amadey | e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2023, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe
Size

514KB
MD5

023cd9a6dfdb959274cd69437c32e98a
SHA1

3adddbcee9a53c1349bd25c654bded42776a6b5c
SHA256

e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9
SHA512

ef3ff2af00eb562eb389b2673fdf8e2a490427164597f53d8304ad3e3d9d873acdb174756b291ec25eca1b04899fd33c8bb54dea826a76ab28280c3c21cb1c29
SSDEEP

12288:tMrTy90a5eJaB767KFVO6yesdEPNgS+IhBGezYFSBBSxO:ay5YJaBeResmlgsB4FxO

Score

10^/10

amadey healer redline smokeloader nasa backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023244-152.dat	healer
behavioral1/files/0x0007000000023244-153.dat	healer
behavioral1/memory/2484-154-0x0000000000C70000-0x0000000000C7A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0413165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0413165.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0413165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0413165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0413165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0413165.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	b8400432.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	danke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	EFE9.exe

Executes dropped EXE 10 IoCs

pid	Process
3748	v5645719.exe
3928	v7646340.exe
2484	a0413165.exe
3808	b8400432.exe
920	danke.exe
3148	c5071276.exe
4352	d1816915.exe
4712	danke.exe
1852	EFE9.exe
4540	danke.exe

Loads dropped DLL 3 IoCs

pid	Process
4388	rundll32.exe
3820	rundll32.exe
3540	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0413165.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5645719.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5645719.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7646340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7646340.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5071276.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5071276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5071276.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4632	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	EFE9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2484	a0413165.exe
2484	a0413165.exe
3148	c5071276.exe
3148	c5071276.exe
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found
2408	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3148	c5071276.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	a0413165.exe
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found
Token: SeShutdownPrivilege	2408	Process not Found
Token: SeCreatePagefilePrivilege	2408	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3808	b8400432.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3748	2744	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe	85
PID 2744 wrote to memory of 3748	2744	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe	85
PID 2744 wrote to memory of 3748	2744	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe	85
PID 3748 wrote to memory of 3928	3748	v5645719.exe	86
PID 3748 wrote to memory of 3928	3748	v5645719.exe	86
PID 3748 wrote to memory of 3928	3748	v5645719.exe	86
PID 3928 wrote to memory of 2484	3928	v7646340.exe	88
PID 3928 wrote to memory of 2484	3928	v7646340.exe	88
PID 3928 wrote to memory of 3808	3928	v7646340.exe	97
PID 3928 wrote to memory of 3808	3928	v7646340.exe	97
PID 3928 wrote to memory of 3808	3928	v7646340.exe	97
PID 3808 wrote to memory of 920	3808	b8400432.exe	99
PID 3808 wrote to memory of 920	3808	b8400432.exe	99
PID 3808 wrote to memory of 920	3808	b8400432.exe	99
PID 3748 wrote to memory of 3148	3748	v5645719.exe	100
PID 3748 wrote to memory of 3148	3748	v5645719.exe	100
PID 3748 wrote to memory of 3148	3748	v5645719.exe	100
PID 920 wrote to memory of 4632	920	danke.exe	101
PID 920 wrote to memory of 4632	920	danke.exe	101
PID 920 wrote to memory of 4632	920	danke.exe	101
PID 920 wrote to memory of 364	920	danke.exe	103
PID 920 wrote to memory of 364	920	danke.exe	103
PID 920 wrote to memory of 364	920	danke.exe	103
PID 364 wrote to memory of 1344	364	cmd.exe	105
PID 364 wrote to memory of 1344	364	cmd.exe	105
PID 364 wrote to memory of 1344	364	cmd.exe	105
PID 364 wrote to memory of 2020	364	cmd.exe	106
PID 364 wrote to memory of 2020	364	cmd.exe	106
PID 364 wrote to memory of 2020	364	cmd.exe	106
PID 364 wrote to memory of 1692	364	cmd.exe	107
PID 364 wrote to memory of 1692	364	cmd.exe	107
PID 364 wrote to memory of 1692	364	cmd.exe	107
PID 364 wrote to memory of 2004	364	cmd.exe	108
PID 364 wrote to memory of 2004	364	cmd.exe	108
PID 364 wrote to memory of 2004	364	cmd.exe	108
PID 364 wrote to memory of 1648	364	cmd.exe	109
PID 364 wrote to memory of 1648	364	cmd.exe	109
PID 364 wrote to memory of 1648	364	cmd.exe	109
PID 364 wrote to memory of 2252	364	cmd.exe	110
PID 364 wrote to memory of 2252	364	cmd.exe	110
PID 364 wrote to memory of 2252	364	cmd.exe	110
PID 2744 wrote to memory of 4352	2744	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe	111
PID 2744 wrote to memory of 4352	2744	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe	111
PID 2744 wrote to memory of 4352	2744	e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe	111
PID 920 wrote to memory of 4388	920	danke.exe	114
PID 920 wrote to memory of 4388	920	danke.exe	114
PID 920 wrote to memory of 4388	920	danke.exe	114
PID 2408 wrote to memory of 1852	2408	Process not Found	117
PID 2408 wrote to memory of 1852	2408	Process not Found	117
PID 2408 wrote to memory of 1852	2408	Process not Found	117
PID 1852 wrote to memory of 4520	1852	EFE9.exe	118
PID 1852 wrote to memory of 4520	1852	EFE9.exe	118
PID 1852 wrote to memory of 4520	1852	EFE9.exe	118
PID 4520 wrote to memory of 3820	4520	control.exe	120
PID 4520 wrote to memory of 3820	4520	control.exe	120
PID 4520 wrote to memory of 3820	4520	control.exe	120
PID 3820 wrote to memory of 5032	3820	rundll32.exe	123
PID 3820 wrote to memory of 5032	3820	rundll32.exe	123
PID 5032 wrote to memory of 3540	5032	RunDll32.exe	124
PID 5032 wrote to memory of 3540	5032	RunDll32.exe	124
PID 5032 wrote to memory of 3540	5032	RunDll32.exe	124

