amadey | c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2023, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe
Size

514KB
MD5

6903951ee8ad543d8cc9a6883b14b7d0
SHA1

ea4f3970789e5d91d9dc58282184b4c63eb75cc7
SHA256

c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a
SHA512

c4fffd76725def4df3be0dfaf03975c4d9100c0b3a614b4b8ca629735577662282c170d3268bff3c30d18010bac29b7a9f2f2383d28ba96effa9d1c96ffeba68
SSDEEP

12288:YMrqy90bLC/dsHJIywBAHPZrWiZdikA8yfNkXObi:iykAaILOHB6qdLFaPi

Score

10^/10

amadey healer redline smokeloader grom backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grom

77.91.68.68:19071

Attributes

auth_value
9ec3129bff410b89097d656d7abc33dc

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000800000002322a-152.dat	healer
behavioral1/files/0x000800000002322a-153.dat	healer
behavioral1/memory/2076-154-0x0000000000510000-0x000000000051A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1361583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1361583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1361583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1361583.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1361583.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1361583.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	b2903781.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	danke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	19E7.exe

Executes dropped EXE 10 IoCs

pid	Process
3440	v6922727.exe
1780	v6289902.exe
2076	a1361583.exe
4788	b2903781.exe
2868	danke.exe
3112	c5522704.exe
1804	d4492169.exe
2484	danke.exe
372	19E7.exe
2124	danke.exe

Loads dropped DLL 3 IoCs

pid	Process
1444	rundll32.exe
4768	rundll32.exe
4632	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1361583.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6922727.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6922727.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6289902.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6289902.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1592	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5522704.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5522704.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c5522704.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
392	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	19E7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2076	a1361583.exe
2076	a1361583.exe
3112	c5522704.exe
3112	c5522704.exe
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3112	c5522704.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	a1361583.exe
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4788	b2903781.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3440	4820	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe	86
PID 4820 wrote to memory of 3440	4820	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe	86
PID 4820 wrote to memory of 3440	4820	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe	86
PID 3440 wrote to memory of 1780	3440	v6922727.exe	87
PID 3440 wrote to memory of 1780	3440	v6922727.exe	87
PID 3440 wrote to memory of 1780	3440	v6922727.exe	87
PID 1780 wrote to memory of 2076	1780	v6289902.exe	88
PID 1780 wrote to memory of 2076	1780	v6289902.exe	88
PID 1780 wrote to memory of 4788	1780	v6289902.exe	93
PID 1780 wrote to memory of 4788	1780	v6289902.exe	93
PID 1780 wrote to memory of 4788	1780	v6289902.exe	93
PID 4788 wrote to memory of 2868	4788	b2903781.exe	94
PID 4788 wrote to memory of 2868	4788	b2903781.exe	94
PID 4788 wrote to memory of 2868	4788	b2903781.exe	94
PID 3440 wrote to memory of 3112	3440	v6922727.exe	95
PID 3440 wrote to memory of 3112	3440	v6922727.exe	95
PID 3440 wrote to memory of 3112	3440	v6922727.exe	95
PID 2868 wrote to memory of 392	2868	danke.exe	96
PID 2868 wrote to memory of 392	2868	danke.exe	96
PID 2868 wrote to memory of 392	2868	danke.exe	96
PID 2868 wrote to memory of 348	2868	danke.exe	98
PID 2868 wrote to memory of 348	2868	danke.exe	98
PID 2868 wrote to memory of 348	2868	danke.exe	98
PID 348 wrote to memory of 1900	348	cmd.exe	100
PID 348 wrote to memory of 1900	348	cmd.exe	100
PID 348 wrote to memory of 1900	348	cmd.exe	100
PID 348 wrote to memory of 4904	348	cmd.exe	101
PID 348 wrote to memory of 4904	348	cmd.exe	101
PID 348 wrote to memory of 4904	348	cmd.exe	101
PID 348 wrote to memory of 2060	348	cmd.exe	102
PID 348 wrote to memory of 2060	348	cmd.exe	102
PID 348 wrote to memory of 2060	348	cmd.exe	102
PID 348 wrote to memory of 2912	348	cmd.exe	103
PID 348 wrote to memory of 2912	348	cmd.exe	103
PID 348 wrote to memory of 2912	348	cmd.exe	103
PID 348 wrote to memory of 3104	348	cmd.exe	104
PID 348 wrote to memory of 3104	348	cmd.exe	104
PID 348 wrote to memory of 3104	348	cmd.exe	104
PID 348 wrote to memory of 3852	348	cmd.exe	105
PID 348 wrote to memory of 3852	348	cmd.exe	105
PID 348 wrote to memory of 3852	348	cmd.exe	105
PID 4820 wrote to memory of 1804	4820	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe	106
PID 4820 wrote to memory of 1804	4820	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe	106
PID 4820 wrote to memory of 1804	4820	c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe	106
PID 2868 wrote to memory of 1444	2868	danke.exe	114
PID 2868 wrote to memory of 1444	2868	danke.exe	114
PID 2868 wrote to memory of 1444	2868	danke.exe	114
PID 3092 wrote to memory of 372	3092	Process not Found	116
PID 3092 wrote to memory of 372	3092	Process not Found	116
PID 3092 wrote to memory of 372	3092	Process not Found	116
PID 372 wrote to memory of 4684	372	19E7.exe	117
PID 372 wrote to memory of 4684	372	19E7.exe	117
PID 372 wrote to memory of 4684	372	19E7.exe	117
PID 4684 wrote to memory of 4768	4684	control.exe	120
PID 4684 wrote to memory of 4768	4684	control.exe	120
PID 4684 wrote to memory of 4768	4684	control.exe	120
PID 4768 wrote to memory of 3164	4768	rundll32.exe	123
PID 4768 wrote to memory of 3164	4768	rundll32.exe	123
PID 3164 wrote to memory of 4632	3164	RunDll32.exe	124
PID 3164 wrote to memory of 4632	3164	RunDll32.exe	124
PID 3164 wrote to memory of 4632	3164	RunDll32.exe	124

