amadey | 41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe
Size

945KB
MD5

2ff4202da54abdc6f75e3b349f87f4eb
SHA1

49e0fcdbc83c592f27d743e321b4098e1c0c6aa8
SHA256

41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c
SHA512

0352063b5e958727db144dd361eb94559c9e3d40e7dbc309c8556f4c66c735092c041aee02637f931f84e2d6d20cbbb4ddc84a7c20611037ae926d32d2162556
SSDEEP

12288:by90HOPntSSLunQKNAwn0vweYo/+ELJ/bvl56F2RqQYSrOsB3NE1c6ol2t:byuObL/lOeZ/+ENbvaYRq2rac6oC

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr311884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr311884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr311884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr311884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr311884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr311884.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	si008509.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
1176	un875073.exe
4500	un398404.exe
3384	pr311884.exe
3988	qu709373.exe
4668	qu709373.exe
4900	rk267695.exe
2236	si008509.exe
4936	oneetx.exe
3748	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr311884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr311884.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un875073.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un875073.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un398404.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un398404.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 4668	3988	qu709373.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
1324	3384	WerFault.exe	86
3172	2236	WerFault.exe	95
4300	2236	WerFault.exe	95
1816	2236	WerFault.exe	95
2516	2236	WerFault.exe	95
4444	2236	WerFault.exe	95
3724	2236	WerFault.exe	95
3728	2236	WerFault.exe	95
4864	2236	WerFault.exe	95
2784	2236	WerFault.exe	95
3444	2236	WerFault.exe	95
4460	4936	WerFault.exe	115
2164	4936	WerFault.exe	115
1960	4936	WerFault.exe	115
1308	4936	WerFault.exe	115
4732	4936	WerFault.exe	115
1964	4936	WerFault.exe	115
2080	4936	WerFault.exe	115
984	4936	WerFault.exe	115
4728	4936	WerFault.exe	115
4640	4936	WerFault.exe	115
2676	4936	WerFault.exe	115
1680	4936	WerFault.exe	115
2832	4936	WerFault.exe	115
2732	4936	WerFault.exe	115
2516	3748	WerFault.exe	153
2612	4936	WerFault.exe	115

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3384	pr311884.exe
3384	pr311884.exe
4900	rk267695.exe
4900	rk267695.exe
4668	qu709373.exe
4668	qu709373.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	pr311884.exe
Token: SeDebugPrivilege	4668	qu709373.exe
Token: SeDebugPrivilege	4900	rk267695.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	si008509.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1176	2100	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe	84
PID 2100 wrote to memory of 1176	2100	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe	84
PID 2100 wrote to memory of 1176	2100	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe	84
PID 1176 wrote to memory of 4500	1176	un875073.exe	85
PID 1176 wrote to memory of 4500	1176	un875073.exe	85
PID 1176 wrote to memory of 4500	1176	un875073.exe	85
PID 4500 wrote to memory of 3384	4500	un398404.exe	86
PID 4500 wrote to memory of 3384	4500	un398404.exe	86
PID 4500 wrote to memory of 3384	4500	un398404.exe	86
PID 4500 wrote to memory of 3988	4500	un398404.exe	92
PID 4500 wrote to memory of 3988	4500	un398404.exe	92
PID 4500 wrote to memory of 3988	4500	un398404.exe	92
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 3988 wrote to memory of 4668	3988	qu709373.exe	93
PID 1176 wrote to memory of 4900	1176	un875073.exe	94
PID 1176 wrote to memory of 4900	1176	un875073.exe	94
PID 1176 wrote to memory of 4900	1176	un875073.exe	94
PID 2100 wrote to memory of 2236	2100	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe	95
PID 2100 wrote to memory of 2236	2100	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe	95
PID 2100 wrote to memory of 2236	2100	41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe	95
PID 2236 wrote to memory of 4936	2236	si008509.exe	115
PID 2236 wrote to memory of 4936	2236	si008509.exe	115
PID 2236 wrote to memory of 4936	2236	si008509.exe	115
PID 4936 wrote to memory of 3792	4936	oneetx.exe	133
PID 4936 wrote to memory of 3792	4936	oneetx.exe	133
PID 4936 wrote to memory of 3792	4936	oneetx.exe	133
PID 4936 wrote to memory of 2216	4936	oneetx.exe	150
PID 4936 wrote to memory of 2216	4936	oneetx.exe	150
PID 4936 wrote to memory of 2216	4936	oneetx.exe	150