C:\Users\Admin\AppData\Local\Temp\e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe
"C:\Users\Admin\AppData\Local\Temp\e91ca6f97cce0fceb2f5eb8abfb14d98277e895c8e12d8bb32f923089792a7e9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5645719.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5645719.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7646340.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7646340.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0413165.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0413165.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8400432.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8400432.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4632
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:2252
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:4388
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5071276.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5071276.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3148
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1816915.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1816915.exe
  2⤵
  - Executes dropped EXE
  PID:4352

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Users\Admin\AppData\Local\Temp\EFE9.exe
C:\Users\Admin\AppData\Local\Temp\EFE9.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\Z8VV6K.CPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\Z8VV6K.CPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\Z8VV6K.CPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\Z8VV6K.CPl",
        5⤵
        Loads dropped DLL
        
        PID:3540

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\EFE9.exe

Filesize
1.4MB

MD5
2217a16be459910d70461635c2d520df

SHA1
0d88bf9a28a7bf23e99c0c8ca424adee6df8597d

SHA256
dde52db6ff51c4e6eaa9c66e3fabe4b0223efbd1c882c59e7900cdb70a093218

SHA512
a550c462263549c7f4d14dcbd07e9605781a72484d0a4aeccdc491d4ad5137781f9053814ed47519789d2593d137db35d69e2e61676995ed347df1384eaa764a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EFE9.exe

Filesize
1.4MB

MD5
2217a16be459910d70461635c2d520df

SHA1
0d88bf9a28a7bf23e99c0c8ca424adee6df8597d

SHA256
dde52db6ff51c4e6eaa9c66e3fabe4b0223efbd1c882c59e7900cdb70a093218

SHA512
a550c462263549c7f4d14dcbd07e9605781a72484d0a4aeccdc491d4ad5137781f9053814ed47519789d2593d137db35d69e2e61676995ed347df1384eaa764a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1816915.exe

Filesize
175KB

MD5
3d5222775b040afe231bf40a125a51cc

SHA1
d22a8208c08f65f920aba33aef4136221e0f9b38

SHA256
bb49fd41950d816f1ab60c4d89c1499a95efbcacf28ff8f1e8b0d01d8e810730

SHA512
62a5c88e1c8d9d97b5c1d101fa2a8f4c84f53da20186a15dfa264a9d9252fdd63894a30eea4c958b59b0c73d15dfe027f1f6812e92303652c1d10b5220df067f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1816915.exe

Filesize
175KB

MD5
3d5222775b040afe231bf40a125a51cc

SHA1
d22a8208c08f65f920aba33aef4136221e0f9b38

SHA256
bb49fd41950d816f1ab60c4d89c1499a95efbcacf28ff8f1e8b0d01d8e810730

SHA512
62a5c88e1c8d9d97b5c1d101fa2a8f4c84f53da20186a15dfa264a9d9252fdd63894a30eea4c958b59b0c73d15dfe027f1f6812e92303652c1d10b5220df067f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5645719.exe

Filesize
359KB

MD5
3e6dd9d2afd462a526e32aa15bf1de93

SHA1
d467782dec7026616119a381393e131649e2a845

SHA256
c3c27f37a9c8d2e62d0f9e61b9462914f96140a84744f4e3bc88c6f9e9a07198

SHA512
38088d3775cc52b8815f0a7c7c55b1b85585c637adf7cfd5ce4152a0f78a3ce24766360b1232b9372098cc9ac7a0c330fa15c09aaf84447e9b8350d5fe36d3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5645719.exe

