amadey | 76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2023 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe
Size

982KB
MD5

9d970e092f7e73731d9b5f7cc0bbd7bf
SHA1

836550a0faa34fbdfdd5f89b392595b974f9faea
SHA256

76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080
SHA512

ef2a98f2f41aabd3b72e67280904b8f3ef96c860c5369038bff7ce9dac640eac94c04b72978687916cb9be8db5f88c814e1e7a67098b20233fc79b6d96ae4f51
SSDEEP

24576:VyiIP6CLdDpKzjyNaW1jFU+aAPv4+uqJx273z9Gg74:w9660W1a+HPvYq7+j9Gs

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr822086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr822086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr822086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr822086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr822086.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr822086.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	si643367.exe

Executes dropped EXE 8 IoCs

pid	Process
3584	un881654.exe
3636	un090038.exe
2820	pr822086.exe
3004	qu519996.exe
1532	rk799354.exe
2644	si643367.exe
4244	oneetx.exe
1256	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
5024	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr822086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr822086.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un881654.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un881654.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un090038.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un090038.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
3664	2820	WerFault.exe	84
3160	3004	WerFault.exe	93
5072	2644	WerFault.exe	98
4980	2644	WerFault.exe	98
1108	2644	WerFault.exe	98
4196	2644	WerFault.exe	98
1864	2644	WerFault.exe	98
744	2644	WerFault.exe	98
2440	2644	WerFault.exe	98
1044	2644	WerFault.exe	98
2700	2644	WerFault.exe	98
3148	2644	WerFault.exe	98
2496	4244	WerFault.exe	118
3332	4244	WerFault.exe	118
3272	4244	WerFault.exe	118
4152	4244	WerFault.exe	118
3612	4244	WerFault.exe	118
1172	4244	WerFault.exe	118
4016	4244	WerFault.exe	118
116	4244	WerFault.exe	118
2308	4244	WerFault.exe	118
4304	4244	WerFault.exe	118
4956	4244	WerFault.exe	118
5056	4244	WerFault.exe	118
4352	4244	WerFault.exe	118
5072	4244	WerFault.exe	118
5064	1256	WerFault.exe	152
808	4244	WerFault.exe	118

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2820	pr822086.exe
2820	pr822086.exe
3004	qu519996.exe
3004	qu519996.exe
1532	rk799354.exe
1532	rk799354.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	pr822086.exe
Token: SeDebugPrivilege	3004	qu519996.exe
Token: SeDebugPrivilege	1532	rk799354.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	si643367.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3584	1924	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe	82
PID 1924 wrote to memory of 3584	1924	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe	82
PID 1924 wrote to memory of 3584	1924	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe	82
PID 3584 wrote to memory of 3636	3584	un881654.exe	83
PID 3584 wrote to memory of 3636	3584	un881654.exe	83
PID 3584 wrote to memory of 3636	3584	un881654.exe	83
PID 3636 wrote to memory of 2820	3636	un090038.exe	84
PID 3636 wrote to memory of 2820	3636	un090038.exe	84
PID 3636 wrote to memory of 2820	3636	un090038.exe	84
PID 3636 wrote to memory of 3004	3636	un090038.exe	93
PID 3636 wrote to memory of 3004	3636	un090038.exe	93
PID 3636 wrote to memory of 3004	3636	un090038.exe	93
PID 3584 wrote to memory of 1532	3584	un881654.exe	97
PID 3584 wrote to memory of 1532	3584	un881654.exe	97
PID 3584 wrote to memory of 1532	3584	un881654.exe	97
PID 1924 wrote to memory of 2644	1924	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe	98
PID 1924 wrote to memory of 2644	1924	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe	98
PID 1924 wrote to memory of 2644	1924	76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe	98
PID 2644 wrote to memory of 4244	2644	si643367.exe	118
PID 2644 wrote to memory of 4244	2644	si643367.exe	118
PID 2644 wrote to memory of 4244	2644	si643367.exe	118
PID 4244 wrote to memory of 1836	4244	oneetx.exe	135
PID 4244 wrote to memory of 1836	4244	oneetx.exe	135
PID 4244 wrote to memory of 1836	4244	oneetx.exe	135
PID 4244 wrote to memory of 5024	4244	oneetx.exe	149
PID 4244 wrote to memory of 5024	4244	oneetx.exe	149
PID 4244 wrote to memory of 5024	4244	oneetx.exe	149