C:\Users\Admin\AppData\Local\Temp\41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe
"C:\Users\Admin\AppData\Local\Temp\41494f40315e5e0bc18e36704e838068fbb9c1640473ef72a8562f0122c5214c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un875073.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un875073.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un398404.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un398404.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr311884.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr311884.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 1080
        5⤵
        Program crash
        
        PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4668
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk267695.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk267695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si008509.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si008509.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 696
    3⤵
    - Program crash
    PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 764
    3⤵
    - Program crash
    PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 856
    3⤵
    - Program crash
    PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 864
    3⤵
    - Program crash
    PID:2516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 984
    3⤵
    - Program crash
    PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 860
    3⤵
    - Program crash
    PID:3724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1220
    3⤵
    - Program crash
    PID:3728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1236
    3⤵
    - Program crash
    PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1316
    3⤵
    - Program crash
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 696
      4⤵
      Program crash
      PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 816
      4⤵
      Program crash
      PID:2164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 912
      4⤵
      Program crash
      PID:1960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1052
      4⤵
      Program crash
      PID:1308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1088
      4⤵
      Program crash
      PID:4732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1088
      4⤵
      Program crash
      PID:1964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1072
      4⤵
      Program crash
      PID:2080
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 992
      4⤵
      Program crash
      PID:984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1256
      4⤵
      Program crash
      PID:4728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 696
      4⤵
      Program crash
      PID:4640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1288
      4⤵
      Program crash
      PID:2676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1136
      4⤵
      Program crash
      PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1628
      4⤵
      Program crash
      PID:2832
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1548
      4⤵
      Program crash
      PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1636
      4⤵
      Program crash
      PID:2612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1368
    3⤵
    - Program crash
    PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3384 -ip 3384
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2236 -ip 2236
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2236 -ip 2236
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2236 -ip 2236
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2236 -ip 2236
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2236 -ip 2236
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2236 -ip 2236
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2236 -ip 2236
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2236 -ip 2236
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2236 -ip 2236
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2236 -ip 2236
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4936 -ip 4936
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4936 -ip 4936
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4936 -ip 4936
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4936 -ip 4936
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4936 -ip 4936
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4936 -ip 4936
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4936 -ip 4936
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4936 -ip 4936
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4936 -ip 4936
1⤵
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4936 -ip 4936
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4936 -ip 4936
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4936 -ip 4936
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4936 -ip 4936
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4936 -ip 4936
1⤵
PID:508

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 320
  2⤵
  - Program crash
  PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3748 -ip 3748
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4936 -ip 4936
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
803063fe91c6e1d7ea89f79ea5b45854

SHA1
5b8c77598f13c6889c64c14861bfd8b51c001d10

SHA256
da46f5b86d992f0180f1b852fa0c9b0d52f4342453d8cf0455306300cc0e776c

SHA512
1cca5c7697ba00ab414fc0dd3715bf62cb76d1aea093795ec13124ce1765ca7daaddb178875e470cf10781fd66e69630b8425275c32bfd823bdfd43ab44c09ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
803063fe91c6e1d7ea89f79ea5b45854

SHA1
5b8c77598f13c6889c64c14861bfd8b51c001d10

SHA256
da46f5b86d992f0180f1b852fa0c9b0d52f4342453d8cf0455306300cc0e776c

SHA512
1cca5c7697ba00ab414fc0dd3715bf62cb76d1aea093795ec13124ce1765ca7daaddb178875e470cf10781fd66e69630b8425275c32bfd823bdfd43ab44c09ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
803063fe91c6e1d7ea89f79ea5b45854

SHA1
5b8c77598f13c6889c64c14861bfd8b51c001d10

SHA256
da46f5b86d992f0180f1b852fa0c9b0d52f4342453d8cf0455306300cc0e776c

SHA512
1cca5c7697ba00ab414fc0dd3715bf62cb76d1aea093795ec13124ce1765ca7daaddb178875e470cf10781fd66e69630b8425275c32bfd823bdfd43ab44c09ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
803063fe91c6e1d7ea89f79ea5b45854

SHA1
5b8c77598f13c6889c64c14861bfd8b51c001d10

SHA256
da46f5b86d992f0180f1b852fa0c9b0d52f4342453d8cf0455306300cc0e776c

SHA512
1cca5c7697ba00ab414fc0dd3715bf62cb76d1aea093795ec13124ce1765ca7daaddb178875e470cf10781fd66e69630b8425275c32bfd823bdfd43ab44c09ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si008509.exe

