amadey | 6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244

Analysis

max time kernel
148s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe
Size

945KB
MD5

b8094df3b1371a92a7934db5e7d2be6c
SHA1

e444697707f2567a0114f60f51b7d6315e7c95ed
SHA256

6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244
SHA512

61a76939322b33fd1b7646f8090d54cd983f73fd3003f6bd0e2b7372a582b08a5763bb367dbe20fdb5dafc4609fb7a76dee4917fd8fed2d7dac1f153333deca0
SSDEEP

12288:Yy90F5FVhAxAEVOyvMym+ysPU0mFMoSzGqHecgvpv4kG49rrIkiMEApoGEeWIrhV:YyA0VWkM0bZGqHKxl3IY0SFQ4

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr191603.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr191603.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr191603.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr191603.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr191603.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr191603.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	si458417.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
4848	un935727.exe
1156	un993370.exe
3892	pr191603.exe
1936	qu382512.exe
5076	rk617394.exe
2588	si458417.exe
2820	oneetx.exe
2292	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
3740	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr191603.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr191603.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un935727.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un935727.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un993370.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un993370.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
3468	3892	WerFault.exe	88
4188	1936	WerFault.exe	94
3860	2588	WerFault.exe	102
116	2588	WerFault.exe	102
2024	2588	WerFault.exe	102
3740	2588	WerFault.exe	102
4656	2588	WerFault.exe	102
3524	2588	WerFault.exe	102
1552	2588	WerFault.exe	102
3848	2588	WerFault.exe	102
1472	2588	WerFault.exe	102
4716	2588	WerFault.exe	102
1128	2820	WerFault.exe	122
2036	2820	WerFault.exe	122
4756	2820	WerFault.exe	122
1404	2820	WerFault.exe	122
4748	2820	WerFault.exe	122
4356	2820	WerFault.exe	122
4048	2820	WerFault.exe	122
532	2820	WerFault.exe	122
2892	2820	WerFault.exe	122
2376	2820	WerFault.exe	122
1156	2820	WerFault.exe	122
2936	2820	WerFault.exe	122
2640	2820	WerFault.exe	122
212	2292	WerFault.exe	153
2776	2820	WerFault.exe	122
3780	2820	WerFault.exe	122
4272	2820	WerFault.exe	122

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3892	pr191603.exe
3892	pr191603.exe
1936	qu382512.exe
1936	qu382512.exe
5076	rk617394.exe
5076	rk617394.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	pr191603.exe
Token: SeDebugPrivilege	1936	qu382512.exe
Token: SeDebugPrivilege	5076	rk617394.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	si458417.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4848	3744	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe	86
PID 3744 wrote to memory of 4848	3744	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe	86
PID 3744 wrote to memory of 4848	3744	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe	86
PID 4848 wrote to memory of 1156	4848	un935727.exe	87
PID 4848 wrote to memory of 1156	4848	un935727.exe	87
PID 4848 wrote to memory of 1156	4848	un935727.exe	87
PID 1156 wrote to memory of 3892	1156	un993370.exe	88
PID 1156 wrote to memory of 3892	1156	un993370.exe	88
PID 1156 wrote to memory of 3892	1156	un993370.exe	88
PID 1156 wrote to memory of 1936	1156	un993370.exe	94
PID 1156 wrote to memory of 1936	1156	un993370.exe	94
PID 1156 wrote to memory of 1936	1156	un993370.exe	94
PID 4848 wrote to memory of 5076	4848	un935727.exe	99
PID 4848 wrote to memory of 5076	4848	un935727.exe	99
PID 4848 wrote to memory of 5076	4848	un935727.exe	99
PID 3744 wrote to memory of 2588	3744	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe	102
PID 3744 wrote to memory of 2588	3744	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe	102
PID 3744 wrote to memory of 2588	3744	6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe	102
PID 2588 wrote to memory of 2820	2588	si458417.exe	122
PID 2588 wrote to memory of 2820	2588	si458417.exe	122
PID 2588 wrote to memory of 2820	2588	si458417.exe	122
PID 2820 wrote to memory of 2516	2820	oneetx.exe	139
PID 2820 wrote to memory of 2516	2820	oneetx.exe	139
PID 2820 wrote to memory of 2516	2820	oneetx.exe	139
PID 2820 wrote to memory of 3740	2820	oneetx.exe	158
PID 2820 wrote to memory of 3740	2820	oneetx.exe	158
PID 2820 wrote to memory of 3740	2820	oneetx.exe	158

