Malware Analysis Report

2025-04-03 09:42

Sample ID 230502-mn6xmaaf63
Target c80864ec4f40c15a4589d19a1e6cd3ca
SHA256 1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc
Tags
amadey systembc persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc

Threat Level: Known bad

The file c80864ec4f40c15a4589d19a1e6cd3ca was found to be: Known bad.

Malicious Activity Summary

amadey systembc persistence trojan

Amadey

SystemBC

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-02 10:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-02 10:37

Reported

2023-05-02 10:40

Platform

win7-20230220-en

Max time kernel

135s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe"

Signatures

Amadey

trojan amadey

SystemBC

trojan systembc

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Downloads MZ/PE file

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000020050\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\sc64.dll = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021061\\sc64.dll, rundll" C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
PID 2032 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
PID 2032 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
PID 2032 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
PID 320 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 320 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 320 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 320 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1984 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 1984 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 1984 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 1984 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Windows\SysWOW64\WerFault.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Windows\SysWOW64\WerFault.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Windows\SysWOW64\WerFault.exe
PID 2032 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Windows\SysWOW64\WerFault.exe
PID 1564 wrote to memory of 756 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 756 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 756 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 756 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1984 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 1756 wrote to memory of 1684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1756 wrote to memory of 1684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1756 wrote to memory of 1684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1756 wrote to memory of 1684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1564 wrote to memory of 464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 992 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 992 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 992 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1564 wrote to memory of 992 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe

"C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe"

C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe

"C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe"

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe" /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1536

C:\Windows\system32\taskeng.exe

taskeng.exe {779797E3-DEA3-4FDB-A471-F600AD35E990} S-1-5-21-1283023626-844874658-3193756055-1000:THEQWNRW\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

"C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 nftday.art udp
US 104.21.32.126:443 nftday.art tcp
US 8.8.8.8:53 tadogem.com udp
US 104.21.96.152:80 tadogem.com tcp
US 104.21.32.126:443 nftday.art tcp
FI 65.21.119.52:4277 tcp

Files

memory/2032-54-0x0000000001020000-0x00000000010B4000-memory.dmp

memory/2032-55-0x0000000000360000-0x0000000000361000-memory.dmp

memory/2032-56-0x0000000009160000-0x00000000091A0000-memory.dmp

\Users\Admin\AppData\Local\Temp\vvONiW8u.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

memory/320-66-0x0000000000460000-0x0000000000461000-memory.dmp

\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\283023626844

MD5 a1af582ff46ed757e818165cc9f843e2
SHA1 04bc54c0ffa7a5b6c0d612787f3ea8f38fb9e0c3
SHA256 6e4e2d3774ed4f8a62bde60e847f347dd38c9899a631599b2d6f9e0096dc7a8a
SHA512 53bde686241687f99129994978787e6f2c2a2df50baa68dca1c6609195bf7df6d5131500f90ed83753c776c6ba76be0ee5b250c8f9924db7a957a1fbce178712

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

memory/672-115-0x0000000000FC0000-0x0000000001000000-memory.dmp

memory/2032-117-0x0000000009160000-0x00000000091A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Roaming\d3ed71f752c04f\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

memory/672-153-0x0000000006E70000-0x0000000006EB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-02 10:37

Reported

2023-05-02 10:40

Platform

win10v2004-20230220-en

Max time kernel

137s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe"

Signatures

Amadey

trojan amadey

SystemBC

trojan systembc

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000020050\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sc64.dll = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021061\\sc64.dll, rundll" C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4920 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe
PID 4920 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe
PID 4920 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe
PID 4584 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 4584 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 4584 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 4432 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 4432 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 4432 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 4432 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 4432 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 4432 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 4432 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 4432 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 4432 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 412 wrote to memory of 1924 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 412 wrote to memory of 1924 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe

"C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe"

C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe

"C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4920 -ip 4920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1848

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe" /F

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

"C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 nftday.art udp
US 172.67.151.248:443 nftday.art tcp
US 8.8.8.8:53 248.151.67.172.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 tadogem.com udp
US 104.21.96.152:80 tadogem.com tcp
US 104.21.96.152:80 tadogem.com tcp
US 172.67.151.248:443 nftday.art tcp
US 8.8.8.8:53 152.96.21.104.in-addr.arpa udp
US 8.8.8.8:53 35.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
FI 65.21.119.52:4277 tcp
US 8.8.8.8:53 52.119.21.65.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 20.189.173.2:443 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 2.77.109.52.in-addr.arpa udp
US 13.107.4.50:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 52.152.108.96:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp

Files

memory/4920-133-0x00000000005D0000-0x0000000000664000-memory.dmp

memory/4920-134-0x0000000002990000-0x0000000002991000-memory.dmp

memory/4920-135-0x0000000009590000-0x00000000095A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

memory/1044-181-0x00000000005F0000-0x0000000000630000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\675742406747

MD5 4d3ee63cc5557c4b31ba595597be90b8
SHA1 fd4d6d1d1ce0a6afe5da00a3a0c0eb327acc8663
SHA256 48f5585fda29d215db96681bf5fabc7b31e2278107a2d607b8e6460e8ef8524a
SHA512 ff48e4ed78a5b5ab8de2e0508d0ea9b4294c1407aaaba2cd3fd4e2a2f8e512be976b70fbae6039485f3b5ac4cc2c59c81c99011f36a04f61c6db58becb2a78be

memory/1044-201-0x0000000009900000-0x0000000009EA4000-memory.dmp

memory/1044-202-0x0000000005070000-0x0000000005102000-memory.dmp

memory/1044-203-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/1044-204-0x0000000004890000-0x00000000048A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\d3ed71f752c04f\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57