amadey | a6a3216a9c020548c53f786ebd90be128225f164804e4b9773e2e00dab7d35d3

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2023 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe
Size

758KB
MD5

13499eab406c0a48dcf39dda4aa38e19
SHA1

7bde52bbb83557923b367462cab76b484949c4fc
SHA256

74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958
SHA512

3fd55ffbce197423d3bd8e3f7e35ef31365a542404349a424626afcca1347176897a5def788fe912a3ec0aa35a069af5db8ce952cd414002a90e5e4d589ad4e0
SSDEEP

12288:kMrKy90Hsvj1Z520YjN4f0ggFgcZH2i1IlnBTKIyYjLXX/tLMpviwEFmTi33X6RR:OyTb1ZM0YjN4fAiU7IGIyWLXVAnEFmTV

Score

10^/10

amadey redline crazy dast discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dast

83.97.73.129:19068

Attributes

auth_value
17d71bf1a3f93284f5848e00b0dd8222

Extracted

Family

amadey

Version

3.83

77.91.68.30/music/rock/index.php

Extracted

Family

redline

Botnet

crazy

83.97.73.129:19068

Attributes

auth_value
66bc4d9682ea090eef64a299ece12fdd

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

k5279461.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5279461.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5279461.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5279461.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5279461.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

m6760067.exelamod.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	m6760067.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	lamod.exe

Executes dropped EXE 11 IoCs

Processes:

y8598814.exey4405986.exey4497591.exej0555529.exek5279461.exel5150740.exem6760067.exelamod.exen0520773.exelamod.exelamod.exe

pid	process
4568	y8598814.exe
5060	y4405986.exe
3988	y4497591.exe
4228	j0555529.exe
2776	k5279461.exe
4176	l5150740.exe
4200	m6760067.exe
2268	lamod.exe
2904	n0520773.exe
1952	lamod.exe
4888	lamod.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4564 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

k5279461.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k5279461.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4564	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5279461.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

y4405986.exey4497591.exe74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exey8598814.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4405986.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4497591.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y4497591.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8598814.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8598814.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4405986.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

j0555529.exen0520773.exe

description	pid	process	target process
PID 4228 set thread context of 2104	4228	j0555529.exe	AppLaunch.exe
PID 2904 set thread context of 4388	2904	n0520773.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4908 4228 WerFault.exe j0555529.exe
1740 2904 WerFault.exe n0520773.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1136 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

AppLaunch.exek5279461.exel5150740.exeAppLaunch.exe

pid process

2104 AppLaunch.exe
2104 AppLaunch.exe
2776 k5279461.exe
2776 k5279461.exe
4176 l5150740.exe
4176 l5150740.exe
4388 AppLaunch.exe
4388 AppLaunch.exe

pid	pid_target	process	target process
4908	4228	WerFault.exe	j0555529.exe
1740	2904	WerFault.exe	n0520773.exe

pid	process
1136	schtasks.exe

pid	process
2104	AppLaunch.exe
2104	AppLaunch.exe
2776	k5279461.exe
2776	k5279461.exe
4176	l5150740.exe
4176	l5150740.exe
4388	AppLaunch.exe
4388	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AppLaunch.exek5279461.exel5150740.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2104	AppLaunch.exe
Token: SeDebugPrivilege	2776	k5279461.exe
Token: SeDebugPrivilege	4176	l5150740.exe
Token: SeDebugPrivilege	4388	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

m6760067.exe

pid process

4200 m6760067.exe

pid	process
4200	m6760067.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exey8598814.exey4405986.exey4497591.exej0555529.exem6760067.exelamod.exen0520773.execmd.exe