C:\Users\Admin\AppData\Local\Temp\76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe
"C:\Users\Admin\AppData\Local\Temp\76b6c42e467999d95d85490afbf9ef4695733b482b7b6381a2de64d724717080.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881654.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881654.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un090038.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un090038.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr822086.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr822086.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1088
        5⤵
        Program crash
        
        PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu519996.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu519996.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1340
        5⤵
        Program crash
        
        PID:3160
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk799354.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk799354.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si643367.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si643367.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 712
    3⤵
    - Program crash
    PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 736
    3⤵
    - Program crash
    PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 860
    3⤵
    - Program crash
    PID:1108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 864
    3⤵
    - Program crash
    PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 968
    3⤵
    - Program crash
    PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 968
    3⤵
    - Program crash
    PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1228
    3⤵
    - Program crash
    PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1216
    3⤵
    - Program crash
    PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1328
    3⤵
    - Program crash
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 708
      4⤵
      Program crash
      PID:2496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 824
      4⤵
      Program crash
      PID:3332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 880
      4⤵
      Program crash
      PID:3272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1056
      4⤵
      Program crash
      PID:4152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1100
      4⤵
      Program crash
      PID:3612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1072
      4⤵
      Program crash
      PID:1172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1136
      4⤵
      Program crash
      PID:4016
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 996
      4⤵
      Program crash
      PID:116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1288
      4⤵
      Program crash
      PID:2308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1308
      4⤵
      Program crash
      PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1300
      4⤵
      Program crash
      PID:4956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1160
      4⤵
      Program crash
      PID:5056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1160
      4⤵
      Program crash
      PID:4352
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:5024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1580
      4⤵
      Program crash
      PID:5072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1564
      4⤵
      Program crash
      PID:808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1400
    3⤵
    - Program crash
    PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2820 -ip 2820
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3004 -ip 3004
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2644 -ip 2644
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2644 -ip 2644
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2644 -ip 2644
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2644 -ip 2644
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2644 -ip 2644
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2644 -ip 2644
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2644 -ip 2644
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2644 -ip 2644
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2644 -ip 2644
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2644 -ip 2644
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4244 -ip 4244
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4244 -ip 4244
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4244 -ip 4244
1⤵
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4244 -ip 4244
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4244 -ip 4244
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4244 -ip 4244
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4244 -ip 4244
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4244 -ip 4244
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4244 -ip 4244
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4244 -ip 4244
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4244 -ip 4244
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4244 -ip 4244
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4244 -ip 4244
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4244 -ip 4244
1⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 428
  2⤵
  - Program crash
  PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1256 -ip 1256
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4244 -ip 4244
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
fa27ca0de127210ef1a8ed5e26416b93

SHA1
f727ffeb0a79afa28f67d159fc501003db2d7be8

SHA256
177d9a8a9dde7a2ade78c173a4dd3d99f9c36666a40e0c3b27edf15b489e45ae

SHA512
7ca569933f94e3ccac002809babe2f352b47da0f3cd5389b15e1d3fecd6c6cb93aac5c2f88d103b401f56dce4abc4eb3efa9f1f6975132386dc04b2072f39c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
fa27ca0de127210ef1a8ed5e26416b93

SHA1
f727ffeb0a79afa28f67d159fc501003db2d7be8

SHA256
177d9a8a9dde7a2ade78c173a4dd3d99f9c36666a40e0c3b27edf15b489e45ae

SHA512
7ca569933f94e3ccac002809babe2f352b47da0f3cd5389b15e1d3fecd6c6cb93aac5c2f88d103b401f56dce4abc4eb3efa9f1f6975132386dc04b2072f39c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
fa27ca0de127210ef1a8ed5e26416b93

SHA1
f727ffeb0a79afa28f67d159fc501003db2d7be8

SHA256
177d9a8a9dde7a2ade78c173a4dd3d99f9c36666a40e0c3b27edf15b489e45ae

SHA512
7ca569933f94e3ccac002809babe2f352b47da0f3cd5389b15e1d3fecd6c6cb93aac5c2f88d103b401f56dce4abc4eb3efa9f1f6975132386dc04b2072f39c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
246KB

