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 784
      4⤵
      Program crash
      PID:404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1200
      4⤵
      Program crash
      PID:1324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1068
      4⤵
      Program crash
      PID:2612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1628
      4⤵
      Program crash
      PID:3020
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:3164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1144
      4⤵
      Program crash
      PID:2740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1636
      4⤵
      Program crash
      PID:5036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1416
    3⤵
    - Program crash
    PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3836 -ip 3836
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1404 -ip 1404
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1020 -ip 1020
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1020 -ip 1020
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1020 -ip 1020
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1020 -ip 1020
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1020 -ip 1020
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1020 -ip 1020
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1020 -ip 1020
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1020 -ip 1020
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1020 -ip 1020
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1020 -ip 1020
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3324 -ip 3324
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3324 -ip 3324
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3324 -ip 3324
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3324 -ip 3324
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3324 -ip 3324
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3324 -ip 3324
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3324 -ip 3324
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3324 -ip 3324
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3324 -ip 3324
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3324 -ip 3324
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3324 -ip 3324
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3324 -ip 3324
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3324 -ip 3324
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3324 -ip 3324
1⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 428
  2⤵
  - Program crash
  PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3804 -ip 3804
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3324 -ip 3324
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
81bf7998ff64b4aad7c763dd18532961

SHA1
e07abc63557d7a278eed5e68a13ecbb77e996b2a

SHA256
1599a0ea5df2089516742590d3e03388c1f4766c1cb4ce6594f00f9cb39e2a19

SHA512
03bf9f0656b5aed5c8476940e8a6f529f0490f30c3929d9c28406f180c9172b005b607fe13cc2ff3623f795e990be3de3ec0766b6dbd10bccae7dafd94e5fb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
81bf7998ff64b4aad7c763dd18532961

SHA1
e07abc63557d7a278eed5e68a13ecbb77e996b2a

SHA256
1599a0ea5df2089516742590d3e03388c1f4766c1cb4ce6594f00f9cb39e2a19

SHA512
03bf9f0656b5aed5c8476940e8a6f529f0490f30c3929d9c28406f180c9172b005b607fe13cc2ff3623f795e990be3de3ec0766b6dbd10bccae7dafd94e5fb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
81bf7998ff64b4aad7c763dd18532961

SHA1
e07abc63557d7a278eed5e68a13ecbb77e996b2a

SHA256
1599a0ea5df2089516742590d3e03388c1f4766c1cb4ce6594f00f9cb39e2a19

SHA512
03bf9f0656b5aed5c8476940e8a6f529f0490f30c3929d9c28406f180c9172b005b607fe13cc2ff3623f795e990be3de3ec0766b6dbd10bccae7dafd94e5fb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
81bf7998ff64b4aad7c763dd18532961

SHA1
e07abc63557d7a278eed5e68a13ecbb77e996b2a

SHA256
1599a0ea5df2089516742590d3e03388c1f4766c1cb4ce6594f00f9cb39e2a19

SHA512
03bf9f0656b5aed5c8476940e8a6f529f0490f30c3929d9c28406f180c9172b005b607fe13cc2ff3623f795e990be3de3ec0766b6dbd10bccae7dafd94e5fb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si197914.exe

Filesize
246KB

MD5
81bf7998ff64b4aad7c763dd18532961

SHA1
e07abc63557d7a278eed5e68a13ecbb77e996b2a

SHA256
1599a0ea5df2089516742590d3e03388c1f4766c1cb4ce6594f00f9cb39e2a19

SHA512
03bf9f0656b5aed5c8476940e8a6f529f0490f30c3929d9c28406f180c9172b005b607fe13cc2ff3623f795e990be3de3ec0766b6dbd10bccae7dafd94e5fb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si197914.exe

Filesize
246KB

MD5
81bf7998ff64b4aad7c763dd18532961

SHA1
e07abc63557d7a278eed5e68a13ecbb77e996b2a

SHA256
1599a0ea5df2089516742590d3e03388c1f4766c1cb4ce6594f00f9cb39e2a19

SHA512
03bf9f0656b5aed5c8476940e8a6f529f0490f30c3929d9c28406f180c9172b005b607fe13cc2ff3623f795e990be3de3ec0766b6dbd10bccae7dafd94e5fb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822194.exe

Filesize
709KB

MD5
bfd9676f047b556c9f6ba1fe347df750

SHA1
f9766fe80fc61a205ed07999cf2670b3591e32a8

SHA256
68b6504f0e85d6e7550c0ea58a9cca02d7d8af564fb713b8570a0e3f050abfed

SHA512
6727cb079e7b2e138acd238812830505227533cbf3784ff9c11b31168c9dce47f6a548c6a08e0bc08404ed9ddc7e6b9e59dfaf60b6031975593381dc35d9ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822194.exe

Filesize
709KB

MD5
bfd9676f047b556c9f6ba1fe347df750

SHA1
f9766fe80fc61a205ed07999cf2670b3591e32a8

SHA256
68b6504f0e85d6e7550c0ea58a9cca02d7d8af564fb713b8570a0e3f050abfed

SHA512
6727cb079e7b2e138acd238812830505227533cbf3784ff9c11b31168c9dce47f6a548c6a08e0bc08404ed9ddc7e6b9e59dfaf60b6031975593381dc35d9ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk124341.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk124341.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un458190.exe