description	pid	process	target process
PID 2736 wrote to memory of 4568	2736	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe	y8598814.exe
PID 2736 wrote to memory of 4568	2736	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe	y8598814.exe
PID 2736 wrote to memory of 4568	2736	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe	y8598814.exe
PID 4568 wrote to memory of 5060	4568	y8598814.exe	y4405986.exe
PID 4568 wrote to memory of 5060	4568	y8598814.exe	y4405986.exe
PID 4568 wrote to memory of 5060	4568	y8598814.exe	y4405986.exe
PID 5060 wrote to memory of 3988	5060	y4405986.exe	y4497591.exe
PID 5060 wrote to memory of 3988	5060	y4405986.exe	y4497591.exe
PID 5060 wrote to memory of 3988	5060	y4405986.exe	y4497591.exe
PID 3988 wrote to memory of 4228	3988	y4497591.exe	j0555529.exe
PID 3988 wrote to memory of 4228	3988	y4497591.exe	j0555529.exe
PID 3988 wrote to memory of 4228	3988	y4497591.exe	j0555529.exe
PID 4228 wrote to memory of 2104	4228	j0555529.exe	AppLaunch.exe
PID 4228 wrote to memory of 2104	4228	j0555529.exe	AppLaunch.exe
PID 4228 wrote to memory of 2104	4228	j0555529.exe	AppLaunch.exe
PID 4228 wrote to memory of 2104	4228	j0555529.exe	AppLaunch.exe
PID 4228 wrote to memory of 2104	4228	j0555529.exe	AppLaunch.exe
PID 3988 wrote to memory of 2776	3988	y4497591.exe	k5279461.exe
PID 3988 wrote to memory of 2776	3988	y4497591.exe	k5279461.exe
PID 5060 wrote to memory of 4176	5060	y4405986.exe	l5150740.exe
PID 5060 wrote to memory of 4176	5060	y4405986.exe	l5150740.exe
PID 5060 wrote to memory of 4176	5060	y4405986.exe	l5150740.exe
PID 4568 wrote to memory of 4200	4568	y8598814.exe	m6760067.exe
PID 4568 wrote to memory of 4200	4568	y8598814.exe	m6760067.exe
PID 4568 wrote to memory of 4200	4568	y8598814.exe	m6760067.exe
PID 4200 wrote to memory of 2268	4200	m6760067.exe	lamod.exe
PID 4200 wrote to memory of 2268	4200	m6760067.exe	lamod.exe
PID 4200 wrote to memory of 2268	4200	m6760067.exe	lamod.exe
PID 2736 wrote to memory of 2904	2736	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe	n0520773.exe
PID 2736 wrote to memory of 2904	2736	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe	n0520773.exe
PID 2736 wrote to memory of 2904	2736	74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe	n0520773.exe
PID 2268 wrote to memory of 1136	2268	lamod.exe	schtasks.exe
PID 2268 wrote to memory of 1136	2268	lamod.exe	schtasks.exe
PID 2268 wrote to memory of 1136	2268	lamod.exe	schtasks.exe
PID 2904 wrote to memory of 4388	2904	n0520773.exe	AppLaunch.exe
PID 2904 wrote to memory of 4388	2904	n0520773.exe	AppLaunch.exe
PID 2904 wrote to memory of 4388	2904	n0520773.exe	AppLaunch.exe
PID 2904 wrote to memory of 4388	2904	n0520773.exe	AppLaunch.exe
PID 2268 wrote to memory of 2360	2268	lamod.exe	cmd.exe
PID 2268 wrote to memory of 2360	2268	lamod.exe	cmd.exe
PID 2268 wrote to memory of 2360	2268	lamod.exe	cmd.exe
PID 2904 wrote to memory of 4388	2904	n0520773.exe	AppLaunch.exe
PID 2360 wrote to memory of 2356	2360	cmd.exe	cmd.exe
PID 2360 wrote to memory of 2356	2360	cmd.exe	cmd.exe
PID 2360 wrote to memory of 2356	2360	cmd.exe	cmd.exe
PID 2360 wrote to memory of 4640	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 4640	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 4640	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 4832	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 4832	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 4832	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 2572	2360	cmd.exe	cmd.exe
PID 2360 wrote to memory of 2572	2360	cmd.exe	cmd.exe
PID 2360 wrote to memory of 2572	2360	cmd.exe	cmd.exe
PID 2360 wrote to memory of 3136	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 3136	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 3136	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 2576	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 2576	2360	cmd.exe	cacls.exe
PID 2360 wrote to memory of 2576	2360	cmd.exe	cacls.exe
PID 2268 wrote to memory of 4564	2268	lamod.exe	rundll32.exe
PID 2268 wrote to memory of 4564	2268	lamod.exe	rundll32.exe
PID 2268 wrote to memory of 4564	2268	lamod.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe
"C:\Users\Admin\AppData\Local\Temp\74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2736

