amadey | 2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2023, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe
Size

1.1MB
MD5

322515660c7771e079761f6c1e304571
SHA1

a5b1b4f6fd398d1c824eac97661e440973690e41
SHA256

2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d
SHA512

05b1db2eb5a3dfff9f4d364f680d6119f6209cb48c32b0769f91f864abf4f3cc9e0c4cd68d1323f28fabde309f0e1d90908a16f1d04578a0bb545a00cf0efc70
SSDEEP

24576:DybwSY8jGMg/DFz5trrKQFrkRegArriZCzcZRU6nWG:WbwSBjBMVFr/CrYriZSJ6nW

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr547880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr547880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr547880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr547880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr547880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr547880.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	si577922.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
1636	un399697.exe
864	un604607.exe
2748	pr547880.exe
484	qu007652.exe
4356	rk953611.exe
4588	si577922.exe
816	oneetx.exe
2536	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
1756	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr547880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr547880.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un399697.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un604607.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un604607.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un399697.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2172	2748	WerFault.exe	87
2068	484	WerFault.exe	93
1524	4588	WerFault.exe	97
1476	4588	WerFault.exe	97
4772	4588	WerFault.exe	97
3464	4588	WerFault.exe	97
4112	4588	WerFault.exe	97
8	4588	WerFault.exe	97
1884	4588	WerFault.exe	97
596	4588	WerFault.exe	97
1764	4588	WerFault.exe	97
3880	4588	WerFault.exe	97
2312	816	WerFault.exe	118
4124	816	WerFault.exe	118
4952	816	WerFault.exe	118
2412	816	WerFault.exe	118
1972	816	WerFault.exe	118
552	816	WerFault.exe	118
3364	816	WerFault.exe	118
4104	816	WerFault.exe	118
2424	816	WerFault.exe	118
5032	816	WerFault.exe	118
1776	816	WerFault.exe	118
4680	816	WerFault.exe	118
1860	816	WerFault.exe	118
1284	816	WerFault.exe	118
4116	816	WerFault.exe	118
4264	2536	WerFault.exe	157
3976	816	WerFault.exe	118

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2748	pr547880.exe
2748	pr547880.exe
484	qu007652.exe
484	qu007652.exe
4356	rk953611.exe
4356	rk953611.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	pr547880.exe
Token: SeDebugPrivilege	484	qu007652.exe
Token: SeDebugPrivilege	4356	rk953611.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4588	si577922.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1636	3140	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe	85
PID 3140 wrote to memory of 1636	3140	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe	85
PID 3140 wrote to memory of 1636	3140	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe	85
PID 1636 wrote to memory of 864	1636	un399697.exe	86
PID 1636 wrote to memory of 864	1636	un399697.exe	86
PID 1636 wrote to memory of 864	1636	un399697.exe	86
PID 864 wrote to memory of 2748	864	un604607.exe	87
PID 864 wrote to memory of 2748	864	un604607.exe	87
PID 864 wrote to memory of 2748	864	un604607.exe	87
PID 864 wrote to memory of 484	864	un604607.exe	93
PID 864 wrote to memory of 484	864	un604607.exe	93
PID 864 wrote to memory of 484	864	un604607.exe	93
PID 1636 wrote to memory of 4356	1636	un399697.exe	96
PID 1636 wrote to memory of 4356	1636	un399697.exe	96
PID 1636 wrote to memory of 4356	1636	un399697.exe	96
PID 3140 wrote to memory of 4588	3140	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe	97
PID 3140 wrote to memory of 4588	3140	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe	97
PID 3140 wrote to memory of 4588	3140	2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe	97
PID 4588 wrote to memory of 816	4588	si577922.exe	118
PID 4588 wrote to memory of 816	4588	si577922.exe	118
PID 4588 wrote to memory of 816	4588	si577922.exe	118
PID 816 wrote to memory of 1444	816	oneetx.exe	137
PID 816 wrote to memory of 1444	816	oneetx.exe	137
PID 816 wrote to memory of 1444	816	oneetx.exe	137
PID 816 wrote to memory of 1756	816	oneetx.exe	154
PID 816 wrote to memory of 1756	816	oneetx.exe	154
PID 816 wrote to memory of 1756	816	oneetx.exe	154

