amadey | 55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe
Size

944KB
MD5

7e9ab50d780b0305699103cd67a637d8
SHA1

a3d32428788661672b25772a28af4c0ef772cc05
SHA256

55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17
SHA512

3227f4811251736fa01999db08c7386b7cfc8af2b216531f22c55c33c27618855aa58911e56e6e56739f861e876c1773d5ed036e7f50546e1d11d16782e9d48d
SSDEEP

24576:my7CmA6RXOZ6q2Aka3aIgdvtuByBCcAT5XUwy/mjF:1J3RBrcKldvhBCTT5XUB/

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr426399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr426399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr426399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr426399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr426399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr426399.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	si532465.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
1524	un041444.exe
4280	un171920.exe
2264	pr426399.exe
3492	qu190984.exe
2120	rk237174.exe
2376	si532465.exe
2028	oneetx.exe
220	oneetx.exe
1212	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
4400	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr426399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr426399.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un041444.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un041444.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un171920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un171920.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
3732	2264	WerFault.exe	86
1512	3492	WerFault.exe	92
2480	2376	WerFault.exe	97
1808	2376	WerFault.exe	97
4076	2376	WerFault.exe	97
4896	2376	WerFault.exe	97
1612	2376	WerFault.exe	97
2356	2376	WerFault.exe	97
2468	2376	WerFault.exe	97
2756	2376	WerFault.exe	97
4880	2376	WerFault.exe	97
1344	2028	WerFault.exe	117
1452	2028	WerFault.exe	117
1884	2028	WerFault.exe	117
5044	2028	WerFault.exe	117
4416	2028	WerFault.exe	117
1520	2028	WerFault.exe	117
3884	2028	WerFault.exe	117
228	2028	WerFault.exe	117
3752	2028	WerFault.exe	117
1700	2028	WerFault.exe	117
2780	2028	WerFault.exe	117
2768	2028	WerFault.exe	117
4564	2028	WerFault.exe	117
3556	2028	WerFault.exe	117
4132	2028	WerFault.exe	117

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2264	pr426399.exe
2264	pr426399.exe
3492	qu190984.exe
3492	qu190984.exe
2120	rk237174.exe
2120	rk237174.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	pr426399.exe
Token: SeDebugPrivilege	3492	qu190984.exe
Token: SeDebugPrivilege	2120	rk237174.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	si532465.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1524	1796	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe	84
PID 1796 wrote to memory of 1524	1796	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe	84
PID 1796 wrote to memory of 1524	1796	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe	84
PID 1524 wrote to memory of 4280	1524	un041444.exe	85
PID 1524 wrote to memory of 4280	1524	un041444.exe	85
PID 1524 wrote to memory of 4280	1524	un041444.exe	85
PID 4280 wrote to memory of 2264	4280	un171920.exe	86
PID 4280 wrote to memory of 2264	4280	un171920.exe	86
PID 4280 wrote to memory of 2264	4280	un171920.exe	86
PID 4280 wrote to memory of 3492	4280	un171920.exe	92
PID 4280 wrote to memory of 3492	4280	un171920.exe	92
PID 4280 wrote to memory of 3492	4280	un171920.exe	92
PID 1524 wrote to memory of 2120	1524	un041444.exe	95
PID 1524 wrote to memory of 2120	1524	un041444.exe	95
PID 1524 wrote to memory of 2120	1524	un041444.exe	95
PID 1796 wrote to memory of 2376	1796	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe	97
PID 1796 wrote to memory of 2376	1796	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe	97
PID 1796 wrote to memory of 2376	1796	55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe	97
PID 2376 wrote to memory of 2028	2376	si532465.exe	117
PID 2376 wrote to memory of 2028	2376	si532465.exe	117
PID 2376 wrote to memory of 2028	2376	si532465.exe	117
PID 2028 wrote to memory of 2408	2028	oneetx.exe	135
PID 2028 wrote to memory of 2408	2028	oneetx.exe	135
PID 2028 wrote to memory of 2408	2028	oneetx.exe	135
PID 2028 wrote to memory of 4400	2028	oneetx.exe	150
PID 2028 wrote to memory of 4400	2028	oneetx.exe	150
PID 2028 wrote to memory of 4400	2028	oneetx.exe	150

C:\Users\Admin\AppData\Local\Temp\55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe
"C:\Users\Admin\AppData\Local\Temp\55d6e88e7b8308e4dc1a3890f34f0b667aafc4e79f53fac8a2aec72ddac84f17.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un041444.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un041444.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171920.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171920.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr426399.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr426399.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1092
        5⤵
        Program crash
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu190984.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu190984.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3492
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 2016
        5⤵
        Program crash
        
