amadey | 0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2023, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

301KB
MD5

5599f89944adc8ccad21b5ab94d33381
SHA1

8df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA256

0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512

a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
SSDEEP

6144:BWHRhTLdCwcaYsbhO83elSyRG/1dZENASIbNjVveSvdNGf3m:BYBCwssbhOnSy3iBbNpvdk/

Score

10^/10

amadey redline persom infostealer spyware trojan

Malware Config

Extracted

Family

amadey

Version

3.69

88.218.60.230/Gb2dZz/index.php

Extracted

Family

redline

Botnet

PERSOM

176.124.219.192:14487

Attributes

auth_value
0695a610af712a57529526101d7e83b2

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 4 IoCs

pid	Process
756	oneetx.exe
3196	exodus.exe
4700	oneetx.exe
4532	oneetx.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3196 set thread context of 2272	3196	exodus.exe	168

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 38 IoCs

pid	pid_target	Process	procid_target
636	4556	WerFault.exe	82
2204	4556	WerFault.exe	82
3760	4556	WerFault.exe	82
1244	4556	WerFault.exe	82
32	4556	WerFault.exe	82
3700	4556	WerFault.exe	82
5008	4556	WerFault.exe	82
2772	4556	WerFault.exe	82
2688	4556	WerFault.exe	82
4056	4556	WerFault.exe	82
1104	756	WerFault.exe	103
4944	756	WerFault.exe	103
2744	756	WerFault.exe	103
2436	756	WerFault.exe	103
2432	756	WerFault.exe	103
2272	756	WerFault.exe	103
1956	756	WerFault.exe	103
1848	756	WerFault.exe	103
1916	756	WerFault.exe	103
2872	756	WerFault.exe	103
632	756	WerFault.exe	103
3764	756	WerFault.exe	103
540	756	WerFault.exe	103
3668	756	WerFault.exe	103
3728	756	WerFault.exe	103
5108	756	WerFault.exe	103
4672	756	WerFault.exe	103
4776	756	WerFault.exe	103
5092	756	WerFault.exe	103
2832	756	WerFault.exe	103
900	756	WerFault.exe	103
5076	756	WerFault.exe	103
3572	756	WerFault.exe	103
4940	756	WerFault.exe	103
3396	756	WerFault.exe	103
4568	4700	WerFault.exe	174
1244	4532	WerFault.exe	177
4624	756	WerFault.exe	103

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	AppLaunch.exe
2272	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4556	file.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 756	4556	file.exe	103
PID 4556 wrote to memory of 756	4556	file.exe	103
PID 4556 wrote to memory of 756	4556	file.exe	103
PID 756 wrote to memory of 1072	756	oneetx.exe	122
PID 756 wrote to memory of 1072	756	oneetx.exe	122
PID 756 wrote to memory of 1072	756	oneetx.exe	122
PID 756 wrote to memory of 1488	756	oneetx.exe	128
PID 756 wrote to memory of 1488	756	oneetx.exe	128
PID 756 wrote to memory of 1488	756	oneetx.exe	128
PID 1488 wrote to memory of 1656	1488	cmd.exe	132
PID 1488 wrote to memory of 1656	1488	cmd.exe	132
PID 1488 wrote to memory of 1656	1488	cmd.exe	132
PID 1488 wrote to memory of 4104	1488	cmd.exe	133
PID 1488 wrote to memory of 4104	1488	cmd.exe	133
PID 1488 wrote to memory of 4104	1488	cmd.exe	133
PID 1488 wrote to memory of 4668	1488	cmd.exe	134
PID 1488 wrote to memory of 4668	1488	cmd.exe	134
PID 1488 wrote to memory of 4668	1488	cmd.exe	134
PID 1488 wrote to memory of 4376	1488	cmd.exe	135
PID 1488 wrote to memory of 4376	1488	cmd.exe	135
PID 1488 wrote to memory of 4376	1488	cmd.exe	135
PID 1488 wrote to memory of 4284	1488	cmd.exe	136
PID 1488 wrote to memory of 4284	1488	cmd.exe	136
PID 1488 wrote to memory of 4284	1488	cmd.exe	136
PID 1488 wrote to memory of 4200	1488	cmd.exe	137
PID 1488 wrote to memory of 4200	1488	cmd.exe	137
PID 1488 wrote to memory of 4200	1488	cmd.exe	137
PID 756 wrote to memory of 3196	756	oneetx.exe	164
PID 756 wrote to memory of 3196	756	oneetx.exe	164
PID 756 wrote to memory of 3196	756	oneetx.exe	164
PID 3196 wrote to memory of 2272	3196	exodus.exe	168
PID 3196 wrote to memory of 2272	3196	exodus.exe	168
PID 3196 wrote to memory of 2272	3196	exodus.exe	168
PID 3196 wrote to memory of 2272	3196	exodus.exe	168
PID 3196 wrote to memory of 2272	3196	exodus.exe	168