MD5
fa27ca0de127210ef1a8ed5e26416b93

SHA1
f727ffeb0a79afa28f67d159fc501003db2d7be8

SHA256
177d9a8a9dde7a2ade78c173a4dd3d99f9c36666a40e0c3b27edf15b489e45ae

SHA512
7ca569933f94e3ccac002809babe2f352b47da0f3cd5389b15e1d3fecd6c6cb93aac5c2f88d103b401f56dce4abc4eb3efa9f1f6975132386dc04b2072f39c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si643367.exe

Filesize
246KB

MD5
fa27ca0de127210ef1a8ed5e26416b93

SHA1
f727ffeb0a79afa28f67d159fc501003db2d7be8

SHA256
177d9a8a9dde7a2ade78c173a4dd3d99f9c36666a40e0c3b27edf15b489e45ae

SHA512
7ca569933f94e3ccac002809babe2f352b47da0f3cd5389b15e1d3fecd6c6cb93aac5c2f88d103b401f56dce4abc4eb3efa9f1f6975132386dc04b2072f39c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si643367.exe

Filesize
246KB

MD5
fa27ca0de127210ef1a8ed5e26416b93

SHA1
f727ffeb0a79afa28f67d159fc501003db2d7be8

SHA256
177d9a8a9dde7a2ade78c173a4dd3d99f9c36666a40e0c3b27edf15b489e45ae

SHA512
7ca569933f94e3ccac002809babe2f352b47da0f3cd5389b15e1d3fecd6c6cb93aac5c2f88d103b401f56dce4abc4eb3efa9f1f6975132386dc04b2072f39c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881654.exe

Filesize
709KB

MD5
7ce7f60a22baec1c502deb18634bc932

SHA1
e3bf1d1de48f4534b6691487d4f9832dd178f572

SHA256
607eea92db95ebaa89ba2338088f442b8f61d4e85be58468751290c60dbcc867

SHA512
55304f7184d3ab79c29fdbe02cf47cf175d1d378ad224328a50c46027f8f0acafd918ea8f9d9ec367f55e36c1caaab86b00c1c3f64f8f0c50a7b4ab0942b1cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un881654.exe

Filesize
709KB

MD5
7ce7f60a22baec1c502deb18634bc932

SHA1
e3bf1d1de48f4534b6691487d4f9832dd178f572

SHA256
607eea92db95ebaa89ba2338088f442b8f61d4e85be58468751290c60dbcc867

SHA512
55304f7184d3ab79c29fdbe02cf47cf175d1d378ad224328a50c46027f8f0acafd918ea8f9d9ec367f55e36c1caaab86b00c1c3f64f8f0c50a7b4ab0942b1cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk799354.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk799354.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un090038.exe

Filesize
555KB

MD5
0c4882e9396a6857f3c42c1b72e9388a

SHA1
83c642fb84870e38587923c1f08ba9fdbec2d329

SHA256
0ffe395f04761bb6a255ee6b2e768fc967bf061543f9aa6e99071332a9819b13

SHA512
aa2c2c787d1fcfeb233b5adf31938da6e9d5bd25345340d06b6992e60a97e571ab8f32d9f46eb177fa38791786dae8ac8bfaf8a9530aa71ed5ff3d51c55208c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un090038.exe

Filesize
555KB

MD5
0c4882e9396a6857f3c42c1b72e9388a

SHA1
83c642fb84870e38587923c1f08ba9fdbec2d329

SHA256
0ffe395f04761bb6a255ee6b2e768fc967bf061543f9aa6e99071332a9819b13

SHA512
aa2c2c787d1fcfeb233b5adf31938da6e9d5bd25345340d06b6992e60a97e571ab8f32d9f46eb177fa38791786dae8ac8bfaf8a9530aa71ed5ff3d51c55208c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr822086.exe

Filesize
255KB

MD5
9b0bc84dd7467cf46de57349bf29cc53

SHA1
01920b2e856e9ba97eaad742254d29c3cbb34308

SHA256
2dc7199ae48b27d58790cf62989cafd7a002727120a377b8990b49dd233c13d7

SHA512
2abb5d766b367c3108054b41a9d1228aea521cb7445ee62b04d3869f3c46e5928f0960e30b187e4a3ceb247edcb3aee503bc2d66456373e21189341acf2fa323

