amadey | 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 277KB
Sample230518-eynj2agg3x
SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
MD5 2f3a3162c7aa84c091eb1245ee5b3584
SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline persom infostealer spyware trojan

Malware Config

Extracted

Family

amadey

Version

3.69

88.218.60.230/Gb2dZz/index.php

Extracted

Family

redline

Botnet

PERSOM

176.124.219.192:14487

Attributes

auth_value
0695a610af712a57529526101d7e83b2

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 4 IoCs

pid	Process
2984	oneetx.exe
2408	Firefox.exe
4240	oneetx.exe
4584	oneetx.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 1368	2408	Firefox.exe	171

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 40 IoCs

pid	pid_target	Process	procid_target
4876	3920	WerFault.exe	83
3844	3920	WerFault.exe	83
372	3920	WerFault.exe	83
4536	3920	WerFault.exe	83
3984	3920	WerFault.exe	83
800	3920	WerFault.exe	83
1224	3920	WerFault.exe	83
4780	3920	WerFault.exe	83
872	3920	WerFault.exe	83
5016	3920	WerFault.exe	83
3668	2984	WerFault.exe	105
2400	2984	WerFault.exe	105
936	2984	WerFault.exe	105
2340	2984	WerFault.exe	105
1608	2984	WerFault.exe	105
3412	2984	WerFault.exe	105
3820	2984	WerFault.exe	105
2080	2984	WerFault.exe	105
3428	2984	WerFault.exe	105
224	2984	WerFault.exe	105
1324	2984	WerFault.exe	105
2324	2984	WerFault.exe	105
2816	2984	WerFault.exe	105
3860	2984	WerFault.exe	105
5100	2984	WerFault.exe	105
4596	2984	WerFault.exe	105
4736	2984	WerFault.exe	105
4656	2984	WerFault.exe	105
2980	2984	WerFault.exe	105
1928	2984	WerFault.exe	105
4880	2984	WerFault.exe	105
1720	2984	WerFault.exe	105
4412	2984	WerFault.exe	105
3364	2984	WerFault.exe	105
1988	2984	WerFault.exe	105
3400	2984	WerFault.exe	105
3760	4240	WerFault.exe	177
4820	4584	WerFault.exe	180
1464	2984	WerFault.exe	105
1224	2984	WerFault.exe	105

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	AppLaunch.exe
1368	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3920	file.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2984	3920	file.exe	105
PID 3920 wrote to memory of 2984	3920	file.exe	105
PID 3920 wrote to memory of 2984	3920	file.exe	105
PID 2984 wrote to memory of 376	2984	oneetx.exe	125
PID 2984 wrote to memory of 376	2984	oneetx.exe	125
PID 2984 wrote to memory of 376	2984	oneetx.exe	125
PID 2984 wrote to memory of 2496	2984	oneetx.exe	131
PID 2984 wrote to memory of 2496	2984	oneetx.exe	131
PID 2984 wrote to memory of 2496	2984	oneetx.exe	131
PID 2496 wrote to memory of 4728	2496	cmd.exe	135
PID 2496 wrote to memory of 4728	2496	cmd.exe	135
PID 2496 wrote to memory of 4728	2496	cmd.exe	135
PID 2496 wrote to memory of 4252	2496	cmd.exe	136
PID 2496 wrote to memory of 4252	2496	cmd.exe	136
PID 2496 wrote to memory of 4252	2496	cmd.exe	136
PID 2496 wrote to memory of 3640	2496	cmd.exe	137
PID 2496 wrote to memory of 3640	2496	cmd.exe	137
PID 2496 wrote to memory of 3640	2496	cmd.exe	137
PID 2496 wrote to memory of 1516	2496	cmd.exe	138
PID 2496 wrote to memory of 1516	2496	cmd.exe	138
PID 2496 wrote to memory of 1516	2496	cmd.exe	138
PID 2496 wrote to memory of 1596	2496	cmd.exe	139
PID 2496 wrote to memory of 1596	2496	cmd.exe	139
PID 2496 wrote to memory of 1596	2496	cmd.exe	139
PID 2496 wrote to memory of 4556	2496	cmd.exe	140
PID 2496 wrote to memory of 4556	2496	cmd.exe	140
PID 2496 wrote to memory of 4556	2496	cmd.exe	140
PID 2984 wrote to memory of 2408	2984	oneetx.exe	167
PID 2984 wrote to memory of 2408	2984	oneetx.exe	167
PID 2984 wrote to memory of 2408	2984	oneetx.exe	167
PID 2408 wrote to memory of 1368	2408	Firefox.exe	171
PID 2408 wrote to memory of 1368	2408	Firefox.exe	171
PID 2408 wrote to memory of 1368	2408	Firefox.exe	171
PID 2408 wrote to memory of 1368	2408	Firefox.exe	171
PID 2408 wrote to memory of 1368	2408	Firefox.exe	171