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3988

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 148
6⤵
- Program crash
PID:4908

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4200

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2356

C:\Windows\SysWOW64\cacls.exe
CACLS "lamod.exe" /P "Admin:N"
6⤵
PID:4640

C:\Windows\SysWOW64\cacls.exe
CACLS "lamod.exe" /P "Admin:R" /E
6⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2572

C:\Windows\SysWOW64\cacls.exe
CACLS "..\a9e2a16078" /P "Admin:N"
6⤵
PID:3136

C:\Windows\SysWOW64\cacls.exe
CACLS "..\a9e2a16078" /P "Admin:R" /E
6⤵
PID:2576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
5⤵
- Creates scheduled task(s)
PID:1136

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:4564

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 580
3⤵
- Program crash
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4228 -ip 4228
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2904 -ip 2904
1⤵
PID:4248

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
1⤵
- Executes dropped EXE
PID:4888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
Filesize
304KB

MD5
4fa7efe052ee68e73b1f764a7990e34d

SHA1
67399c257ad5a88f2e8627b45e9dee8c8d8a440e

SHA256
e0288b2ad0c076e12e1d1dca4dc88c140091e92e9e2cbe283253c25beabde500

SHA512
e8da2ed69c7c61dfbc27f5e575d25788f203c9e90f6b31bbd093ffd24a0ca7270e55524e196291ed2e812d587b1624ed87f757616d8971d2c42a466eee4deebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0520773.exe
Filesize
304KB

MD5
4fa7efe052ee68e73b1f764a7990e34d

SHA1
67399c257ad5a88f2e8627b45e9dee8c8d8a440e

SHA256
e0288b2ad0c076e12e1d1dca4dc88c140091e92e9e2cbe283253c25beabde500

SHA512
e8da2ed69c7c61dfbc27f5e575d25788f203c9e90f6b31bbd093ffd24a0ca7270e55524e196291ed2e812d587b1624ed87f757616d8971d2c42a466eee4deebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
Filesize
542KB

MD5
aa19b04f6fba786acfa6da472210f5fc

SHA1
a0aad2323563071eb7ab20ba384035d52f1a3d45

SHA256
6140d5ff3e1521752e5086a305a5ee000f031b8700628a92096172f4b13f9237

SHA512
cfe271798196a0a9e913b986a4d797c377b404def2aa495034fd14507b8656ba9c1a26522ed2bf13003f497b9098a723fa24ee7f814bc921f385b0d41679c997

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8598814.exe
Filesize
542KB

MD5
aa19b04f6fba786acfa6da472210f5fc

SHA1
a0aad2323563071eb7ab20ba384035d52f1a3d45

SHA256
6140d5ff3e1521752e5086a305a5ee000f031b8700628a92096172f4b13f9237

SHA512
cfe271798196a0a9e913b986a4d797c377b404def2aa495034fd14507b8656ba9c1a26522ed2bf13003f497b9098a723fa24ee7f814bc921f385b0d41679c997

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6760067.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
Filesize
370KB