C:\Users\Admin\AppData\Local\Temp\6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe
"C:\Users\Admin\AppData\Local\Temp\6c12fde45303f36f913848d3ac220dd4dd393f11e952ca2cf32f669f7f400244.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un935727.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un935727.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un993370.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un993370.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr191603.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr191603.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 1076
        5⤵
        Program crash
        
        PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu382512.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu382512.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1960
        5⤵
        Program crash
        
        PID:4188
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk617394.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk617394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458417.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458417.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 700
    3⤵
    - Program crash
    PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 800
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 888
    3⤵
    - Program crash
    PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 952
    3⤵
    - Program crash
    PID:3740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 952
    3⤵
    - Program crash
    PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 952
    3⤵
    - Program crash
    PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1216
    3⤵
    - Program crash
    PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1236
    3⤵
    - Program crash
    PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1320
    3⤵
    - Program crash
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 692
      4⤵
      Program crash
      PID:1128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 832
      4⤵
      Program crash
      PID:2036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 892
      4⤵
      Program crash
      PID:4756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1052
      4⤵
      Program crash
      PID:1404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1072
      4⤵
      Program crash
      PID:4748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1088
      4⤵
      Program crash
      PID:4356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1104
      4⤵
      Program crash
      PID:4048
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1016
      4⤵
      Program crash
      PID:532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1288
      4⤵
      Program crash
      PID:2892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1336
      4⤵
      Program crash
      PID:2376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1392
      4⤵
      Program crash
      PID:1156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1304
      4⤵
      Program crash
      PID:2936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1148
      4⤵
      Program crash
      PID:2640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1632
      4⤵
      Program crash
      PID:2776
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:3740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1276
      4⤵
      Program crash
      PID:3780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1656
      4⤵
      Program crash
      PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1336
    3⤵
    - Program crash
    PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3892 -ip 3892
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1936 -ip 1936
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2588 -ip 2588
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2588 -ip 2588
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2588 -ip 2588
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2588 -ip 2588
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2588 -ip 2588
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2588 -ip 2588
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2588 -ip 2588
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2588 -ip 2588
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2588 -ip 2588
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2588 -ip 2588
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2820 -ip 2820
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2820 -ip 2820
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2820 -ip 2820
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2820 -ip 2820
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2820 -ip 2820
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2820 -ip 2820
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2820 -ip 2820
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2820 -ip 2820
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2820 -ip 2820
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2820 -ip 2820
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2820 -ip 2820
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2820 -ip 2820
1⤵
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2820 -ip 2820
1⤵
PID:1040

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 316
  2⤵
  - Program crash
  PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2292 -ip 2292
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2820 -ip 2820
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2820 -ip 2820
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2820 -ip 2820
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
e232a81b05dfaa319bbf24afaab7eb5d

SHA1
1cf58c063a24391a59d26f3379bcf90af1bd8122

SHA256
19215dd8ede93606026c9d8739063fa910ca89c9129714207287d9a74f7ee2f9

SHA512
4dbc88b60b32c973efc215bf49bf36afa955cd517fe809638f774b5578b7569e174b9a2ff85e054cac409962029a4ec755bb69624d37729e5fab686cf81882ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
e232a81b05dfaa319bbf24afaab7eb5d

SHA1
1cf58c063a24391a59d26f3379bcf90af1bd8122

SHA256
19215dd8ede93606026c9d8739063fa910ca89c9129714207287d9a74f7ee2f9

SHA512
4dbc88b60b32c973efc215bf49bf36afa955cd517fe809638f774b5578b7569e174b9a2ff85e054cac409962029a4ec755bb69624d37729e5fab686cf81882ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
e232a81b05dfaa319bbf24afaab7eb5d

SHA1
1cf58c063a24391a59d26f3379bcf90af1bd8122

SHA256
19215dd8ede93606026c9d8739063fa910ca89c9129714207287d9a74f7ee2f9

SHA512
4dbc88b60b32c973efc215bf49bf36afa955cd517fe809638f774b5578b7569e174b9a2ff85e054cac409962029a4ec755bb69624d37729e5fab686cf81882ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
e232a81b05dfaa319bbf24afaab7eb5d

