amadey | 74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958

Analysis

max time kernel
121s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2023 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02557999.exe
Size

758KB
MD5

13499eab406c0a48dcf39dda4aa38e19
SHA1

7bde52bbb83557923b367462cab76b484949c4fc
SHA256

74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958
SHA512

3fd55ffbce197423d3bd8e3f7e35ef31365a542404349a424626afcca1347176897a5def788fe912a3ec0aa35a069af5db8ce952cd414002a90e5e4d589ad4e0
SSDEEP

12288:kMrKy90Hsvj1Z520YjN4f0ggFgcZH2i1IlnBTKIyYjLXX/tLMpviwEFmTi33X6RR:OyTb1ZM0YjN4fAiU7IGIyWLXVAnEFmTV

Score

10^/10

amadey redline crazy dast discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dast

83.97.73.129:19068

Attributes

auth_value
17d71bf1a3f93284f5848e00b0dd8222

Extracted

Family

amadey

Version

3.83

77.91.68.30/music/rock/index.php

Extracted

Family

redline

Botnet

crazy

83.97.73.129:19068

Attributes

auth_value
66bc4d9682ea090eef64a299ece12fdd

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

k5279461.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5279461.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5279461.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

m6760067.exelamod.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	m6760067.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	lamod.exe

Executes dropped EXE 11 IoCs

Processes:

y8598814.exey4405986.exey4497591.exej0555529.exek5279461.exel5150740.exem6760067.exelamod.exen0520773.exelamod.exelamod.exe

pid	process
2012	y8598814.exe
3252	y4405986.exe
2868	y4497591.exe
440	j0555529.exe
212	k5279461.exe
3200	l5150740.exe
2800	m6760067.exe
4856	lamod.exe
3204	n0520773.exe
920	lamod.exe
1380	lamod.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4224 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

k5279461.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k5279461.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4224	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5279461.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

y8598814.exey4405986.exey4497591.exe02557999.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8598814.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4405986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4405986.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4497591.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y4497591.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	02557999.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02557999.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8598814.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

j0555529.exen0520773.exe

description	pid	process	target process
PID 440 set thread context of 3704	440	j0555529.exe	AppLaunch.exe
PID 3204 set thread context of 3280	3204	n0520773.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2468	440	WerFault.exe	j0555529.exe
3296	3204	WerFault.exe	n0520773.exe
1284	3204	WerFault.exe	n0520773.exe
3904	3204	WerFault.exe	n0520773.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

AppLaunch.exek5279461.exel5150740.exeAppLaunch.exe

pid process

3704 AppLaunch.exe
3704 AppLaunch.exe
212 k5279461.exe
212 k5279461.exe
3200 l5150740.exe
3200 l5150740.exe
3280 AppLaunch.exe
3280 AppLaunch.exe

pid	process
4800	schtasks.exe

pid	process
3704	AppLaunch.exe
3704	AppLaunch.exe
212	k5279461.exe
212	k5279461.exe
3200	l5150740.exe
3200	l5150740.exe
3280	AppLaunch.exe
3280	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AppLaunch.exek5279461.exel5150740.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	3704	AppLaunch.exe
Token: SeDebugPrivilege	212	k5279461.exe
Token: SeDebugPrivilege	3200	l5150740.exe
Token: SeDebugPrivilege	3280	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

m6760067.exe

pid process

2800 m6760067.exe

pid	process
2800	m6760067.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

02557999.exey8598814.exey4405986.exey4497591.exej0555529.exem6760067.exen0520773.exelamod.execmd.exe