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 560
  2⤵
  - Program crash
  PID:636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 644
  2⤵
  - Program crash
  PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 720
  2⤵
  - Program crash
  PID:3760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 816
  2⤵
  - Program crash
  PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 856
  2⤵
  - Program crash
  PID:32
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 856
  2⤵
  - Program crash
  PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1112
  2⤵
  - Program crash
  PID:5008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1116
  2⤵
  - Program crash
  PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1216
  2⤵
  - Program crash
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 584
    3⤵
    - Program crash
    PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 796
    3⤵
    - Program crash
    PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 844
    3⤵
    - Program crash
    PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 852
    3⤵
    - Program crash
    PID:2436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1004
    3⤵
    - Program crash
    PID:2432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 996
    3⤵
    - Program crash
    PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 980
    3⤵
    - Program crash
    PID:1956
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 916
    3⤵
    - Program crash
    PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1188
    3⤵
    - Program crash
    PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\d96cb54b4a" /P "Admin:N"&&CACLS "..\d96cb54b4a" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:4668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\d96cb54b4a" /P "Admin:N"
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\d96cb54b4a" /P "Admin:R" /E
      4⤵
      PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1148
    3⤵
    - Program crash
    PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 776
    3⤵
    - Program crash
    PID:632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 656
    3⤵
    - Program crash
    PID:3764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1384
    3⤵
    - Program crash
    PID:540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1740
    3⤵
    - Program crash
    PID:3668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1796
    3⤵
    - Program crash
    PID:3728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1752
    3⤵
    - Program crash
    PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1984
    3⤵
    - Program crash
    PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2036
    3⤵
    - Program crash
    PID:4776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1804
    3⤵
    - Program crash
    PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2032
    3⤵
    - Program crash
    PID:2832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2016
    3⤵
    - Program crash
    PID:900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1484
    3⤵
    - Program crash
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\1000029001\exodus.exe
    "C:\Users\Admin\AppData\Local\Temp\1000029001\exodus.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2160
    3⤵
    - Program crash
    PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1880
    3⤵
    - Program crash
    PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 968
    3⤵
    - Program crash
    PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1312
    3⤵
    - Program crash
    PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1328
  2⤵
  - Program crash
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4556 -ip 4556
1⤵
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4556 -ip 4556
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4556 -ip 4556
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4556 -ip 4556
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4556 -ip 4556
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4556 -ip 4556
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4556 -ip 4556
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4556 -ip 4556
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4556 -ip 4556
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4556 -ip 4556
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 756 -ip 756
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 756 -ip 756
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 756 -ip 756
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 756 -ip 756
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 756 -ip 756
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 756 -ip 756
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 756 -ip 756
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 756 -ip 756
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 756 -ip 756
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 756 -ip 756
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 756 -ip 756
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 756 -ip 756
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 756 -ip 756
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 756 -ip 756
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 756 -ip 756
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 756 -ip 756
1⤵
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 756 -ip 756
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 756 -ip 756
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 756 -ip 756
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 756 -ip 756
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 756 -ip 756
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 756 -ip 756
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 756 -ip 756
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 756 -ip 756
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 756 -ip 756
1⤵
PID:4244