C:\Users\Admin\AppData\Local\Temp\2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe
"C:\Users\Admin\AppData\Local\Temp\2af37204988d92eded1e03e9063ec2c012053ebe1c58686939a7783977bae88d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un399697.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un399697.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un604607.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un604607.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr547880.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr547880.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 1084
        5⤵
        Program crash
        
        PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu007652.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu007652.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 1720
        5⤵
        Program crash
        
        PID:2068
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk953611.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk953611.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si577922.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si577922.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 696
    3⤵
    - Program crash
    PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 780
    3⤵
    - Program crash
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 796
    3⤵
    - Program crash
    PID:4772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 976
    3⤵
    - Program crash
    PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 980
    3⤵
    - Program crash
    PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 956
    3⤵
    - Program crash
    PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1216
    3⤵
    - Program crash
    PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1248
    3⤵
    - Program crash
    PID:596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1312
    3⤵
    - Program crash
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 692
      4⤵
      Program crash
      PID:2312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 848
      4⤵
      Program crash
      PID:4124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 888
      4⤵
      Program crash
      PID:4952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1060
      4⤵
      Program crash
      PID:2412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1088
      4⤵
      Program crash
      PID:1972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1056
      4⤵
      Program crash
      PID:552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1096
      4⤵
      Program crash
      PID:3364
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 992
      4⤵
      Program crash
      PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 684
      4⤵
      Program crash
      PID:2424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 692
      4⤵
      Program crash
      PID:5032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 992
      4⤵
      Program crash
      PID:1776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1532
      4⤵
      Program crash
      PID:4680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1132
      4⤵
      Program crash
      PID:1860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1632
      4⤵
      Program crash
      PID:1284
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1088
      4⤵
      Program crash
      PID:4116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1644
      4⤵
      Program crash
      PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1584
    3⤵
    - Program crash
    PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2748 -ip 2748
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 484 -ip 484
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4588 -ip 4588
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4588 -ip 4588
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4588 -ip 4588
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4588 -ip 4588
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4588 -ip 4588
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4588 -ip 4588
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4588 -ip 4588
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4588 -ip 4588
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4588 -ip 4588
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4588 -ip 4588
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 816 -ip 816
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 816 -ip 816
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 816 -ip 816
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 816 -ip 816
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 816 -ip 816
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 816 -ip 816
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 816 -ip 816
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 816 -ip 816
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 816 -ip 816
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 816 -ip 816
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 816 -ip 816
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 816 -ip 816
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 816 -ip 816
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 816 -ip 816
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 816 -ip 816
1⤵
PID:2228

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 320
  2⤵
  - Program crash
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2536 -ip 2536
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 816 -ip 816
1⤵
PID:236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
2beecdc14e0c949d4eabc751559c339e

SHA1
a450db697192ddbc54967837dc171810f08c8e6f

SHA256
2ec14d388a156a5744ebd5120f5cd69e2541e653c1c72367ad1c16c2db278041

SHA512
6c6645f2a1dbc366aef888558da72a527a33ee3cd8e8a91f454fcb363ae85b2431d081e0db01941ee928510a2c9fd3f83d520edbc1ead301b6fac5f1da3d1db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
2beecdc14e0c949d4eabc751559c339e

SHA1
a450db697192ddbc54967837dc171810f08c8e6f

SHA256
2ec14d388a156a5744ebd5120f5cd69e2541e653c1c72367ad1c16c2db278041

SHA512
6c6645f2a1dbc366aef888558da72a527a33ee3cd8e8a91f454fcb363ae85b2431d081e0db01941ee928510a2c9fd3f83d520edbc1ead301b6fac5f1da3d1db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
2beecdc14e0c949d4eabc751559c339e

SHA1
a450db697192ddbc54967837dc171810f08c8e6f

SHA256
2ec14d388a156a5744ebd5120f5cd69e2541e653c1c72367ad1c16c2db278041

SHA512
6c6645f2a1dbc366aef888558da72a527a33ee3cd8e8a91f454fcb363ae85b2431d081e0db01941ee928510a2c9fd3f83d520edbc1ead301b6fac5f1da3d1db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
396KB