C:\Users\Admin\AppData\Local\Temp\c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe
"C:\Users\Admin\AppData\Local\Temp\c4d22c695252a5c30a3138a4cbfb38e992516fbf2028a78ecab82a69e1d29a5a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6922727.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6922727.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6289902.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6289902.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1361583.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1361583.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2903781.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2903781.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:392
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:3852
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:1444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5522704.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5522704.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4492169.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4492169.exe
  2⤵
  - Executes dropped EXE
  PID:1804

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2484

C:\Users\Admin\AppData\Local\Temp\19E7.exe
C:\Users\Admin\AppData\Local\Temp\19E7.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\kARUFP_.cPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\kARUFP_.cPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\kARUFP_.cPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\kARUFP_.cPL",
        5⤵
        Loads dropped DLL
        
        PID:4632

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2124

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19E7.exe

Filesize
1.5MB

MD5
ca8ffc6a4da7b513311880d89e0c5cf6

SHA1
7e1f3edc749c8c65e69b136dc5b00a4d660852df

SHA256
754ad00f26b575e2151dba6b37bac821024525cda02bb0c19ce83ec7411bc0e1

SHA512
b8db12f570be2b026aa8df9057907fab6397601f4820512a28984981a87065d12fcff2fc60951bb7aa2cd10b1816d1706693084411a64762e941b0a6d576dbe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\19E7.exe

Filesize
1.5MB

MD5
ca8ffc6a4da7b513311880d89e0c5cf6

SHA1
7e1f3edc749c8c65e69b136dc5b00a4d660852df

SHA256
754ad00f26b575e2151dba6b37bac821024525cda02bb0c19ce83ec7411bc0e1

SHA512
b8db12f570be2b026aa8df9057907fab6397601f4820512a28984981a87065d12fcff2fc60951bb7aa2cd10b1816d1706693084411a64762e941b0a6d576dbe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4492169.exe

Filesize
172KB

MD5
36ae2c43a21f8fd5042c35ff7da55b57

SHA1
3d6397cdfa9f90ae63d69083827e2d7218f5cdd2

SHA256
fb69a79587467bd8542d90de4262e284efb90fecdf7f1895fa631ab5f33ee4e6

SHA512
f7635be387dccea7775719fa2d85b2cccbd9ac2c31972138de5dad02dfddf55cb39cf9d30a2384f8943d79abb219f8f66c9c8f4503f3c8dc2e68ff9296a15e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4492169.exe

Filesize
172KB

MD5
36ae2c43a21f8fd5042c35ff7da55b57

SHA1
3d6397cdfa9f90ae63d69083827e2d7218f5cdd2

SHA256
fb69a79587467bd8542d90de4262e284efb90fecdf7f1895fa631ab5f33ee4e6

SHA512
f7635be387dccea7775719fa2d85b2cccbd9ac2c31972138de5dad02dfddf55cb39cf9d30a2384f8943d79abb219f8f66c9c8f4503f3c8dc2e68ff9296a15e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6922727.exe

Filesize
359KB

MD5
7d071d055c191d3b40931d52c94765a0

SHA1
2369baf2c4fb7d1643371b79beccfad5a02795b7

SHA256
e4b130757f15df08df89fdaf657d44cd7f81ffb0101d4b4aabc912319fc44726

SHA512
2f3018510c319b65c469abb067ee006db14f7b083f21db4297ceba6d5d6a225216646283a0b6648fe0c8c266eaa71aa3fee2b942f92800f47581ab9f3de75153