description	pid	process	target process
PID 1760 wrote to memory of 2012	1760	02557999.exe	y8598814.exe
PID 1760 wrote to memory of 2012	1760	02557999.exe	y8598814.exe
PID 1760 wrote to memory of 2012	1760	02557999.exe	y8598814.exe
PID 2012 wrote to memory of 3252	2012	y8598814.exe	y4405986.exe
PID 2012 wrote to memory of 3252	2012	y8598814.exe	y4405986.exe
PID 2012 wrote to memory of 3252	2012	y8598814.exe	y4405986.exe
PID 3252 wrote to memory of 2868	3252	y4405986.exe	y4497591.exe
PID 3252 wrote to memory of 2868	3252	y4405986.exe	y4497591.exe
PID 3252 wrote to memory of 2868	3252	y4405986.exe	y4497591.exe
PID 2868 wrote to memory of 440	2868	y4497591.exe	j0555529.exe
PID 2868 wrote to memory of 440	2868	y4497591.exe	j0555529.exe
PID 2868 wrote to memory of 440	2868	y4497591.exe	j0555529.exe
PID 440 wrote to memory of 3704	440	j0555529.exe	AppLaunch.exe
PID 440 wrote to memory of 3704	440	j0555529.exe	AppLaunch.exe
PID 440 wrote to memory of 3704	440	j0555529.exe	AppLaunch.exe
PID 440 wrote to memory of 3704	440	j0555529.exe	AppLaunch.exe
PID 440 wrote to memory of 3704	440	j0555529.exe	AppLaunch.exe
PID 2868 wrote to memory of 212	2868	y4497591.exe	k5279461.exe
PID 2868 wrote to memory of 212	2868	y4497591.exe	k5279461.exe
PID 3252 wrote to memory of 3200	3252	y4405986.exe	l5150740.exe
PID 3252 wrote to memory of 3200	3252	y4405986.exe	l5150740.exe
PID 3252 wrote to memory of 3200	3252	y4405986.exe	l5150740.exe
PID 2012 wrote to memory of 2800	2012	y8598814.exe	m6760067.exe
PID 2012 wrote to memory of 2800	2012	y8598814.exe	m6760067.exe
PID 2012 wrote to memory of 2800	2012	y8598814.exe	m6760067.exe
PID 2800 wrote to memory of 4856	2800	m6760067.exe	lamod.exe
PID 2800 wrote to memory of 4856	2800	m6760067.exe	lamod.exe
PID 2800 wrote to memory of 4856	2800	m6760067.exe	lamod.exe
PID 1760 wrote to memory of 3204	1760	02557999.exe	n0520773.exe
PID 1760 wrote to memory of 3204	1760	02557999.exe	n0520773.exe
PID 1760 wrote to memory of 3204	1760	02557999.exe	n0520773.exe
PID 3204 wrote to memory of 3280	3204	n0520773.exe	AppLaunch.exe
PID 3204 wrote to memory of 3280	3204	n0520773.exe	AppLaunch.exe
PID 3204 wrote to memory of 3280	3204	n0520773.exe	AppLaunch.exe
PID 3204 wrote to memory of 3280	3204	n0520773.exe	AppLaunch.exe
PID 4856 wrote to memory of 4800	4856	lamod.exe	schtasks.exe
PID 4856 wrote to memory of 4800	4856	lamod.exe	schtasks.exe
PID 4856 wrote to memory of 4800	4856	lamod.exe	schtasks.exe
PID 3204 wrote to memory of 3280	3204	n0520773.exe	AppLaunch.exe
PID 4856 wrote to memory of 2040	4856	lamod.exe	cmd.exe
PID 4856 wrote to memory of 2040	4856	lamod.exe	cmd.exe
PID 4856 wrote to memory of 2040	4856	lamod.exe	cmd.exe
PID 2040 wrote to memory of 832	2040	cmd.exe	cmd.exe
PID 2040 wrote to memory of 832	2040	cmd.exe	cmd.exe
PID 2040 wrote to memory of 832	2040	cmd.exe	cmd.exe
PID 2040 wrote to memory of 3348	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 3348	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 3348	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 2904	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 2904	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 2904	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 792	2040	cmd.exe	cmd.exe
PID 2040 wrote to memory of 792	2040	cmd.exe	cmd.exe
PID 2040 wrote to memory of 792	2040	cmd.exe	cmd.exe
PID 2040 wrote to memory of 4632	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 4632	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 4632	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 3916	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 3916	2040	cmd.exe	cacls.exe
PID 2040 wrote to memory of 3916	2040	cmd.exe	cacls.exe
PID 4856 wrote to memory of 4224	4856	lamod.exe	rundll32.exe
PID 4856 wrote to memory of 4224	4856	lamod.exe	rundll32.exe
PID 4856 wrote to memory of 4224	4856	lamod.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\02557999.exe
"C:\Users\Admin\AppData\Local\Temp\02557999.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3252

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 572
6⤵
- Program crash
PID:2468

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
5⤵
- Creates scheduled task(s)
PID:4800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:832

C:\Windows\SysWOW64\cacls.exe
CACLS "lamod.exe" /P "Admin:N"
6⤵
PID:3348

C:\Windows\SysWOW64\cacls.exe
CACLS "lamod.exe" /P "Admin:R" /E
6⤵
PID:2904

C:\Windows\SysWOW64\cacls.exe
CACLS "..\a9e2a16078" /P "Admin:N"
6⤵
PID:4632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:792