MD5
2beecdc14e0c949d4eabc751559c339e

SHA1
a450db697192ddbc54967837dc171810f08c8e6f

SHA256
2ec14d388a156a5744ebd5120f5cd69e2541e653c1c72367ad1c16c2db278041

SHA512
6c6645f2a1dbc366aef888558da72a527a33ee3cd8e8a91f454fcb363ae85b2431d081e0db01941ee928510a2c9fd3f83d520edbc1ead301b6fac5f1da3d1db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si577922.exe

Filesize
396KB

MD5
2beecdc14e0c949d4eabc751559c339e

SHA1
a450db697192ddbc54967837dc171810f08c8e6f

SHA256
2ec14d388a156a5744ebd5120f5cd69e2541e653c1c72367ad1c16c2db278041

SHA512
6c6645f2a1dbc366aef888558da72a527a33ee3cd8e8a91f454fcb363ae85b2431d081e0db01941ee928510a2c9fd3f83d520edbc1ead301b6fac5f1da3d1db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si577922.exe

Filesize
396KB

MD5
2beecdc14e0c949d4eabc751559c339e

SHA1
a450db697192ddbc54967837dc171810f08c8e6f

SHA256
2ec14d388a156a5744ebd5120f5cd69e2541e653c1c72367ad1c16c2db278041

SHA512
6c6645f2a1dbc366aef888558da72a527a33ee3cd8e8a91f454fcb363ae85b2431d081e0db01941ee928510a2c9fd3f83d520edbc1ead301b6fac5f1da3d1db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un399697.exe

Filesize
765KB

MD5
cd59a91ef39c7435e54683945c2ba7d1

SHA1
b9787d80ce40542b3a90d65fb3622ede114d4e7c

SHA256
3abff2f4973159a4ca2176b46291d61b9c1584d98deb949423905d8b2436f7c0

SHA512
9a8fdab8470fa02f159fa3dfdf199494aa55159e0a226cb589363560a8388bf3f85826c3a206d5e309ff2e6c90df70d6e4ee0b4a248ea0eef171ab6eaa857990

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un399697.exe

Filesize
765KB

MD5
cd59a91ef39c7435e54683945c2ba7d1

SHA1
b9787d80ce40542b3a90d65fb3622ede114d4e7c

SHA256
3abff2f4973159a4ca2176b46291d61b9c1584d98deb949423905d8b2436f7c0

SHA512
9a8fdab8470fa02f159fa3dfdf199494aa55159e0a226cb589363560a8388bf3f85826c3a206d5e309ff2e6c90df70d6e4ee0b4a248ea0eef171ab6eaa857990

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk953611.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk953611.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un604607.exe

Filesize
610KB

MD5
2f4663dab80f59f74d195829f49eb312

SHA1
98d3f58eb72095bc8d77f964ba8f07f03d5dc76e

SHA256
c22a6610e486b1679db2df0477cf3aeaffcbfab426fd7228adb832b880b03cae

SHA512
e6d80cf684a88142d25beb303523e7cf2d34ca5f34f232073f22ec5d0d75acd9beec145e7f1f497113b43a8faabcdbcc63d3070f5b1aeb819e3c11cf929b567a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un604607.exe

Filesize
610KB

MD5
2f4663dab80f59f74d195829f49eb312

SHA1
98d3f58eb72095bc8d77f964ba8f07f03d5dc76e

SHA256
c22a6610e486b1679db2df0477cf3aeaffcbfab426fd7228adb832b880b03cae

SHA512
e6d80cf684a88142d25beb303523e7cf2d34ca5f34f232073f22ec5d0d75acd9beec145e7f1f497113b43a8faabcdbcc63d3070f5b1aeb819e3c11cf929b567a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr547880.exe

Filesize
404KB

MD5
111f671732339d71e8bc975f796fc807

SHA1
8a36ec93ae1b2e08e34fac648e3574804c9fc1a4

SHA256
91ff10951d8a606005b1e7295aefcfa06176c631cf6e2ed87348e3f784f7fcb6

SHA512
f8346178c7a0db765ff68e62efcaa57ae8bad266b434a151e4abe7f053f69523c983401ab1cfab762b9256fc9298870646b5d937c7530db4a3900dfc51bb499c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr547880.exe