SHA1
1cf58c063a24391a59d26f3379bcf90af1bd8122

SHA256
19215dd8ede93606026c9d8739063fa910ca89c9129714207287d9a74f7ee2f9

SHA512
4dbc88b60b32c973efc215bf49bf36afa955cd517fe809638f774b5578b7569e174b9a2ff85e054cac409962029a4ec755bb69624d37729e5fab686cf81882ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458417.exe

Filesize
258KB

MD5
e232a81b05dfaa319bbf24afaab7eb5d

SHA1
1cf58c063a24391a59d26f3379bcf90af1bd8122

SHA256
19215dd8ede93606026c9d8739063fa910ca89c9129714207287d9a74f7ee2f9

SHA512
4dbc88b60b32c973efc215bf49bf36afa955cd517fe809638f774b5578b7569e174b9a2ff85e054cac409962029a4ec755bb69624d37729e5fab686cf81882ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458417.exe

Filesize
258KB

MD5
e232a81b05dfaa319bbf24afaab7eb5d

SHA1
1cf58c063a24391a59d26f3379bcf90af1bd8122

SHA256
19215dd8ede93606026c9d8739063fa910ca89c9129714207287d9a74f7ee2f9

SHA512
4dbc88b60b32c973efc215bf49bf36afa955cd517fe809638f774b5578b7569e174b9a2ff85e054cac409962029a4ec755bb69624d37729e5fab686cf81882ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un935727.exe

Filesize
689KB

MD5
fab6c0b0acebab21e3f9d29e75939660

SHA1
4e207ba0e32a5a4779e8d59017eeec8115936691

SHA256
32c7debe3122996bcea187b53c1660ee94033dd7ad192888706d4646576f7322

SHA512
c0968f2f0befd30758effd216666b730b28a1509b61806d595562dee429987a30e77c54a9eafdf915239a06ab53bf6caac33125ded826eb68265dcc9bab45ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un935727.exe

Filesize
689KB

MD5
fab6c0b0acebab21e3f9d29e75939660

SHA1
4e207ba0e32a5a4779e8d59017eeec8115936691

SHA256
32c7debe3122996bcea187b53c1660ee94033dd7ad192888706d4646576f7322

SHA512
c0968f2f0befd30758effd216666b730b28a1509b61806d595562dee429987a30e77c54a9eafdf915239a06ab53bf6caac33125ded826eb68265dcc9bab45ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk617394.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk617394.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un993370.exe

Filesize
535KB

MD5
3d3e77b580de2cfd1210344b6efc7830

SHA1
eadbb46def44ae3dcd905b00170ccdd5650b1c39

SHA256
56300eaad885aab47f5d346d0217db6b3f99d37cdde641467c66ccc40e15c6b5

SHA512
4f17166aa33995023f7d63b01267027574f785950040564d96d9d5bd45975b370c0fbbd2238906c0c02233dbe56c27dd167a35da5d94138ffbe6574e28a643d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un993370.exe

Filesize
535KB

MD5
3d3e77b580de2cfd1210344b6efc7830

SHA1
eadbb46def44ae3dcd905b00170ccdd5650b1c39

SHA256
56300eaad885aab47f5d346d0217db6b3f99d37cdde641467c66ccc40e15c6b5

SHA512
4f17166aa33995023f7d63b01267027574f785950040564d96d9d5bd45975b370c0fbbd2238906c0c02233dbe56c27dd167a35da5d94138ffbe6574e28a643d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr191603.exe

Filesize
266KB

MD5
e3aff6ba7e43ac2f566c53d480ac6663

SHA1
e6f351340af5d706801cb33ced24a03688fdc999

SHA256
003de7a15200206c3fcb9110f3f84bd9b0b3e7bf07eb3415ff67f2489a5844cd

SHA512
5fa5694acbf5e88328b55d0e477c26d35ea70dcdb5bf7d6fffcdf564605af04f0a00bf23e901376cf8aab51cf7384ceabb6660de4023fb13f317b250079e3a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr191603.exe

