amadey | 96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2023 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe
Size

948KB
MD5

1b2b6e33f280907366e608fa67b67c5a
SHA1

498e8ec6c3966dfc17950319b5170113b4a0aa82
SHA256

96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2
SHA512

30b6b6c6392c773093531a18704d7869aa6d0794984237d5750746d79e135e768fc8097c022b0db3a36ad1734977f9274ef55d1e594a42a7bc6532281716f241
SSDEEP

24576:WyJpDHozxIwxGCaaWvoi+cW5yjRMAFT4a5QPHReVN8xT:lJpDHozxIwsCatE4MOgG

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr338989.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr338989.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr338989.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr338989.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr338989.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr338989.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	si520817.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
1260	un708050.exe
1932	un209797.exe
4620	pr338989.exe
1208	qu750325.exe
3736	rk599373.exe
1592	si520817.exe
3344	oneetx.exe
5012	oneetx.exe
3364	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr338989.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr338989.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un708050.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un708050.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un209797.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un209797.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
3520	4620	WerFault.exe	87
4232	1208	WerFault.exe	93
4800	1592	WerFault.exe	98
464	1592	WerFault.exe	98
2164	1592	WerFault.exe	98
4748	1592	WerFault.exe	98
940	1592	WerFault.exe	98
1456	1592	WerFault.exe	98
3020	1592	WerFault.exe	98
4912	1592	WerFault.exe	98
1452	1592	WerFault.exe	98
3336	1592	WerFault.exe	98
1004	3344	WerFault.exe	118
4332	3344	WerFault.exe	118
2748	3344	WerFault.exe	118
3204	3344	WerFault.exe	118
2732	3344	WerFault.exe	118
3356	3344	WerFault.exe	118
3656	3344	WerFault.exe	118
4624	3344	WerFault.exe	118
932	3344	WerFault.exe	118
4140	3344	WerFault.exe	118
4268	3344	WerFault.exe	118
3532	3344	WerFault.exe	118
980	5012	WerFault.exe	150
4608	3344	WerFault.exe	118
3124	3344	WerFault.exe	118
1836	3344	WerFault.exe	118
3996	3364	WerFault.exe	160

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4620	pr338989.exe
4620	pr338989.exe
1208	qu750325.exe
1208	qu750325.exe
3736	rk599373.exe
3736	rk599373.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	pr338989.exe
Token: SeDebugPrivilege	1208	qu750325.exe
Token: SeDebugPrivilege	3736	rk599373.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1592	si520817.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1260	3404	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe	85
PID 3404 wrote to memory of 1260	3404	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe	85
PID 3404 wrote to memory of 1260	3404	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe	85
PID 1260 wrote to memory of 1932	1260	un708050.exe	86
PID 1260 wrote to memory of 1932	1260	un708050.exe	86
PID 1260 wrote to memory of 1932	1260	un708050.exe	86
PID 1932 wrote to memory of 4620	1932	un209797.exe	87
PID 1932 wrote to memory of 4620	1932	un209797.exe	87
PID 1932 wrote to memory of 4620	1932	un209797.exe	87
PID 1932 wrote to memory of 1208	1932	un209797.exe	93
PID 1932 wrote to memory of 1208	1932	un209797.exe	93
PID 1932 wrote to memory of 1208	1932	un209797.exe	93
PID 1260 wrote to memory of 3736	1260	un708050.exe	96
PID 1260 wrote to memory of 3736	1260	un708050.exe	96
PID 1260 wrote to memory of 3736	1260	un708050.exe	96
PID 3404 wrote to memory of 1592	3404	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe	98
PID 3404 wrote to memory of 1592	3404	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe	98
PID 3404 wrote to memory of 1592	3404	96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe	98
PID 1592 wrote to memory of 3344	1592	si520817.exe	118
PID 1592 wrote to memory of 3344	1592	si520817.exe	118
PID 1592 wrote to memory of 3344	1592	si520817.exe	118
PID 3344 wrote to memory of 1864	3344	oneetx.exe	137
PID 3344 wrote to memory of 1864	3344	oneetx.exe	137
PID 3344 wrote to memory of 1864	3344	oneetx.exe	137
PID 3344 wrote to memory of 2924	3344	oneetx.exe	155
PID 3344 wrote to memory of 2924	3344	oneetx.exe	155
PID 3344 wrote to memory of 2924	3344	oneetx.exe	155