Filesize
258KB

MD5
803063fe91c6e1d7ea89f79ea5b45854

SHA1
5b8c77598f13c6889c64c14861bfd8b51c001d10

SHA256
da46f5b86d992f0180f1b852fa0c9b0d52f4342453d8cf0455306300cc0e776c

SHA512
1cca5c7697ba00ab414fc0dd3715bf62cb76d1aea093795ec13124ce1765ca7daaddb178875e470cf10781fd66e69630b8425275c32bfd823bdfd43ab44c09ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si008509.exe

Filesize
258KB

MD5
803063fe91c6e1d7ea89f79ea5b45854

SHA1
5b8c77598f13c6889c64c14861bfd8b51c001d10

SHA256
da46f5b86d992f0180f1b852fa0c9b0d52f4342453d8cf0455306300cc0e776c

SHA512
1cca5c7697ba00ab414fc0dd3715bf62cb76d1aea093795ec13124ce1765ca7daaddb178875e470cf10781fd66e69630b8425275c32bfd823bdfd43ab44c09ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un875073.exe

Filesize
689KB

MD5
dc9ebb800689ebb22883f86bb57f226c

SHA1
42e3b5853186c378f2c34ff02a733003039a527c

SHA256
88d45358b13fb2b9924ff5b2bca78661fdc7e086cbe05d2d23217ec342559e11

SHA512
fbdf7dd1953ce39bff3d98a6298bdc4ac33d76df276cde383c032d17998b3f437fc5675fc1673271676fe00d983df32c91d5dbc90c2eb56419797df1ec462ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un875073.exe

Filesize
689KB

MD5
dc9ebb800689ebb22883f86bb57f226c

SHA1
42e3b5853186c378f2c34ff02a733003039a527c

SHA256
88d45358b13fb2b9924ff5b2bca78661fdc7e086cbe05d2d23217ec342559e11

SHA512
fbdf7dd1953ce39bff3d98a6298bdc4ac33d76df276cde383c032d17998b3f437fc5675fc1673271676fe00d983df32c91d5dbc90c2eb56419797df1ec462ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk267695.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk267695.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un398404.exe

Filesize
535KB

MD5
4e3ae370809657030cd003bc0abfceca

SHA1
d5df73d602043c1b0ef5de5b17ed37f0d2a1f6cd

SHA256
4408994ac82643244e3480494076ead8d34c8a8073c94c0164c6643bddcf45e1

SHA512
f9dcd2de4bd08364b99cd32d09a45f08442a42c104dbe275330c5e2116349ea9c19614dc5800875ece694eeb95800836d37f3709ad198ab34bddf7cd7bda7933

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un398404.exe

Filesize
535KB

MD5
4e3ae370809657030cd003bc0abfceca

SHA1
d5df73d602043c1b0ef5de5b17ed37f0d2a1f6cd

SHA256
4408994ac82643244e3480494076ead8d34c8a8073c94c0164c6643bddcf45e1

SHA512
f9dcd2de4bd08364b99cd32d09a45f08442a42c104dbe275330c5e2116349ea9c19614dc5800875ece694eeb95800836d37f3709ad198ab34bddf7cd7bda7933

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr311884.exe

Filesize
266KB

MD5
96d293b456fd0f396b1bdb51f2f7125e

SHA1
fec4299d93004a8963caa5ea46f9fe5b2df494aa

SHA256
967ebf1ba3c4cb58a8d424b1be71c47a651878c1d09ffcfb82cf5d867ee93fd6

SHA512
41b14855f296e68241652c28fa0409593a23b1477a3ee52bea589eec06af04f6e8ba379ae2d7ffc40bb4b9d7ef3b50f8d632e2d7620d1ff2a78ee764fc8f059e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr311884.exe

Filesize
266KB

MD5
96d293b456fd0f396b1bdb51f2f7125e

SHA1
fec4299d93004a8963caa5ea46f9fe5b2df494aa

SHA256
967ebf1ba3c4cb58a8d424b1be71c47a651878c1d09ffcfb82cf5d867ee93fd6

SHA512
41b14855f296e68241652c28fa0409593a23b1477a3ee52bea589eec06af04f6e8ba379ae2d7ffc40bb4b9d7ef3b50f8d632e2d7620d1ff2a78ee764fc8f059e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe

Filesize
350KB

MD5
38fdcd87273bbfbc59e897aac56b76ac

SHA1
155be6b992c212d499b8f1e8e81a03b02f79995a

SHA256
bc38bfa211dc1429adc3f933bb37b2a297967c1ebf7dda31f10db867bef6dbd3

SHA512
f925279eaafdceb55ab4f7860bd2420aec0f4d535c6ae9e77a27fa29f4b757d54fe41a3a31c4f7157e4317e49bbb1fdfc9594d439ec35e50b5db08a37e029786