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr822086.exe

Filesize
255KB

MD5
9b0bc84dd7467cf46de57349bf29cc53

SHA1
01920b2e856e9ba97eaad742254d29c3cbb34308

SHA256
2dc7199ae48b27d58790cf62989cafd7a002727120a377b8990b49dd233c13d7

SHA512
2abb5d766b367c3108054b41a9d1228aea521cb7445ee62b04d3869f3c46e5928f0960e30b187e4a3ceb247edcb3aee503bc2d66456373e21189341acf2fa323

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu519996.exe

Filesize
338KB

MD5
50ca50ced9f918b5b9d303e5bdc9fa11

SHA1
abba030f4b26090eded35fc883f029b5c5b0fa49

SHA256
5664c5a744c80a3a63998a478724d1dae5aa16a90776af8cf38b0c20732009b3

SHA512
ef1ac247870fda0b0d7d86a23f220adc898c628761ba380744413509d17d08e0cc8f7b172046cc98f726fe6e08fd5230c5accf89eb1ec0caef77021d9f7d0553

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu519996.exe

Filesize
338KB

MD5
50ca50ced9f918b5b9d303e5bdc9fa11

SHA1
abba030f4b26090eded35fc883f029b5c5b0fa49

SHA256
5664c5a744c80a3a63998a478724d1dae5aa16a90776af8cf38b0c20732009b3

SHA512
ef1ac247870fda0b0d7d86a23f220adc898c628761ba380744413509d17d08e0cc8f7b172046cc98f726fe6e08fd5230c5accf89eb1ec0caef77021d9f7d0553

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1532-1011-0x0000000000990000-0x00000000009B8000-memory.dmp

Filesize
160KB

Download
memory/1532-1012-0x0000000007A50000-0x0000000007A60000-memory.dmp

Filesize
64KB

Download
memory/2644-1018-0x0000000000850000-0x000000000088B000-memory.dmp

Filesize
236KB

Download
memory/2820-157-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-176-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-182-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-184-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-185-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2820-186-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2820-187-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2820-188-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2820-189-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2820-190-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2820-191-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/2820-193-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2820-178-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-180-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-174-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-172-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-170-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-168-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-166-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-164-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-162-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-160-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-158-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/2820-156-0x0000000004A30000-0x0000000004FD4000-memory.dmp

Filesize
5.6MB

Download
memory/2820-155-0x0000000000600000-0x000000000062D000-memory.dmp

Filesize
180KB

Download
memory/3004-207-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-225-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-227-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-229-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-231-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-545-0x0000000002120000-0x0000000002166000-memory.dmp

Filesize
280KB

Download
memory/3004-549-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/3004-546-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/3004-550-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/3004-994-0x0000000007560000-0x0000000007B78000-memory.dmp

Filesize
6.1MB

Download
memory/3004-995-0x0000000007C20000-0x0000000007C32000-memory.dmp

Filesize
72KB

Download
memory/3004-996-0x0000000007C40000-0x0000000007D4A000-memory.dmp

Filesize
1.0MB

Download
memory/3004-997-0x0000000007D70000-0x0000000007DAC000-memory.dmp

Filesize
240KB

Download
memory/3004-998-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/3004-999-0x0000000008060000-0x00000000080C6000-memory.dmp

Filesize
408KB

Download
memory/3004-1000-0x0000000008720000-0x00000000087B2000-memory.dmp

Filesize
584KB

Download
memory/3004-1001-0x00000000087D0000-0x0000000008846000-memory.dmp

Filesize
472KB

Download
memory/3004-1002-0x0000000008890000-0x00000000088AE000-memory.dmp

Filesize
120KB

Download
memory/3004-1003-0x0000000008AB0000-0x0000000008C72000-memory.dmp

Filesize
1.8MB

Download
memory/3004-223-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-221-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-219-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-217-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-215-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-213-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-211-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-209-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-205-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-203-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-201-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-199-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-198-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3004-1004-0x0000000008C80000-0x00000000091AC000-memory.dmp

Filesize
5.2MB

Download
memory/3004-1005-0x00000000024D0000-0x0000000002520000-memory.dmp

Filesize
320KB

Download