C:\Users\Admin\AppData\Local\Temp\96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe
"C:\Users\Admin\AppData\Local\Temp\96799c77044dd59f3d6fbc7158d3d63bace6b80be21242daf3d2226dc524c5a2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un708050.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un708050.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un209797.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un209797.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr338989.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr338989.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1084
        5⤵
        Program crash
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu750325.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu750325.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1328
        5⤵
        Program crash
        
        PID:4232
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk599373.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk599373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si520817.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si520817.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 704
    3⤵
    - Program crash
    PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 772
    3⤵
    - Program crash
    PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 812
    3⤵
    - Program crash
    PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 972
    3⤵
    - Program crash
    PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 812
    3⤵
    - Program crash
    PID:940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 972
    3⤵
    - Program crash
    PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1216
    3⤵
    - Program crash
    PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1204
    3⤵
    - Program crash
    PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1316
    3⤵
    - Program crash
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 692
      4⤵
      Program crash
      PID:1004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 816
      4⤵
      Program crash
      PID:4332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 892
      4⤵
      Program crash
      PID:2748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1052
      4⤵
      Program crash
      PID:3204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1060
      4⤵
      Program crash
      PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1068
      4⤵
      Program crash
      PID:3356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1112
      4⤵
      Program crash
      PID:3656
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1008
      4⤵
      Program crash
      PID:4624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1248
      4⤵
      Program crash
      PID:932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1252
      4⤵
      Program crash
      PID:4140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1276
      4⤵
      Program crash
      PID:4268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1072
      4⤵
      Program crash
      PID:3532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1620
      4⤵
      Program crash
      PID:4608
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1072
      4⤵
      Program crash
      PID:3124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1636
      4⤵
      Program crash
      PID:1836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1356
    3⤵
    - Program crash
    PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4620 -ip 4620
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1208 -ip 1208
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1592 -ip 1592
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1592 -ip 1592
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1592 -ip 1592
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1592 -ip 1592
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1592 -ip 1592
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1592 -ip 1592
1⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1592 -ip 1592
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1592 -ip 1592
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1592 -ip 1592
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1592 -ip 1592
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3344 -ip 3344
1⤵
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3344 -ip 3344
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3344 -ip 3344
1⤵
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3344 -ip 3344
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3344 -ip 3344
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3344 -ip 3344
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3344 -ip 3344
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3344 -ip 3344
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3344 -ip 3344
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3344 -ip 3344
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3344 -ip 3344
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3344 -ip 3344
1⤵
PID:1608

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 312
  2⤵
  - Program crash
  PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5012 -ip 5012
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3344 -ip 3344
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3344 -ip 3344
1⤵
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3344 -ip 3344
1⤵
PID:3304

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 316
  2⤵
  - Program crash
  PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3364 -ip 3364
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si520817.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si520817.exe

Filesize
258KB

MD5
b2aa59d3dbf590f95503b084953eaa3c

SHA1
1307f8b9664856dd8e58918b2d6f22406c4ac715

SHA256
88dd8de40a7500227dc60327f7c9dd255a256810bc0f26f8bb083a6b8ff7ddad

SHA512
c2739440f2d3ba45e64dc3f9001ba63046328a9ab59b12a911672e98ecf409475c5bf829fd298c67d8c1cff0a041609d643c88848c21009394b004f9bc8c35d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un708050.exe

Filesize
693KB

MD5
d89173395376fabb7860b203d197437e

SHA1
547c98bd8677a30486a70856ff25907edb21fec4

SHA256
98a42895e9f72be7fa62920ff12eddceba6b9e2d99f32409fd289438441ab7fc

SHA512
c69e101b53dc1c0def6de9151f0035ce58f5024dde4c4aa3c7a1cec6d2c8c809cff7520fd5c5b60036029e824a892d028cbc7838f205bd478e37861f9df81208