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 560
  2⤵
  - Program crash
  PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 644
  2⤵
  - Program crash
  PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 660
  2⤵
  - Program crash
  PID:372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 836
  2⤵
  - Program crash
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 880
  2⤵
  - Program crash
  PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 880
  2⤵
  - Program crash
  PID:800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1108
  2⤵
  - Program crash
  PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1148
  2⤵
  - Program crash
  PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1100
  2⤵
  - Program crash
  PID:872
- C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 584
    3⤵
    - Program crash
    PID:3668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 708
    3⤵
    - Program crash
    PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 792
    3⤵
    - Program crash
    PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 944
    3⤵
    - Program crash
    PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 964
    3⤵
    - Program crash
    PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1000
    3⤵
    - Program crash
    PID:3412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1020
    3⤵
    - Program crash
    PID:3820
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 888
    3⤵
    - Program crash
    PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 668
    3⤵
    - Program crash
    PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\d96cb54b4a" /P "Admin:N"&&CACLS "..\d96cb54b4a" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4728
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:4252
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:3640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\d96cb54b4a" /P "Admin:N"
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\d96cb54b4a" /P "Admin:R" /E
      4⤵
      PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 656
    3⤵
    - Program crash
    PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1192
    3⤵
    - Program crash
    PID:1324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1192
    3⤵
    - Program crash
    PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1732
    3⤵
    - Program crash
    PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1792
    3⤵
    - Program crash
    PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2016
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2004
    3⤵
    - Program crash
    PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1804
    3⤵
    - Program crash
    PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1796
    3⤵
    - Program crash
    PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1864
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1804
    3⤵
    - Program crash
    PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2016
    3⤵
    - Program crash
    PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2024
    3⤵
    - Program crash
    PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2004
    3⤵
    - Program crash
    PID:4412
- - C:\Users\Admin\AppData\Local\Temp\1000029001\Firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\1000029001\Firefox.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2148
    3⤵
    - Program crash
    PID:3364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1820
    3⤵
    - Program crash
    PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1016
    3⤵
    - Program crash
    PID:3400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2104
    3⤵
    - Program crash
    PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1292
    3⤵
    - Program crash
    PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1264
  2⤵
  - Program crash
  PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3920 -ip 3920
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3920 -ip 3920
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3920 -ip 3920
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3920 -ip 3920
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3920 -ip 3920
1⤵
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3920 -ip 3920
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3920 -ip 3920
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3920 -ip 3920
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3920 -ip 3920
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3920 -ip 3920
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2984 -ip 2984
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2984 -ip 2984
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2984 -ip 2984
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2984 -ip 2984
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2984 -ip 2984
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2984 -ip 2984
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2984 -ip 2984
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2984 -ip 2984
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2984 -ip 2984
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2984 -ip 2984
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2984 -ip 2984
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2984 -ip 2984
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2984 -ip 2984
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2984 -ip 2984
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2984 -ip 2984
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2984 -ip 2984
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2984 -ip 2984
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2984 -ip 2984
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2984 -ip 2984
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2984 -ip 2984
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2984 -ip 2984
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2984 -ip 2984
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2984 -ip 2984
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2984 -ip 2984
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2984 -ip 2984
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2984 -ip 2984
1⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
1⤵
- Executes dropped EXE
PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 312
  2⤵
  - Program crash
  PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4240 -ip 4240
1⤵
PID:4228

C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
1⤵
- Executes dropped EXE
PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 320
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4584 -ip 4584
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2984 -ip 2984
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2984 -ip 2984
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Firefox.exe