        PID:1512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk237174.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk237174.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si532465.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si532465.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 696
    3⤵
    - Program crash
    PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 780
    3⤵
    - Program crash
    PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 796
    3⤵
    - Program crash
    PID:4076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 800
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 968
    3⤵
    - Program crash
    PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 968
    3⤵
    - Program crash
    PID:2356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1212
    3⤵
    - Program crash
    PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1248
    3⤵
    - Program crash
    PID:2756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1352
    3⤵
    - Program crash
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 692
      4⤵
      Program crash
      PID:1344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 836
      4⤵
      Program crash
      PID:1452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 868
      4⤵
      Program crash
      PID:1884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1060
      4⤵
      Program crash
      PID:5044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1088
      4⤵
      Program crash
      PID:4416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1088
      4⤵
      Program crash
      PID:1520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1080
      4⤵
      Program crash
      PID:3884
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 992
      4⤵
      Program crash
      PID:228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 696
      4⤵
      Program crash
      PID:3752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 988
      4⤵
      Program crash
      PID:1700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 768
      4⤵
      Program crash
      PID:2780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1112
      4⤵
      Program crash
      PID:2768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1688
      4⤵
      Program crash
      PID:4564
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1628
      4⤵
      Program crash
      PID:3556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1696
      4⤵
      Program crash
      PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2264 -ip 2264
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3492 -ip 3492
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2376 -ip 2376
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2376 -ip 2376
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2376 -ip 2376
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2376 -ip 2376
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2376 -ip 2376
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2376 -ip 2376
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2376 -ip 2376
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2376 -ip 2376
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2376 -ip 2376
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2028 -ip 2028
1⤵
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2028 -ip 2028
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2028 -ip 2028
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2028 -ip 2028
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2028 -ip 2028
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2028 -ip 2028
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2028 -ip 2028
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2028 -ip 2028
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2028 -ip 2028
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2028 -ip 2028
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2028 -ip 2028
1⤵
PID:3384

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2028 -ip 2028
1⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2028 -ip 2028
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2028 -ip 2028
1⤵
PID:1868

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2028 -ip 2028
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si532465.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si532465.exe

Filesize
258KB

MD5
a2b139607a51270b6cf3a8bdb1d03925

SHA1
102fcc195398169383991debafa63e60a1125440

SHA256
3f681894f8f314153201afaeaa92927fba45be28692eca6c3e4017c3867be45c

SHA512
a2cf209091baddfb2be24f6ae6ea19325d6ba885cd52c3aa5bcde822a25187d3175c804f88aa484824df5f1b2d35ccfc2ab74f38e6fa8495f22b6a84fd9aec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un041444.exe

Filesize
689KB

MD5
fe5231eb915c2e518aa759ab3be89241

SHA1
86aed9fa5fa6cc801eea4713b38b5b02063c0f23

SHA256
495d0f0da916308d65481214a43716a4f4bab692d06358d5c2eba8f200b97b93

SHA512
3a808f10be6d17e55fb56880f6eb2173157b70ed2be158072d20acc9343a720229d7aa5aeff32c1b7d0e2724dcc95d903e25bbd6881845071b2ee5897d759168

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un041444.exe

Filesize
689KB

MD5
fe5231eb915c2e518aa759ab3be89241

SHA1
86aed9fa5fa6cc801eea4713b38b5b02063c0f23

SHA256
495d0f0da916308d65481214a43716a4f4bab692d06358d5c2eba8f200b97b93

SHA512
3a808f10be6d17e55fb56880f6eb2173157b70ed2be158072d20acc9343a720229d7aa5aeff32c1b7d0e2724dcc95d903e25bbd6881845071b2ee5897d759168

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk237174.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk237174.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171920.exe

Filesize
534KB

MD5
cf6c7cfd7321d46911c7304314de627f

SHA1
2bb9e585559e7d2584367ec38a20e80ab82289c6

SHA256
1a6030147e24a3cc457f752903c0ad9a142c34a9012047bf146aec91f494c2a7

SHA512
3d0642d25a60c698351b13c712db7ab54f6d20e8b9c429ec106f9567cba2e1a6536d89891a915c63031c4c16a5ea18d3b9d48dfd6d52b29e02c3bcac84604204

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un171920.exe

Filesize
534KB

MD5
cf6c7cfd7321d46911c7304314de627f

SHA1
2bb9e585559e7d2584367ec38a20e80ab82289c6

SHA256
1a6030147e24a3cc457f752903c0ad9a142c34a9012047bf146aec91f494c2a7

SHA512
3d0642d25a60c698351b13c712db7ab54f6d20e8b9c429ec106f9567cba2e1a6536d89891a915c63031c4c16a5ea18d3b9d48dfd6d52b29e02c3bcac84604204