C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
1⤵
- Executes dropped EXE
PID:4700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 316
  2⤵
  - Program crash
  PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4700 -ip 4700
1⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
1⤵
- Executes dropped EXE
PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 316
  2⤵
  - Program crash
  PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4532 -ip 4532
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 756 -ip 756
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000029001\exodus.exe

Filesize
320KB

MD5
b9352f9dcaba6a6ebeed5c756dfe5e74

SHA1
cf0fd4f388aac8302606d59f83cd576cdfe94e92

SHA256
e25c3f7621547050d8b33edb42b6efb31f3eecbfdf5ff347ca2396a67fb41b27

SHA512
e595bbd5e37579d561565879de6ac4aadf43c155c770d4506419e575d74d202ccde61bee216b5ffc1996cd4e49e5fd819e21c536de19b79fbaecf44a8c9807ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\exodus.exe

Filesize
320KB

MD5
b9352f9dcaba6a6ebeed5c756dfe5e74

SHA1
cf0fd4f388aac8302606d59f83cd576cdfe94e92

SHA256
e25c3f7621547050d8b33edb42b6efb31f3eecbfdf5ff347ca2396a67fb41b27

SHA512
e595bbd5e37579d561565879de6ac4aadf43c155c770d4506419e575d74d202ccde61bee216b5ffc1996cd4e49e5fd819e21c536de19b79fbaecf44a8c9807ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\exodus.exe

Filesize
320KB

MD5
b9352f9dcaba6a6ebeed5c756dfe5e74

SHA1
cf0fd4f388aac8302606d59f83cd576cdfe94e92

SHA256
e25c3f7621547050d8b33edb42b6efb31f3eecbfdf5ff347ca2396a67fb41b27

SHA512
e595bbd5e37579d561565879de6ac4aadf43c155c770d4506419e575d74d202ccde61bee216b5ffc1996cd4e49e5fd819e21c536de19b79fbaecf44a8c9807ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe

Filesize
301KB

MD5
5599f89944adc8ccad21b5ab94d33381

SHA1
8df8ce98cdf2a8cef21e26b03841818c9d522ded

SHA256
0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e

SHA512
a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171

Download Submit
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe

Filesize
301KB

MD5
5599f89944adc8ccad21b5ab94d33381

SHA1
8df8ce98cdf2a8cef21e26b03841818c9d522ded

SHA256
0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e

SHA512
a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171

Download Submit
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe

Filesize
301KB

MD5
5599f89944adc8ccad21b5ab94d33381

SHA1
8df8ce98cdf2a8cef21e26b03841818c9d522ded

SHA256
0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e

SHA512
a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171

Download Submit
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe

Filesize
301KB

MD5
5599f89944adc8ccad21b5ab94d33381

SHA1
8df8ce98cdf2a8cef21e26b03841818c9d522ded

SHA256
0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e

SHA512
a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171

Download Submit
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe

Filesize
301KB

MD5
5599f89944adc8ccad21b5ab94d33381

SHA1
8df8ce98cdf2a8cef21e26b03841818c9d522ded

SHA256
0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e

SHA512
a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171

Download Submit
memory/756-190-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/756-153-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2272-187-0x0000000005560000-0x0000000005572000-memory.dmp

Filesize
72KB

Download
memory/2272-192-0x0000000006680000-0x0000000006C24000-memory.dmp

Filesize
5.6MB

Download
memory/2272-180-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2272-188-0x00000000055C0000-0x00000000055FC000-memory.dmp

Filesize
240KB

Download
memory/2272-189-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/2272-185-0x0000000005AB0000-0x00000000060C8000-memory.dmp

Filesize
6.1MB

Download
memory/2272-191-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/2272-186-0x0000000005630000-0x000000000573A000-memory.dmp

Filesize
1.0MB

Download
memory/2272-193-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/2272-194-0x0000000007050000-0x0000000007212000-memory.dmp

Filesize
1.8MB

Download
memory/2272-195-0x0000000007750000-0x0000000007C7C000-memory.dmp

Filesize
5.2MB

Download
memory/2272-196-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4532-211-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4556-134-0x0000000000A90000-0x0000000000ACA000-memory.dmp

Filesize
232KB

Download
memory/4556-149-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4700-202-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download