Filesize
404KB

MD5
111f671732339d71e8bc975f796fc807

SHA1
8a36ec93ae1b2e08e34fac648e3574804c9fc1a4

SHA256
91ff10951d8a606005b1e7295aefcfa06176c631cf6e2ed87348e3f784f7fcb6

SHA512
f8346178c7a0db765ff68e62efcaa57ae8bad266b434a151e4abe7f053f69523c983401ab1cfab762b9256fc9298870646b5d937c7530db4a3900dfc51bb499c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu007652.exe

Filesize
487KB

MD5
3e8b1398b5ea1a7ddbfc33c221a2dc1b

SHA1
d81253c7524e74f118e9f1dbd5b0013721ded08d

SHA256
3fd03072a4949ef51a34b80795fed97f12c97e3591e819daaa92f22ad7d69393

SHA512
fc2b358960cad98731f21e59915394c95af1b0606b380da5ba8d7a04336661ddfefa6cf2dfc1dea50cd3d992ed8e2caf4d4802bf03e044774de195d2862496d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu007652.exe

Filesize
487KB

MD5
3e8b1398b5ea1a7ddbfc33c221a2dc1b

SHA1
d81253c7524e74f118e9f1dbd5b0013721ded08d

SHA256
3fd03072a4949ef51a34b80795fed97f12c97e3591e819daaa92f22ad7d69393

SHA512
fc2b358960cad98731f21e59915394c95af1b0606b380da5ba8d7a04336661ddfefa6cf2dfc1dea50cd3d992ed8e2caf4d4802bf03e044774de195d2862496d0

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
ee69aeae2f96208fc3b11dfb70e07161

SHA1
5f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6

SHA256
13ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9

SHA512
94373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/484-999-0x0000000008C40000-0x0000000008CB6000-memory.dmp

Filesize
472KB

Download
memory/484-418-0x0000000000A90000-0x0000000000AD6000-memory.dmp

Filesize
280KB

Download
memory/484-1003-0x0000000004920000-0x0000000004970000-memory.dmp

Filesize
320KB

Download
memory/484-1002-0x0000000008FD0000-0x00000000094FC000-memory.dmp

Filesize
5.2MB

Download
memory/484-1001-0x0000000008E00000-0x0000000008FC2000-memory.dmp

Filesize
1.8MB

Download
memory/484-1000-0x0000000008CE0000-0x0000000008CFE000-memory.dmp

Filesize
120KB

Download
memory/484-998-0x0000000008B70000-0x0000000008C02000-memory.dmp

Filesize
584KB

Download
memory/484-997-0x00000000084B0000-0x0000000008516000-memory.dmp

Filesize
408KB

Download
memory/484-996-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/484-995-0x00000000081C0000-0x00000000081FC000-memory.dmp

Filesize
240KB

Download
memory/484-994-0x0000000008090000-0x000000000819A000-memory.dmp

Filesize
1.0MB

Download
memory/484-197-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-196-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-199-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-201-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-203-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-205-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-207-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-209-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-211-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-213-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-215-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-217-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-219-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-221-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-223-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-225-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-227-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-229-0x0000000004F00000-0x0000000004F35000-memory.dmp

Filesize
212KB

Download
memory/484-993-0x0000000008070000-0x0000000008082000-memory.dmp

Filesize
72KB

Download
memory/484-419-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/484-421-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/484-423-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/484-992-0x00000000079F0000-0x0000000008008000-memory.dmp

Filesize
6.1MB

Download
memory/2748-170-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-158-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/2748-178-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-191-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/2748-189-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/2748-188-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/2748-174-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-187-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/2748-186-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-184-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-182-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-172-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-176-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-180-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-164-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-168-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-166-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-155-0x0000000004DF0000-0x0000000005394000-memory.dmp

Filesize
5.6MB

Download
memory/2748-156-0x0000000000890000-0x00000000008BD000-memory.dmp

Filesize
180KB

Download
memory/2748-162-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-160-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-159-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/2748-157-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/4356-1009-0x00000000000B0000-0x00000000000D8000-memory.dmp

Filesize
160KB

Download
memory/4356-1010-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Filesize
64KB

Download
memory/4588-1016-0x00000000009A0000-0x00000000009DB000-memory.dmp

Filesize
236KB

Download