C:\Windows\SysWOW64\cacls.exe
CACLS "..\a9e2a16078" /P "Admin:R" /E
6⤵
PID:3916

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:4224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 572
3⤵
- Program crash
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 572
3⤵
- Program crash
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 148
3⤵
- Program crash
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 440 -ip 440
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3204 -ip 3204
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3204 -ip 3204
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3204 -ip 3204
1⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:920

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:1380

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
Filesize
304KB

MD5
4fa7efe052ee68e73b1f764a7990e34d

SHA1
67399c257ad5a88f2e8627b45e9dee8c8d8a440e

SHA256
e0288b2ad0c076e12e1d1dca4dc88c140091e92e9e2cbe283253c25beabde500

SHA512
e8da2ed69c7c61dfbc27f5e575d25788f203c9e90f6b31bbd093ffd24a0ca7270e55524e196291ed2e812d587b1624ed87f757616d8971d2c42a466eee4deebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
Filesize
304KB

MD5
4fa7efe052ee68e73b1f764a7990e34d

SHA1
67399c257ad5a88f2e8627b45e9dee8c8d8a440e

SHA256
e0288b2ad0c076e12e1d1dca4dc88c140091e92e9e2cbe283253c25beabde500

SHA512
e8da2ed69c7c61dfbc27f5e575d25788f203c9e90f6b31bbd093ffd24a0ca7270e55524e196291ed2e812d587b1624ed87f757616d8971d2c42a466eee4deebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
Filesize
542KB

MD5
aa19b04f6fba786acfa6da472210f5fc

SHA1
a0aad2323563071eb7ab20ba384035d52f1a3d45

SHA256
6140d5ff3e1521752e5086a305a5ee000f031b8700628a92096172f4b13f9237

SHA512
cfe271798196a0a9e913b986a4d797c377b404def2aa495034fd14507b8656ba9c1a26522ed2bf13003f497b9098a723fa24ee7f814bc921f385b0d41679c997

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
Filesize
542KB

MD5
aa19b04f6fba786acfa6da472210f5fc

SHA1
a0aad2323563071eb7ab20ba384035d52f1a3d45

SHA256
6140d5ff3e1521752e5086a305a5ee000f031b8700628a92096172f4b13f9237

SHA512
cfe271798196a0a9e913b986a4d797c377b404def2aa495034fd14507b8656ba9c1a26522ed2bf13003f497b9098a723fa24ee7f814bc921f385b0d41679c997

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
Filesize
370KB

MD5
9027b58f90b82de1d530275b22090c2b

SHA1
bfdaa1f90a05155a1c3b15d3e474e264bd415f5e

SHA256
5bb9f651c140abf54b39fc32c5d8ab92f46ba4ad34b33cbcbabfb5d4a097dbe3

SHA512
337255050e83fe1945f0441638ecc2db5b1eabf2f25b162add5afbf201a9d29e758dc739ad89f7c97583e6f092a6f76414501d7ef23bc3726098d7f82126fc47

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
Filesize
370KB

MD5
9027b58f90b82de1d530275b22090c2b

SHA1
bfdaa1f90a05155a1c3b15d3e474e264bd415f5e

SHA256
5bb9f651c140abf54b39fc32c5d8ab92f46ba4ad34b33cbcbabfb5d4a097dbe3

SHA512
337255050e83fe1945f0441638ecc2db5b1eabf2f25b162add5afbf201a9d29e758dc739ad89f7c97583e6f092a6f76414501d7ef23bc3726098d7f82126fc47

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
Filesize
172KB

MD5
64b97edc45075cb8be6d03413d25b42f

SHA1
808545cfe0ef3acf32b928a11f551f33c02c1d9a

SHA256
56fd6a00cd1c1c2ee8f08ffe7e0ddb43f031b800c2d53ea210c2c9b40f039404

SHA512
640a60f40f9408fe14a1c2302ad7ce9ab713bb4d15e63eef85b14f4b38cc47904d72d5d597f8acc3c460d9be83334636b13927f4246c011e45b606b7bf404828

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
Filesize
172KB

MD5
64b97edc45075cb8be6d03413d25b42f

SHA1
808545cfe0ef3acf32b928a11f551f33c02c1d9a

SHA256
56fd6a00cd1c1c2ee8f08ffe7e0ddb43f031b800c2d53ea210c2c9b40f039404

SHA512
640a60f40f9408fe14a1c2302ad7ce9ab713bb4d15e63eef85b14f4b38cc47904d72d5d597f8acc3c460d9be83334636b13927f4246c011e45b606b7bf404828