Filesize
359KB

MD5
3e6dd9d2afd462a526e32aa15bf1de93

SHA1
d467782dec7026616119a381393e131649e2a845

SHA256
c3c27f37a9c8d2e62d0f9e61b9462914f96140a84744f4e3bc88c6f9e9a07198

SHA512
38088d3775cc52b8815f0a7c7c55b1b85585c637adf7cfd5ce4152a0f78a3ce24766360b1232b9372098cc9ac7a0c330fa15c09aaf84447e9b8350d5fe36d3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5071276.exe

Filesize
32KB

MD5
9d99393ef4e250e4deabb53c4fd289fe

SHA1
f0a9969135813ebc01e41dddfe6ef076e972a947

SHA256
313a0714c0af14ed9ce7434fba95195c1242c23a1b836b752b0c4a2c60ef6094

SHA512
f028001a4716ae68557ea3f4f786200ff8a0e6dd1271faaa1d615ad83810c618f8a871e460715ef61d63bfe9fb8afb532f67612c03f1adaebae13cd091085adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5071276.exe

Filesize
32KB

MD5
9d99393ef4e250e4deabb53c4fd289fe

SHA1
f0a9969135813ebc01e41dddfe6ef076e972a947

SHA256
313a0714c0af14ed9ce7434fba95195c1242c23a1b836b752b0c4a2c60ef6094

SHA512
f028001a4716ae68557ea3f4f786200ff8a0e6dd1271faaa1d615ad83810c618f8a871e460715ef61d63bfe9fb8afb532f67612c03f1adaebae13cd091085adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7646340.exe

Filesize
234KB

MD5
11b637821fd0a8948acccfa2e3b6a854

SHA1
133ed27d1c20ee220a1292a8510e2d67e53cd40d

SHA256
068df385d41e013d47d87bb0550aed9681b580cbddea9e93ec4e6cf16b329979

SHA512
dad17e206c468ee62e6333e051a85d84ca0640ac7a218aa5676b1dd1a35ce9c9dcaadaf390896f8ffe1696d5aed5a92749a4b586dcf3ecdf0865f41e63919dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7646340.exe

Filesize
234KB

MD5
11b637821fd0a8948acccfa2e3b6a854

SHA1
133ed27d1c20ee220a1292a8510e2d67e53cd40d

SHA256
068df385d41e013d47d87bb0550aed9681b580cbddea9e93ec4e6cf16b329979

SHA512
dad17e206c468ee62e6333e051a85d84ca0640ac7a218aa5676b1dd1a35ce9c9dcaadaf390896f8ffe1696d5aed5a92749a4b586dcf3ecdf0865f41e63919dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0413165.exe

Filesize
15KB

MD5
15b78af0dfd3bfb44a0b2b0ad333782c

SHA1
a628694736c31071fc1fb58ae39a97a834c3ed31

SHA256
f8545e82baab5a4c4d157be1cda106169ba58edc4d6326b3beee78ecf1809579

SHA512
899bd43daa85f6fe53c5c55429a112ae9ea81327acee626dd3fb3b0b8b208fc87a6b6b633cdb0bdf7bef20b3bfdf8ea5a6914bd3e95c0cd91aaae93ef1857241

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0413165.exe

Filesize
15KB

MD5
15b78af0dfd3bfb44a0b2b0ad333782c

SHA1
a628694736c31071fc1fb58ae39a97a834c3ed31

SHA256
f8545e82baab5a4c4d157be1cda106169ba58edc4d6326b3beee78ecf1809579

SHA512
899bd43daa85f6fe53c5c55429a112ae9ea81327acee626dd3fb3b0b8b208fc87a6b6b633cdb0bdf7bef20b3bfdf8ea5a6914bd3e95c0cd91aaae93ef1857241

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8400432.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8400432.exe

Filesize
228KB

MD5
6bc0d7d2ff312431f8a890cae9c63a25

SHA1
81ee941c20e185e0f14232a49364f09ff67c992a

SHA256
bd82e2190c57d6630aad29146d26f2f05517f1a5e55253d39bb49b2cd65b2817

SHA512
c1102cea00c2207d52b583efa081714e5899ad39cb831060428a40a3ad1bcc53315775624ad80b9a38073aae95d60fe4e35018cccb393f0580a112a3c9003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z8VV6K.CPl

Filesize
1.2MB

MD5
968d5855db5a025c1778719142817515

SHA1
dbd57729573c363a725560744a2a3e0b09b762c0

SHA256
06490a70732e1cf97ece839ca2f20a455558e6abde976e8ed26bd9798fab70a9

SHA512
065a1159638fa5239e9ff5ae305e62e8542ecec733d47778791e26143ce3f7e74a49eb429bd3d5fd4c9787c2eef606ecbff1ee99ff3bb03dac2bd3fc5615f215