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un708050.exe

Filesize
693KB

MD5
d89173395376fabb7860b203d197437e

SHA1
547c98bd8677a30486a70856ff25907edb21fec4

SHA256
98a42895e9f72be7fa62920ff12eddceba6b9e2d99f32409fd289438441ab7fc

SHA512
c69e101b53dc1c0def6de9151f0035ce58f5024dde4c4aa3c7a1cec6d2c8c809cff7520fd5c5b60036029e824a892d028cbc7838f205bd478e37861f9df81208

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk599373.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk599373.exe

Filesize
136KB

MD5
e48a471cb7bc4ff6a6b32ae6d192dbbb

SHA1
d38181853eccf41490641e35b9f2b13e1f6d1711

SHA256
ce0d0c494beb02432c1c208d73c07be71fefb4afd34e74a98f188417ca86d21c

SHA512
dffde20f58c233b543a9a5e5a4bbdf29767bfb80661541b36c52cd6d53debb6cb3a62d3f7aa76010d06c9b0d74e9b972231eae53cd539f648ec89a85bdc457f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un209797.exe

Filesize
539KB

MD5
95ed57edc8fd5e814fe85c8ee9e8969e

SHA1
81388a008e0a4ea3647f8e5088cd42abd8964c05

SHA256
1aced8cbc1ab2c75d0b91b2a2d3a85a12e19cdf71a70e4d8166033afca22265e

SHA512
1f04eb1b81bb61d07907cd70fbcde80057317e97a56d344a90ec38f90f6581e1d2c9a9839a3b4b0cbc53ac8a746180e8b8d67269f374d47d7f03f57c37d28109

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un209797.exe

Filesize
539KB

MD5
95ed57edc8fd5e814fe85c8ee9e8969e

SHA1
81388a008e0a4ea3647f8e5088cd42abd8964c05

SHA256
1aced8cbc1ab2c75d0b91b2a2d3a85a12e19cdf71a70e4d8166033afca22265e

SHA512
1f04eb1b81bb61d07907cd70fbcde80057317e97a56d344a90ec38f90f6581e1d2c9a9839a3b4b0cbc53ac8a746180e8b8d67269f374d47d7f03f57c37d28109

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr338989.exe

Filesize
278KB

MD5
54c584f9a082e3913396163d22b514e5

SHA1
cfd26f1eebd5cf703bfbc145f2d8c12f27edd623

SHA256
952d13766d686a27832ecc3360ce6e7b66a506de567390439fa95c1763ada399

SHA512
0ee8afe538fc9090aa555b663ebceadab02c8bbbbe2ec6fd69ea49a61a7ec0c86e64f00984c7f5d483379d1cc43edd742cc9c470b1372c0269eff7766872b534

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr338989.exe

Filesize
278KB

MD5
54c584f9a082e3913396163d22b514e5

SHA1
cfd26f1eebd5cf703bfbc145f2d8c12f27edd623

SHA256
952d13766d686a27832ecc3360ce6e7b66a506de567390439fa95c1763ada399

SHA512
0ee8afe538fc9090aa555b663ebceadab02c8bbbbe2ec6fd69ea49a61a7ec0c86e64f00984c7f5d483379d1cc43edd742cc9c470b1372c0269eff7766872b534

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu750325.exe

Filesize
350KB

MD5
b7bf4f5dbda64a323e0e0a64c08980da

SHA1
182cef090d35d24829caebdd5b92624b67e43b5b

SHA256
067b3c475eb18cc159c0c448d411b786a718e864f082805a43f8134a12bfba5b

SHA512
dfb4bbd51aa06e70e79cd7539f498cc120b2d0ef6b42205d95e48bca02d85e9e2764425e3aa6837d6f01e4dbe6830de2511d297335c73dfc775419cb446071e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu750325.exe