MD5
9027b58f90b82de1d530275b22090c2b

SHA1
bfdaa1f90a05155a1c3b15d3e474e264bd415f5e

SHA256
5bb9f651c140abf54b39fc32c5d8ab92f46ba4ad34b33cbcbabfb5d4a097dbe3

SHA512
337255050e83fe1945f0441638ecc2db5b1eabf2f25b162add5afbf201a9d29e758dc739ad89f7c97583e6f092a6f76414501d7ef23bc3726098d7f82126fc47

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4405986.exe
Filesize
370KB

MD5
9027b58f90b82de1d530275b22090c2b

SHA1
bfdaa1f90a05155a1c3b15d3e474e264bd415f5e

SHA256
5bb9f651c140abf54b39fc32c5d8ab92f46ba4ad34b33cbcbabfb5d4a097dbe3

SHA512
337255050e83fe1945f0441638ecc2db5b1eabf2f25b162add5afbf201a9d29e758dc739ad89f7c97583e6f092a6f76414501d7ef23bc3726098d7f82126fc47

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
Filesize
172KB

MD5
64b97edc45075cb8be6d03413d25b42f

SHA1
808545cfe0ef3acf32b928a11f551f33c02c1d9a

SHA256
56fd6a00cd1c1c2ee8f08ffe7e0ddb43f031b800c2d53ea210c2c9b40f039404

SHA512
640a60f40f9408fe14a1c2302ad7ce9ab713bb4d15e63eef85b14f4b38cc47904d72d5d597f8acc3c460d9be83334636b13927f4246c011e45b606b7bf404828

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5150740.exe
Filesize
172KB

MD5
64b97edc45075cb8be6d03413d25b42f

SHA1
808545cfe0ef3acf32b928a11f551f33c02c1d9a

SHA256
56fd6a00cd1c1c2ee8f08ffe7e0ddb43f031b800c2d53ea210c2c9b40f039404

SHA512
640a60f40f9408fe14a1c2302ad7ce9ab713bb4d15e63eef85b14f4b38cc47904d72d5d597f8acc3c460d9be83334636b13927f4246c011e45b606b7bf404828

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
Filesize
214KB

MD5
67ca2d22f1895e2a0b71738e6e033a1a

SHA1
6dfaaa5ddd9fcfec879e3d534d980b136446a50c

SHA256
87193c830332be5208568100c9cf625a03befd7d17579870a5da8689b6540cb5

SHA512
bf41bedd9fcce2f310d12dbdb9d61ba12852d5d703113035eaa50db689d2d4f6a34795f28819b253cf64e34aa912f245e4aeaa73a8846cd77a4e96c0a2d14c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y4497591.exe
Filesize
214KB

MD5
67ca2d22f1895e2a0b71738e6e033a1a

SHA1
6dfaaa5ddd9fcfec879e3d534d980b136446a50c

SHA256
87193c830332be5208568100c9cf625a03befd7d17579870a5da8689b6540cb5

SHA512
bf41bedd9fcce2f310d12dbdb9d61ba12852d5d703113035eaa50db689d2d4f6a34795f28819b253cf64e34aa912f245e4aeaa73a8846cd77a4e96c0a2d14c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
Filesize
143KB

MD5
b872eaba38c7e18cd9dfe5efa7cca55b

SHA1
eb2e38ec60136fb9a469a433f07aaa9845d5ef8b

SHA256
d22817758c571867a536ad79f677dce57d31ccdb6ad59a7e700b77e6eb6351db

SHA512
0f58cab8b2080e77e2264e07d5567180d2fb497e54564c1563cb0560994fc014cc5a07ff986a0153d69927497038956857c6f75ba11479e70bb6bbaaaecd69e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0555529.exe
Filesize
143KB

