Analysis Overview
SHA256
1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc
Threat Level: Known bad
The file c80864ec4f40c15a4589d19a1e6cd3ca was found to be: Known bad.
Malicious Activity Summary
Amadey
SystemBC
Blocklisted process makes network request
Downloads MZ/PE file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-05-02 10:37
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-05-02 10:37
Reported
2023-05-02 10:40
Platform
win7-20230220-en
Max time kernel
135s
Max time network
153s
Command Line
Signatures
Amadey
SystemBC
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000020050\\rundll32.exe" | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\sc64.dll = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021061\\sc64.dll, rundll" | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe
"C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe"
C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
"C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe"
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe" /F
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1536
C:\Windows\system32\taskeng.exe
taskeng.exe {779797E3-DEA3-4FDB-A471-F600AD35E990} S-1-5-21-1283023626-844874658-3193756055-1000:THEQWNRW\Admin:Interactive:[1]
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
"C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll
C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | nftday.art | udp |
| US | 104.21.32.126:443 | nftday.art | tcp |
| US | 8.8.8.8:53 | tadogem.com | udp |
| US | 104.21.96.152:80 | tadogem.com | tcp |
| US | 104.21.32.126:443 | nftday.art | tcp |
| FI | 65.21.119.52:4277 | tcp |
Files
memory/2032-54-0x0000000001020000-0x00000000010B4000-memory.dmp
memory/2032-55-0x0000000000360000-0x0000000000361000-memory.dmp
memory/2032-56-0x0000000009160000-0x00000000091A0000-memory.dmp
\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\vvONiW8u.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
memory/320-66-0x0000000000460000-0x0000000000461000-memory.dmp
\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\283023626844
| MD5 | a1af582ff46ed757e818165cc9f843e2 |
| SHA1 | 04bc54c0ffa7a5b6c0d612787f3ea8f38fb9e0c3 |
| SHA256 | 6e4e2d3774ed4f8a62bde60e847f347dd38c9899a631599b2d6f9e0096dc7a8a |
| SHA512 | 53bde686241687f99129994978787e6f2c2a2df50baa68dca1c6609195bf7df6d5131500f90ed83753c776c6ba76be0ee5b250c8f9924db7a957a1fbce178712 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
memory/672-115-0x0000000000FC0000-0x0000000001000000-memory.dmp
memory/2032-117-0x0000000009160000-0x00000000091A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
C:\Users\Admin\AppData\Roaming\d3ed71f752c04f\cred64.dll
| MD5 | 1b7c22a214949975556626d7217e9a39 |
| SHA1 | d01c97e2944166ed23e47e4a62ff471ab8fa031f |
| SHA256 | 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87 |
| SHA512 | ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
memory/672-153-0x0000000006E70000-0x0000000006EB0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-05-02 10:37
Reported
2023-05-02 10:40
Platform
win10v2004-20230220-en
Max time kernel
137s
Max time network
146s
Command Line
Signatures
Amadey
SystemBC
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000020050\\rundll32.exe" | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sc64.dll = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021061\\sc64.dll, rundll" | C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe
"C:\Users\Admin\AppData\Local\Temp\c80864ec4f40c15a4589d19a1e6cd3ca.exe"
C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe
"C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4920 -ip 4920
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1848
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe" /F
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
"C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll
C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | nftday.art | udp |
| US | 172.67.151.248:443 | nftday.art | tcp |
| US | 8.8.8.8:53 | 248.151.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tadogem.com | udp |
| US | 104.21.96.152:80 | tadogem.com | tcp |
| US | 104.21.96.152:80 | tadogem.com | tcp |
| US | 172.67.151.248:443 | nftday.art | tcp |
| US | 8.8.8.8:53 | 152.96.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| FI | 65.21.119.52:4277 | tcp | |
| US | 8.8.8.8:53 | 52.119.21.65.in-addr.arpa | udp |
| US | 40.125.122.176:443 | tcp | |
| US | 20.189.173.2:443 | tcp | |
| US | 40.125.122.176:443 | tcp | |
| US | 8.8.8.8:53 | 2.77.109.52.in-addr.arpa | udp |
| US | 13.107.4.50:80 | tcp | |
| NL | 173.223.113.164:443 | tcp | |
| NL | 173.223.113.131:80 | tcp | |
| US | 204.79.197.203:80 | tcp | |
| US | 40.125.122.176:443 | tcp | |
| US | 40.125.122.176:443 | tcp | |
| US | 40.125.122.176:443 | tcp | |
| US | 52.152.108.96:443 | tcp | |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
Files
memory/4920-133-0x00000000005D0000-0x0000000000664000-memory.dmp
memory/4920-134-0x0000000002990000-0x0000000002991000-memory.dmp
memory/4920-135-0x0000000009590000-0x00000000095A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\bplhxgM.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
| MD5 | 1d81057710dc737ffee88f7f8b0ef90c |
| SHA1 | 8a13b1fe68d5010e5e9b14719a279c4037d7c446 |
| SHA256 | c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc |
| SHA512 | a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49 |
memory/1044-181-0x00000000005F0000-0x0000000000630000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll
| MD5 | 4c09e8e3a1d837f125ea9f9c0c2c5380 |
| SHA1 | 0221f489cdef441afad424b5954d07b432d0b8e8 |
| SHA256 | 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace |
| SHA512 | d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\675742406747
| MD5 | 4d3ee63cc5557c4b31ba595597be90b8 |
| SHA1 | fd4d6d1d1ce0a6afe5da00a3a0c0eb327acc8663 |
| SHA256 | 48f5585fda29d215db96681bf5fabc7b31e2278107a2d607b8e6460e8ef8524a |
| SHA512 | ff48e4ed78a5b5ab8de2e0508d0ea9b4294c1407aaaba2cd3fd4e2a2f8e512be976b70fbae6039485f3b5ac4cc2c59c81c99011f36a04f61c6db58becb2a78be |
memory/1044-201-0x0000000009900000-0x0000000009EA4000-memory.dmp
memory/1044-202-0x0000000005070000-0x0000000005102000-memory.dmp
memory/1044-203-0x0000000004890000-0x00000000048A0000-memory.dmp
memory/1044-204-0x0000000004890000-0x00000000048A0000-memory.dmp
C:\Users\Admin\AppData\Roaming\d3ed71f752c04f\cred64.dll
| MD5 | 1b7c22a214949975556626d7217e9a39 |
| SHA1 | d01c97e2944166ed23e47e4a62ff471ab8fa031f |
| SHA256 | 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87 |
| SHA512 | ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |
C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
| MD5 | c23d62c9166ae248fe9fe078328182f9 |
| SHA1 | ce684054121205b1cd7befc016644680fd5b29d5 |
| SHA256 | 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e |
| SHA512 | 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57 |