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr426399.exe

Filesize
266KB

MD5
670faefe91be17cd47503b1e36c8c3dd

SHA1
62db036b33fc6fbf954ccff235d39a50a240fdd7

SHA256
56a37dd463e01d6e0c1b52fca646d699c51570fc580df9ce3eefec2aa1a34358

SHA512
7c86164fe1ff38273df1b8a72f2bea2c540459a4b232afc74659fb1427d4796532a68a8230329caa191d79052070addfec11fdb51dcfcbb7de5264fb4b0e3287

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr426399.exe

Filesize
266KB

MD5
670faefe91be17cd47503b1e36c8c3dd

SHA1
62db036b33fc6fbf954ccff235d39a50a240fdd7

SHA256
56a37dd463e01d6e0c1b52fca646d699c51570fc580df9ce3eefec2aa1a34358

SHA512
7c86164fe1ff38273df1b8a72f2bea2c540459a4b232afc74659fb1427d4796532a68a8230329caa191d79052070addfec11fdb51dcfcbb7de5264fb4b0e3287

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu190984.exe

Filesize
350KB

MD5
19d0a2862a7623456e1022977e5f6db6

SHA1
d5434df1210fcc3dde243f5ed71f47ce0c1f696b

SHA256
b519fe5a9f6fd5f82523f776c1f6c60441b8586028082fd95b2355d04fdebb3b

SHA512
348abbc3e385fd5593d0f2fdf76abb4355750e6ae280e61cd51f56bf5e5a2fec86e54e15bf0ac05817467373212f617892f90f6f78ef0516d2647c71e5ee3bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu190984.exe

Filesize
350KB

MD5
19d0a2862a7623456e1022977e5f6db6

SHA1
d5434df1210fcc3dde243f5ed71f47ce0c1f696b

SHA256
b519fe5a9f6fd5f82523f776c1f6c60441b8586028082fd95b2355d04fdebb3b

SHA512
348abbc3e385fd5593d0f2fdf76abb4355750e6ae280e61cd51f56bf5e5a2fec86e54e15bf0ac05817467373212f617892f90f6f78ef0516d2647c71e5ee3bd4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2120-1013-0x0000000000320000-0x0000000000348000-memory.dmp

Filesize
160KB

Download
memory/2120-1014-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2264-157-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-176-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-182-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-184-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-185-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2264-186-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2264-187-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2264-188-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/2264-189-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2264-190-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2264-191-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2264-193-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/2264-178-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-180-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-174-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-172-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-170-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-168-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-166-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-164-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-162-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-160-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-155-0x0000000002D30000-0x0000000002D5D000-memory.dmp

Filesize
180KB

Download
memory/2264-158-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/2264-156-0x0000000007260000-0x0000000007804000-memory.dmp

Filesize
5.6MB

Download
memory/2376-1020-0x0000000004800000-0x000000000483B000-memory.dmp

Filesize
236KB

Download
memory/3492-208-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-224-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-228-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-229-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3492-226-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-231-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-233-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-235-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-994-0x0000000009CA0000-0x000000000A2B8000-memory.dmp

Filesize
6.1MB

Download
memory/3492-995-0x000000000A310000-0x000000000A322000-memory.dmp

Filesize
72KB

Download
memory/3492-996-0x000000000A330000-0x000000000A43A000-memory.dmp

Filesize
1.0MB

Download
memory/3492-997-0x000000000A460000-0x000000000A49C000-memory.dmp

Filesize
240KB

Download
memory/3492-998-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3492-999-0x000000000A750000-0x000000000A7B6000-memory.dmp

Filesize
408KB

Download
memory/3492-1000-0x000000000AE20000-0x000000000AEB2000-memory.dmp

Filesize
584KB

Download
memory/3492-1001-0x000000000AFD0000-0x000000000B046000-memory.dmp

Filesize
472KB

Download
memory/3492-1002-0x000000000B080000-0x000000000B09E000-memory.dmp

Filesize
120KB

Download
memory/3492-1003-0x000000000B120000-0x000000000B170000-memory.dmp

Filesize
320KB

Download
memory/3492-1004-0x000000000B2E0000-0x000000000B4A2000-memory.dmp

Filesize
1.8MB

Download
memory/3492-220-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-222-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-218-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-216-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-214-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-212-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-210-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-206-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-202-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-204-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-201-0x0000000004CA0000-0x0000000004CD5000-memory.dmp

Filesize
212KB

Download
memory/3492-200-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3492-198-0x0000000004800000-0x0000000004846000-memory.dmp

Filesize
280KB

Download
memory/3492-199-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3492-1005-0x000000000B6C0000-0x000000000BBEC000-memory.dmp

Filesize
5.2MB

Download
memory/3492-1009-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download