Filesize
350KB

MD5
b7bf4f5dbda64a323e0e0a64c08980da

SHA1
182cef090d35d24829caebdd5b92624b67e43b5b

SHA256
067b3c475eb18cc159c0c448d411b786a718e864f082805a43f8134a12bfba5b

SHA512
dfb4bbd51aa06e70e79cd7539f498cc120b2d0ef6b42205d95e48bca02d85e9e2764425e3aa6837d6f01e4dbe6830de2511d297335c73dfc775419cb446071e4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1208-999-0x000000000A750000-0x000000000A7B6000-memory.dmp

Filesize
408KB

Download
memory/1208-244-0x00000000072F0000-0x0000000007300000-memory.dmp

Filesize
64KB

Download
memory/1208-1005-0x0000000004AA0000-0x0000000004AF0000-memory.dmp

Filesize
320KB

Download
memory/1208-1004-0x000000000B980000-0x000000000B99E000-memory.dmp

Filesize
120KB

Download
memory/1208-1003-0x000000000B3D0000-0x000000000B8FC000-memory.dmp

Filesize
5.2MB

Download
memory/1208-1002-0x000000000B200000-0x000000000B3C2000-memory.dmp

Filesize
1.8MB

Download
memory/1208-1001-0x000000000B120000-0x000000000B196000-memory.dmp

Filesize
472KB

Download
memory/1208-1000-0x000000000AF60000-0x000000000AFF2000-memory.dmp

Filesize
584KB

Download
memory/1208-998-0x00000000072F0000-0x0000000007300000-memory.dmp

Filesize
64KB

Download
memory/1208-997-0x000000000A460000-0x000000000A49C000-memory.dmp

Filesize
240KB

Download
memory/1208-996-0x000000000A350000-0x000000000A45A000-memory.dmp

Filesize
1.0MB

Download
memory/1208-995-0x00000000072B0000-0x00000000072C2000-memory.dmp

Filesize
72KB

Download
memory/1208-198-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-199-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-201-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-203-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-205-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-215-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-213-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-211-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-209-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-207-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-217-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-219-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-221-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-223-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-225-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-227-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-229-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-231-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/1208-242-0x0000000004830000-0x0000000004876000-memory.dmp

Filesize
280KB

Download
memory/1208-994-0x0000000009D30000-0x000000000A348000-memory.dmp

Filesize
6.1MB

Download
memory/1208-246-0x00000000072F0000-0x0000000007300000-memory.dmp

Filesize
64KB

Download
memory/1208-248-0x00000000072F0000-0x0000000007300000-memory.dmp

Filesize
64KB

Download
memory/1592-1020-0x0000000002C60000-0x0000000002C9B000-memory.dmp

Filesize
236KB

Download
memory/3736-1013-0x0000000000820000-0x0000000000848000-memory.dmp

Filesize
160KB

Download
memory/3736-1014-0x0000000007590000-0x00000000075A0000-memory.dmp

Filesize
64KB

Download
memory/4620-190-0x0000000007290000-0x00000000072A0000-memory.dmp

Filesize
64KB

Download
memory/4620-172-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-178-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-191-0x0000000007290000-0x00000000072A0000-memory.dmp

Filesize
64KB

Download
memory/4620-184-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-188-0x0000000000400000-0x0000000002BA0000-memory.dmp

Filesize
39.6MB

Download
memory/4620-187-0x0000000007290000-0x00000000072A0000-memory.dmp

Filesize
64KB

Download
memory/4620-186-0x0000000007290000-0x00000000072A0000-memory.dmp

Filesize
64KB

Download
memory/4620-185-0x0000000007290000-0x00000000072A0000-memory.dmp

Filesize
64KB

Download
memory/4620-176-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-174-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-193-0x0000000000400000-0x0000000002BA0000-memory.dmp

Filesize
39.6MB

Download
memory/4620-182-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-192-0x0000000007290000-0x00000000072A0000-memory.dmp

Filesize
64KB

Download
memory/4620-170-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-180-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-168-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-166-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-164-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-160-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-162-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-158-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-157-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/4620-156-0x00000000072A0000-0x0000000007844000-memory.dmp

Filesize
5.6MB

Download
memory/4620-155-0x0000000002D00000-0x0000000002D2D000-memory.dmp

Filesize
180KB

Download