Filesize
266KB

MD5
e3aff6ba7e43ac2f566c53d480ac6663

SHA1
e6f351340af5d706801cb33ced24a03688fdc999

SHA256
003de7a15200206c3fcb9110f3f84bd9b0b3e7bf07eb3415ff67f2489a5844cd

SHA512
5fa5694acbf5e88328b55d0e477c26d35ea70dcdb5bf7d6fffcdf564605af04f0a00bf23e901376cf8aab51cf7384ceabb6660de4023fb13f317b250079e3a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu382512.exe

Filesize
350KB

MD5
f93a67a59e3c1225a776f73fb7fef484

SHA1
94c8bdc62245858bcb92d131eb29769313b99bd4

SHA256
dc584226e53a486c5ca0bbc552366b0d76eeb4d0da6e8464022e711524cbcd65

SHA512
912be9c94b007f9689df681dbde80647c29d010700406e5aa5618a1552a6cbea9e80154832f65c8c26b3f331920ae6af54692d2c3bfeb131a32fac0c40764b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu382512.exe

Filesize
350KB

MD5
f93a67a59e3c1225a776f73fb7fef484

SHA1
94c8bdc62245858bcb92d131eb29769313b99bd4

SHA256
dc584226e53a486c5ca0bbc552366b0d76eeb4d0da6e8464022e711524cbcd65

SHA512
912be9c94b007f9689df681dbde80647c29d010700406e5aa5618a1552a6cbea9e80154832f65c8c26b3f331920ae6af54692d2c3bfeb131a32fac0c40764b83

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1936-1005-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/1936-229-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-1010-0x000000000B4C0000-0x000000000B9EC000-memory.dmp

Filesize
5.2MB

Download
memory/1936-1009-0x000000000B2E0000-0x000000000B4A2000-memory.dmp

Filesize
1.8MB

Download
memory/1936-1008-0x000000000B150000-0x000000000B1A0000-memory.dmp

Filesize
320KB

Download
memory/1936-1007-0x000000000B0C0000-0x000000000B0DE000-memory.dmp

Filesize
120KB

Download
memory/1936-1006-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/1936-1004-0x000000000B000000-0x000000000B076000-memory.dmp

Filesize
472KB

Download
memory/1936-1003-0x000000000AF60000-0x000000000AFF2000-memory.dmp

Filesize
584KB

Download
memory/1936-1002-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/1936-1001-0x000000000A750000-0x000000000A7B6000-memory.dmp

Filesize
408KB

Download
memory/1936-999-0x000000000A460000-0x000000000A49C000-memory.dmp

Filesize
240KB

Download
memory/1936-998-0x000000000A340000-0x000000000A44A000-memory.dmp

Filesize
1.0MB

Download
memory/1936-997-0x000000000A320000-0x000000000A332000-memory.dmp

Filesize
72KB

Download
memory/1936-201-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-200-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-203-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-206-0x0000000002C70000-0x0000000002CB6000-memory.dmp

Filesize
280KB

Download
memory/1936-205-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-208-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/1936-210-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/1936-212-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/1936-213-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-209-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-215-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-217-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-219-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-221-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-223-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-225-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-227-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-996-0x0000000009CC0000-0x000000000A2D8000-memory.dmp

Filesize
6.1MB

Download
memory/1936-231-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-233-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/1936-235-0x00000000077C0000-0x00000000077F5000-memory.dmp

Filesize
212KB

Download
memory/2588-1024-0x0000000002C60000-0x0000000002C9B000-memory.dmp

Filesize
236KB

Download
memory/3892-171-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-158-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/3892-194-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/3892-193-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/3892-169-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-191-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/3892-189-0x0000000002E20000-0x0000000002E4D000-memory.dmp

Filesize
180KB

Download
memory/3892-173-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-188-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/3892-187-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-185-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-183-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-177-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-181-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-192-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/3892-155-0x0000000002E20000-0x0000000002E4D000-memory.dmp

Filesize
180KB

Download
memory/3892-156-0x0000000007490000-0x0000000007A34000-memory.dmp

Filesize
5.6MB

Download
memory/3892-167-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-165-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-175-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-163-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-160-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/3892-161-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-179-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-159-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3892-157-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/5076-1018-0x0000000007590000-0x00000000075A0000-memory.dmp

Filesize
64KB

Download
memory/5076-1017-0x0000000000480000-0x00000000004A8000-memory.dmp

Filesize
160KB

Download