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z8VV6k.cpl

Filesize
1.2MB

MD5
968d5855db5a025c1778719142817515

SHA1
dbd57729573c363a725560744a2a3e0b09b762c0

SHA256
06490a70732e1cf97ece839ca2f20a455558e6abde976e8ed26bd9798fab70a9

SHA512
065a1159638fa5239e9ff5ae305e62e8542ecec733d47778791e26143ce3f7e74a49eb429bd3d5fd4c9787c2eef606ecbff1ee99ff3bb03dac2bd3fc5615f215

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z8VV6k.cpl

Filesize
1.2MB

MD5
968d5855db5a025c1778719142817515

SHA1
dbd57729573c363a725560744a2a3e0b09b762c0

SHA256
06490a70732e1cf97ece839ca2f20a455558e6abde976e8ed26bd9798fab70a9

SHA512
065a1159638fa5239e9ff5ae305e62e8542ecec733d47778791e26143ce3f7e74a49eb429bd3d5fd4c9787c2eef606ecbff1ee99ff3bb03dac2bd3fc5615f215

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z8VV6k.cpl

Filesize
1.2MB

MD5
968d5855db5a025c1778719142817515

SHA1
dbd57729573c363a725560744a2a3e0b09b762c0

SHA256
06490a70732e1cf97ece839ca2f20a455558e6abde976e8ed26bd9798fab70a9

SHA512
065a1159638fa5239e9ff5ae305e62e8542ecec733d47778791e26143ce3f7e74a49eb429bd3d5fd4c9787c2eef606ecbff1ee99ff3bb03dac2bd3fc5615f215

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
272B

MD5
d867eabb1be5b45bc77bb06814e23640

SHA1
3139a51ce7e8462c31070363b9532c13cc52c82d

SHA256
38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349

SHA512
afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59

Download Submit
memory/2408-175-0x0000000000C30000-0x0000000000C46000-memory.dmp

Filesize
88KB

Download
memory/2484-155-0x00007FF9032E0000-0x00007FF903DA1000-memory.dmp

Filesize
10.8MB

Download
memory/2484-157-0x00007FF9032E0000-0x00007FF903DA1000-memory.dmp

Filesize
10.8MB

Download
memory/2484-154-0x0000000000C70000-0x0000000000C7A000-memory.dmp

Filesize
40KB

Download
memory/3148-176-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3148-174-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3540-236-0x0000000002D10000-0x0000000002D16000-memory.dmp

Filesize
24KB

Download
memory/3540-239-0x0000000003500000-0x00000000035F8000-memory.dmp

Filesize
992KB

Download
memory/3540-240-0x0000000003600000-0x00000000036DF000-memory.dmp

Filesize
892KB

Download
memory/3540-243-0x0000000003600000-0x00000000036DF000-memory.dmp

Filesize
892KB

Download
memory/3540-244-0x0000000003600000-0x00000000036DF000-memory.dmp

Filesize
892KB

Download
memory/3820-230-0x0000000002F10000-0x0000000002FEF000-memory.dmp

Filesize
892KB

Download
memory/3820-234-0x0000000002F10000-0x0000000002FEF000-memory.dmp

Filesize
892KB

Download
memory/3820-227-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/3820-226-0x0000000002760000-0x0000000002766000-memory.dmp

Filesize
24KB

Download
memory/3820-229-0x0000000002E10000-0x0000000002F08000-memory.dmp

Filesize
992KB

Download
memory/3820-233-0x0000000002F10000-0x0000000002FEF000-memory.dmp

Filesize
892KB

Download
memory/4352-183-0x0000000073270000-0x0000000073A20000-memory.dmp

Filesize
7.7MB

Download
memory/4352-182-0x0000000000AD0000-0x0000000000B00000-memory.dmp

Filesize
192KB

Download
memory/4352-190-0x0000000005320000-0x0000000005330000-memory.dmp

Filesize
64KB

Download
memory/4352-189-0x0000000073270000-0x0000000073A20000-memory.dmp

Filesize
7.7MB

Download
memory/4352-188-0x0000000005600000-0x000000000563C000-memory.dmp

Filesize
240KB

Download
memory/4352-187-0x0000000005320000-0x0000000005330000-memory.dmp

Filesize
64KB

Download
memory/4352-186-0x00000000055A0000-0x00000000055B2000-memory.dmp

Filesize
72KB

Download
memory/4352-185-0x0000000005680000-0x000000000578A000-memory.dmp

Filesize
1.0MB

Download
memory/4352-184-0x0000000005B50000-0x0000000006168000-memory.dmp

Filesize
6.1MB

Download