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe

Filesize
350KB

MD5
38fdcd87273bbfbc59e897aac56b76ac

SHA1
155be6b992c212d499b8f1e8e81a03b02f79995a

SHA256
bc38bfa211dc1429adc3f933bb37b2a297967c1ebf7dda31f10db867bef6dbd3

SHA512
f925279eaafdceb55ab4f7860bd2420aec0f4d535c6ae9e77a27fa29f4b757d54fe41a3a31c4f7157e4317e49bbb1fdfc9594d439ec35e50b5db08a37e029786

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu709373.exe

Filesize
350KB

MD5
38fdcd87273bbfbc59e897aac56b76ac

SHA1
155be6b992c212d499b8f1e8e81a03b02f79995a

SHA256
bc38bfa211dc1429adc3f933bb37b2a297967c1ebf7dda31f10db867bef6dbd3

SHA512
f925279eaafdceb55ab4f7860bd2420aec0f4d535c6ae9e77a27fa29f4b757d54fe41a3a31c4f7157e4317e49bbb1fdfc9594d439ec35e50b5db08a37e029786

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2236-1022-0x0000000002D70000-0x0000000002DAB000-memory.dmp

Filesize
236KB

Download
memory/3384-157-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-166-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-178-0x00000000073D0000-0x00000000073E0000-memory.dmp

Filesize
64KB

Download
memory/3384-180-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-181-0x00000000073D0000-0x00000000073E0000-memory.dmp

Filesize
64KB

Download
memory/3384-183-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-185-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-187-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-188-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/3384-189-0x00000000073D0000-0x00000000073E0000-memory.dmp

Filesize
64KB

Download
memory/3384-191-0x00000000073D0000-0x00000000073E0000-memory.dmp

Filesize
64KB

Download
memory/3384-192-0x00000000073D0000-0x00000000073E0000-memory.dmp

Filesize
64KB

Download
memory/3384-193-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/3384-155-0x0000000002C70000-0x0000000002C9D000-memory.dmp

Filesize
180KB

Download
memory/3384-176-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-174-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-172-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-170-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-168-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-177-0x00000000073D0000-0x00000000073E0000-memory.dmp

Filesize
64KB

Download
memory/3384-164-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-162-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-160-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-158-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3384-156-0x00000000073E0000-0x0000000007984000-memory.dmp

Filesize
5.6MB

Download
memory/3988-200-0x0000000004870000-0x00000000048B7000-memory.dmp

Filesize
284KB

Download
memory/4668-209-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-234-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4668-221-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-223-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-225-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-227-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4668-229-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4668-228-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-232-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4668-235-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-238-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-240-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-198-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4668-217-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-231-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-242-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-244-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-246-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-204-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4668-206-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4668-208-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-212-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-215-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4668-1026-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4668-1021-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4900-337-0x0000000007E10000-0x0000000007EA2000-memory.dmp

Filesize
584KB

Download
memory/4900-218-0x0000000006FC0000-0x00000000070CA000-memory.dmp

Filesize
1.0MB

Download
memory/4900-795-0x0000000004360000-0x00000000043B0000-memory.dmp

Filesize
320KB

Download
memory/4900-214-0x0000000006E90000-0x0000000006EA2000-memory.dmp

Filesize
72KB

Download
memory/4900-377-0x0000000008050000-0x000000000806E000-memory.dmp

Filesize
120KB

Download
memory/4900-366-0x0000000008F90000-0x00000000094BC000-memory.dmp

Filesize
5.2MB

Download
memory/4900-211-0x0000000007410000-0x0000000007A28000-memory.dmp

Filesize
6.1MB

Download
memory/4900-359-0x0000000008890000-0x0000000008A52000-memory.dmp

Filesize
1.8MB

Download
memory/4900-350-0x0000000007EB0000-0x0000000007F26000-memory.dmp

Filesize
472KB

Download
memory/4900-205-0x0000000000160000-0x0000000000188000-memory.dmp

Filesize
160KB

Download
memory/4900-219-0x0000000006EF0000-0x0000000006F2C000-memory.dmp

Filesize
240KB

Download
memory/4900-294-0x0000000007230000-0x0000000007296000-memory.dmp

Filesize
408KB

Download
memory/4900-236-0x0000000006F30000-0x0000000006F40000-memory.dmp

Filesize
64KB

Download