Path C:\Users\Admin\AppData\Local\Temp\1000029001\Firefox.exe
Size 330KB
SHA256 bcc8671116930bf6f9819cbd6fcebf1a5612ed32bb417eaff633ed11ad301059
MD5 c0ff2a9d710fc2f524d781dbf2d89e21
SHA1 3dc25a7c8287a7f36b39b6464241de78a83bd4d6
SHA512 742d8ced69a52980ffe533dc7f6c61bdfe96e557b54df0393a4de4670df354212c840217ca8e087d8aac88525d875edff22f55db0846a10ed10af4b7457362cd
SSDEEP 6144:ciSbJLNNhLuEF0uVcT4jKTOybaOPo0jkAf6V5Ap+6:cH1hLuEFZ+T4jI1baOPo0oD5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Firefox.exe

Path C:\Users\Admin\AppData\Local\Temp\1000029001\Firefox.exe
Size 330KB
SHA256 bcc8671116930bf6f9819cbd6fcebf1a5612ed32bb417eaff633ed11ad301059
MD5 c0ff2a9d710fc2f524d781dbf2d89e21
SHA1 3dc25a7c8287a7f36b39b6464241de78a83bd4d6
SHA512 742d8ced69a52980ffe533dc7f6c61bdfe96e557b54df0393a4de4670df354212c840217ca8e087d8aac88525d875edff22f55db0846a10ed10af4b7457362cd
SSDEEP 6144:ciSbJLNNhLuEF0uVcT4jKTOybaOPo0jkAf6V5Ap+6:cH1hLuEFZ+T4jI1baOPo0oD5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Firefox.exe

Path C:\Users\Admin\AppData\Local\Temp\1000029001\Firefox.exe
Size 330KB
SHA256 bcc8671116930bf6f9819cbd6fcebf1a5612ed32bb417eaff633ed11ad301059
MD5 c0ff2a9d710fc2f524d781dbf2d89e21
SHA1 3dc25a7c8287a7f36b39b6464241de78a83bd4d6
SHA512 742d8ced69a52980ffe533dc7f6c61bdfe96e557b54df0393a4de4670df354212c840217ca8e087d8aac88525d875edff22f55db0846a10ed10af4b7457362cd
SSDEEP 6144:ciSbJLNNhLuEF0uVcT4jKTOybaOPo0jkAf6V5Ap+6:cH1hLuEFZ+T4jI1baOPo0oD5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

oneetx.exe

Path C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
Size 277KB
SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
MD5 2f3a3162c7aa84c091eb1245ee5b3584
SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

oneetx.exe

Path C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
Size 277KB
SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
MD5 2f3a3162c7aa84c091eb1245ee5b3584
SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

oneetx.exe

Path C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
Size 277KB
SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
MD5 2f3a3162c7aa84c091eb1245ee5b3584
SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

oneetx.exe

Path C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
Size 277KB
SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
MD5 2f3a3162c7aa84c091eb1245ee5b3584
SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

oneetx.exe

Path C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe
Size 277KB
SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
MD5 2f3a3162c7aa84c091eb1245ee5b3584
SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-187-0x00000000055F0000-0x0000000005602000-memory.dmp

Download

memory/1368-192-0x0000000006A20000-0x0000000006FC4000-memory.dmp

Download

memory/1368-185-0x0000000005B40000-0x0000000006158000-memory.dmp

Download

memory/1368-186-0x00000000056C0000-0x00000000057CA000-memory.dmp

Download

memory/1368-196-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/1368-188-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/1368-189-0x0000000005650000-0x000000000568C000-memory.dmp

Download

memory/1368-195-0x0000000007500000-0x0000000007A2C000-memory.dmp

Download

memory/1368-191-0x00000000059A0000-0x0000000005A06000-memory.dmp

Download

memory/1368-180-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1368-193-0x0000000006550000-0x00000000065E2000-memory.dmp

Download

memory/1368-194-0x00000000067C0000-0x0000000006982000-memory.dmp

Download

memory/2984-190-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/2984-153-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/3920-134-0x0000000000990000-0x00000000009CA000-memory.dmp

Download

memory/3920-148-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/4240-202-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/4584-211-0x0000000000400000-0x00000000006C2000-memory.dmp

Download