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
Filesize
214KB

MD5
67ca2d22f1895e2a0b71738e6e033a1a

SHA1
6dfaaa5ddd9fcfec879e3d534d980b136446a50c

SHA256
87193c830332be5208568100c9cf625a03befd7d17579870a5da8689b6540cb5

SHA512
bf41bedd9fcce2f310d12dbdb9d61ba12852d5d703113035eaa50db689d2d4f6a34795f28819b253cf64e34aa912f245e4aeaa73a8846cd77a4e96c0a2d14c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
Filesize
214KB

MD5
67ca2d22f1895e2a0b71738e6e033a1a

SHA1
6dfaaa5ddd9fcfec879e3d534d980b136446a50c

SHA256
87193c830332be5208568100c9cf625a03befd7d17579870a5da8689b6540cb5

SHA512
bf41bedd9fcce2f310d12dbdb9d61ba12852d5d703113035eaa50db689d2d4f6a34795f28819b253cf64e34aa912f245e4aeaa73a8846cd77a4e96c0a2d14c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
Filesize
143KB

MD5
b872eaba38c7e18cd9dfe5efa7cca55b

SHA1
eb2e38ec60136fb9a469a433f07aaa9845d5ef8b

SHA256
d22817758c571867a536ad79f677dce57d31ccdb6ad59a7e700b77e6eb6351db

SHA512
0f58cab8b2080e77e2264e07d5567180d2fb497e54564c1563cb0560994fc014cc5a07ff986a0153d69927497038956857c6f75ba11479e70bb6bbaaaecd69e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
Filesize
143KB

MD5
b872eaba38c7e18cd9dfe5efa7cca55b

SHA1
eb2e38ec60136fb9a469a433f07aaa9845d5ef8b

SHA256
d22817758c571867a536ad79f677dce57d31ccdb6ad59a7e700b77e6eb6351db

SHA512
0f58cab8b2080e77e2264e07d5567180d2fb497e54564c1563cb0560994fc014cc5a07ff986a0153d69927497038956857c6f75ba11479e70bb6bbaaaecd69e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
Filesize
11KB

MD5
d0d2ffa1c18e1d4d666aec1f4b7e3d4e

SHA1
3f17b695b9c9cccb7ceaf3ce7941365daf75ea4a

SHA256
cadba2fbb1e5c0e634fb09e0500f582fa7f8fa05d764f26de8c3902c01838255

SHA512
0ea98d830311403c5f4951e13a41dbfb354dc88db6db95356d1cb1ba2fce5e430de751acbb38bc821366952b1ae4b2caa32cc529751cb7c3f100cabaaa900da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
Filesize
11KB

MD5
d0d2ffa1c18e1d4d666aec1f4b7e3d4e

SHA1
3f17b695b9c9cccb7ceaf3ce7941365daf75ea4a

SHA256
cadba2fbb1e5c0e634fb09e0500f582fa7f8fa05d764f26de8c3902c01838255

SHA512
0ea98d830311403c5f4951e13a41dbfb354dc88db6db95356d1cb1ba2fce5e430de751acbb38bc821366952b1ae4b2caa32cc529751cb7c3f100cabaaa900da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/212-170-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/3200-180-0x0000000004E40000-0x0000000004E7C000-memory.dmp

Filesize
240KB

Download
memory/3200-187-0x0000000006970000-0x0000000006B32000-memory.dmp

Filesize
1.8MB

Download
memory/3200-181-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/3200-176-0x0000000000330000-0x0000000000360000-memory.dmp

Filesize
192KB

Download
memory/3200-185-0x0000000005300000-0x0000000005366000-memory.dmp

Filesize
408KB

Download
memory/3200-184-0x00000000063C0000-0x0000000006964000-memory.dmp

Filesize
5.6MB

Download
memory/3200-183-0x0000000005260000-0x00000000052F2000-memory.dmp

Filesize
584KB

Download
memory/3200-182-0x0000000005140000-0x00000000051B6000-memory.dmp

Filesize
472KB

Download
memory/3200-177-0x0000000005400000-0x0000000005A18000-memory.dmp

Filesize
6.1MB

Download
memory/3200-188-0x0000000008590000-0x0000000008ABC000-memory.dmp

Filesize
5.2MB

Download
memory/3200-186-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/3200-178-0x0000000004EF0000-0x0000000004FFA000-memory.dmp

Filesize
1.0MB

Download
memory/3200-189-0x00000000061F0000-0x0000000006240000-memory.dmp

Filesize
320KB

Download
memory/3200-179-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3280-215-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/3280-214-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/3280-208-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3704-162-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download