Filesize
554KB

MD5
ba91e67fb481c257d87f2d5644c24e6c

SHA1
4174ee6d89cacc541fda6871c1e17c82c41aa780

SHA256
70ed0f0d50d35fdffd708ce5a4d929c4937153226342d13b0b035c6e27f8a620

SHA512
e2073986e2bbacc6c8e35ffb7fb0efd7a136aaee749c72bce51c4ad26ea34203b732009048e305b2bde754f68d4680d2b0c522ccfdac9ee90554649f7f4bb02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un458190.exe

Filesize
554KB

MD5
ba91e67fb481c257d87f2d5644c24e6c

SHA1
4174ee6d89cacc541fda6871c1e17c82c41aa780

SHA256
70ed0f0d50d35fdffd708ce5a4d929c4937153226342d13b0b035c6e27f8a620

SHA512
e2073986e2bbacc6c8e35ffb7fb0efd7a136aaee749c72bce51c4ad26ea34203b732009048e305b2bde754f68d4680d2b0c522ccfdac9ee90554649f7f4bb02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr967863.exe

Filesize
254KB

MD5
0302bc66affc8178b8a9949534ef53e8

SHA1
d006ea419983bbf5dceb15c13bb436cf8e370505

SHA256
e7e1b1d829b6f1074b8f7d583d189fde3d5d6d03f4f6c8f15e3c6751042cbbe1

SHA512
2c3f7b938760392b086caaccd118567203dc84dba5990e1957599bfee370ae3f77a8a88bdea349bb54816fda42790c07cf1db6252dae7ef590aa85e124d173b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr967863.exe

Filesize
254KB

MD5
0302bc66affc8178b8a9949534ef53e8

SHA1
d006ea419983bbf5dceb15c13bb436cf8e370505

SHA256
e7e1b1d829b6f1074b8f7d583d189fde3d5d6d03f4f6c8f15e3c6751042cbbe1

SHA512
2c3f7b938760392b086caaccd118567203dc84dba5990e1957599bfee370ae3f77a8a88bdea349bb54816fda42790c07cf1db6252dae7ef590aa85e124d173b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu225612.exe

Filesize
337KB

MD5
6b5f2531dacc35006968eeda6777be92

SHA1
31bd02caf16a604ec2f88b3085aafdf95454d78c

SHA256
44c5d9b9f7aa1a014f078020a2c53e023cd0ab7e179078f53d122e754436e71d

SHA512
e969458783f35af0e747f29683415515d3bbfe51917fa22946be2664da5b5d57f3a6f452c30886e63d6c2e187cb9bff02e5d377339633df4a0669f33c7047126

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu225612.exe

Filesize
337KB

MD5
6b5f2531dacc35006968eeda6777be92

SHA1
31bd02caf16a604ec2f88b3085aafdf95454d78c

SHA256
44c5d9b9f7aa1a014f078020a2c53e023cd0ab7e179078f53d122e754436e71d

SHA512
e969458783f35af0e747f29683415515d3bbfe51917fa22946be2664da5b5d57f3a6f452c30886e63d6c2e187cb9bff02e5d377339633df4a0669f33c7047126

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1020-1013-0x0000000000750000-0x000000000078B000-memory.dmp

Filesize
236KB

Download
memory/1404-996-0x00000000087D0000-0x0000000008846000-memory.dmp

Filesize
472KB

Download
memory/1404-273-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/1404-1000-0x0000000008E90000-0x00000000093BC000-memory.dmp

Filesize
5.2MB

Download
memory/1404-999-0x0000000008CB0000-0x0000000008E72000-memory.dmp

Filesize
1.8MB

Download
memory/1404-998-0x0000000008920000-0x0000000008970000-memory.dmp

Filesize
320KB

Download
memory/1404-997-0x0000000008890000-0x00000000088AE000-memory.dmp

Filesize
120KB

Download
memory/1404-995-0x0000000008730000-0x00000000087C2000-memory.dmp

Filesize
584KB

Download
memory/1404-194-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-196-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-193-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-198-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-200-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-202-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-204-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-206-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-208-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-210-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-212-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-214-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-216-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-218-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-220-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-222-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-224-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-226-0x0000000002760000-0x0000000002795000-memory.dmp

Filesize
212KB

Download
memory/1404-271-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/1404-269-0x00000000009D0000-0x0000000000A16000-memory.dmp

Filesize
280KB

Download
memory/1404-994-0x0000000008060000-0x00000000080C6000-memory.dmp

Filesize
408KB

Download
memory/1404-275-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/1404-989-0x0000000007590000-0x0000000007BA8000-memory.dmp

Filesize
6.1MB

Download
memory/1404-990-0x0000000007C20000-0x0000000007C32000-memory.dmp

Filesize
72KB

Download
memory/1404-991-0x0000000007C40000-0x0000000007D4A000-memory.dmp

Filesize
1.0MB

Download
memory/1404-992-0x0000000007D70000-0x0000000007DAC000-memory.dmp

Filesize
240KB

Download
memory/1404-993-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3836-163-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-177-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-171-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-181-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-188-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3836-186-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3836-185-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-175-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-169-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-156-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/3836-155-0x0000000000530000-0x000000000055D000-memory.dmp

Filesize
180KB

Download
memory/3836-179-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-173-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-167-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-165-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-183-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-161-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-159-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-158-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/3836-157-0x0000000004D20000-0x00000000052C4000-memory.dmp

Filesize
5.6MB

Download
memory/4848-1006-0x0000000000B40000-0x0000000000B68000-memory.dmp

Filesize
160KB

Download
memory/4848-1007-0x00000000078F0000-0x0000000007900000-memory.dmp

Filesize
64KB

Download