MD5
b872eaba38c7e18cd9dfe5efa7cca55b

SHA1
eb2e38ec60136fb9a469a433f07aaa9845d5ef8b

SHA256
d22817758c571867a536ad79f677dce57d31ccdb6ad59a7e700b77e6eb6351db

SHA512
0f58cab8b2080e77e2264e07d5567180d2fb497e54564c1563cb0560994fc014cc5a07ff986a0153d69927497038956857c6f75ba11479e70bb6bbaaaecd69e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
Filesize
11KB

MD5
d0d2ffa1c18e1d4d666aec1f4b7e3d4e

SHA1
3f17b695b9c9cccb7ceaf3ce7941365daf75ea4a

SHA256
cadba2fbb1e5c0e634fb09e0500f582fa7f8fa05d764f26de8c3902c01838255

SHA512
0ea98d830311403c5f4951e13a41dbfb354dc88db6db95356d1cb1ba2fce5e430de751acbb38bc821366952b1ae4b2caa32cc529751cb7c3f100cabaaa900da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5279461.exe
Filesize
11KB

MD5
d0d2ffa1c18e1d4d666aec1f4b7e3d4e

SHA1
3f17b695b9c9cccb7ceaf3ce7941365daf75ea4a

SHA256
cadba2fbb1e5c0e634fb09e0500f582fa7f8fa05d764f26de8c3902c01838255

SHA512
0ea98d830311403c5f4951e13a41dbfb354dc88db6db95356d1cb1ba2fce5e430de751acbb38bc821366952b1ae4b2caa32cc529751cb7c3f100cabaaa900da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
Filesize
205KB

MD5
1f7bb558c775ad5a97243e8c22918ca4

SHA1
c34140fa4efd58718488ae548cb82491e0f7e128

SHA256
de523132af9ac7e193660a0d5d1e220efd75974a7945910e7ce298204f428541

SHA512
8e7767d2da7b8aa1de8fb6d22e49b41985d5128749c4d9efbc29e3c4c84dd05dab9da0d550b7d4b0ba1cbafcca341e73e6b7e82d5f4ace1cb91ee84774a57072

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
a5ed103ec4719a27ab3d3c01dac66f01

SHA1
c830d6980d7edea60568a518eccd36c0bc2a4924

SHA256
dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

SHA512
b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2104-162-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2776-170-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

Filesize
40KB

Download
memory/4176-182-0x000000000B0B0000-0x000000000B126000-memory.dmp

Filesize
472KB

Download
memory/4176-183-0x000000000B870000-0x000000000B902000-memory.dmp

Filesize
584KB

Download
memory/4176-187-0x000000000C770000-0x000000000C932000-memory.dmp

Filesize
1.8MB

Download
memory/4176-186-0x000000000BCF0000-0x000000000BD40000-memory.dmp

Filesize
320KB

Download
memory/4176-189-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/4176-184-0x000000000B130000-0x000000000B196000-memory.dmp

Filesize
408KB

Download
memory/4176-188-0x000000000CE70000-0x000000000D39C000-memory.dmp

Filesize
5.2MB

Download
memory/4176-176-0x0000000000D80000-0x0000000000DB0000-memory.dmp

Filesize
192KB

Download
memory/4176-185-0x000000000C1C0000-0x000000000C764000-memory.dmp

Filesize
5.6MB

Download
memory/4176-177-0x000000000B1B0000-0x000000000B7C8000-memory.dmp

Filesize
6.1MB

Download
memory/4176-181-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/4176-180-0x000000000ACA0000-0x000000000ACDC000-memory.dmp

Filesize
240KB

Download
memory/4176-179-0x000000000AC40000-0x000000000AC52000-memory.dmp

Filesize
72KB

Download
memory/4176-178-0x000000000AD00000-0x000000000AE0A000-memory.dmp

Filesize
1.0MB

Download
memory/4388-214-0x0000000004A90000-0x0000000004AA0000-memory.dmp

Filesize
64KB

Download
memory/4388-208-0x00000000005B0000-0x00000000005E0000-memory.dmp

Filesize
192KB

Download