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6922727.exe

Filesize
359KB

MD5
7d071d055c191d3b40931d52c94765a0

SHA1
2369baf2c4fb7d1643371b79beccfad5a02795b7

SHA256
e4b130757f15df08df89fdaf657d44cd7f81ffb0101d4b4aabc912319fc44726

SHA512
2f3018510c319b65c469abb067ee006db14f7b083f21db4297ceba6d5d6a225216646283a0b6648fe0c8c266eaa71aa3fee2b942f92800f47581ab9f3de75153

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5522704.exe

Filesize
33KB

MD5
17ac27b7d04bafe122a87cca6babfe81

SHA1
8e34219460033afa279925b6b64e025770f1b350

SHA256
0671a21e2792aa6e43f19fbc1cae5679694ba785b08eb113e5276ae98d07d9db

SHA512
5e84984330bcab3e3288a2d969aa6f1b6d0938bdf91a30d2e1c9935868c061b1681a610e3a681c34f8adf38ef31f75ace66c25bc235886238f35751d18edb2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5522704.exe

Filesize
33KB

MD5
17ac27b7d04bafe122a87cca6babfe81

SHA1
8e34219460033afa279925b6b64e025770f1b350

SHA256
0671a21e2792aa6e43f19fbc1cae5679694ba785b08eb113e5276ae98d07d9db

SHA512
5e84984330bcab3e3288a2d969aa6f1b6d0938bdf91a30d2e1c9935868c061b1681a610e3a681c34f8adf38ef31f75ace66c25bc235886238f35751d18edb2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6289902.exe

Filesize
235KB

MD5
0781decfcf2326d3a2e5c3168f8cb4ad

SHA1
e3304829b342261bebb89219059fc84a72c7938e

SHA256
5673cb86ca75969d41af316cf4617ebe1b913b520efa2ec88a6631bba1d29831

SHA512
6ccda7b7a53c303eac9e68b04dd95a3084ba379206c41cf95d7cfa4a830de06cf8df2570518fc2fb17f5e79a42f5cdcace5b6dae5a40a000fc777d9b84284a19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6289902.exe

Filesize
235KB

MD5
0781decfcf2326d3a2e5c3168f8cb4ad

SHA1
e3304829b342261bebb89219059fc84a72c7938e

SHA256
5673cb86ca75969d41af316cf4617ebe1b913b520efa2ec88a6631bba1d29831

SHA512
6ccda7b7a53c303eac9e68b04dd95a3084ba379206c41cf95d7cfa4a830de06cf8df2570518fc2fb17f5e79a42f5cdcace5b6dae5a40a000fc777d9b84284a19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1361583.exe

Filesize
15KB

MD5
8fb59ef61ac827c2e55f4ef6f3faa9ac

SHA1
57b8e107ba43478a3e1e3e863d74eea8baf4b59c

SHA256
bd98f7c7aed09baf38e7be51bd4a1d6221598e313198228b9428d00965b08542

SHA512
9a300b2c9597eb63c4f6e5b0cd07bb0fa7992b63d3e5717c875af825c44eb01f629d85ae4fae9919061e18d1456c26d1d624a46ab5227d7e4bcfcff0cf26d437

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1361583.exe

Filesize
15KB

MD5
8fb59ef61ac827c2e55f4ef6f3faa9ac

SHA1
57b8e107ba43478a3e1e3e863d74eea8baf4b59c

SHA256
bd98f7c7aed09baf38e7be51bd4a1d6221598e313198228b9428d00965b08542

SHA512
9a300b2c9597eb63c4f6e5b0cd07bb0fa7992b63d3e5717c875af825c44eb01f629d85ae4fae9919061e18d1456c26d1d624a46ab5227d7e4bcfcff0cf26d437

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2903781.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2903781.exe

Filesize
228KB

MD5
d62916bbc96f1b9ee468ad5e1e51925e

SHA1
edf23ccb5456e4148d75411570a85d2af0879c3e

SHA256
771476f2bfcdb5ad3f7fd523fb4db46482e61e6e460d139708c2d9af89e7010d

SHA512
a4b7652b5a89df69c8f31207b644fdc6ce38d14fadab5fba707db100851b89688bcb307ccbb9e422f696d5c955f725c9fca0a59fc7c1b2c7d399ac6b44fc1ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\kARUFP_.cPL

Filesize
1.3MB

MD5
8898afc2e0de0c84396cf490bd009ae7

SHA1
7c8420ca2cc0b05ffb3f391a228a2b7a6a9aaebd

SHA256
e2ec5155a04b6cd7e88e88978ebbf88d4b79c71311a4acd4df665af1079779fe

SHA512
d61a322b10b00e4b2704d9074ae1db6f82a37153480c24cd2d9d0a257e43a81ce1302b74dd90458efe5a2a243f5dfbbff919657b5c0539bf82fdbc6c03cfcf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\kArufP_.cpl

Filesize
1.3MB

MD5
8898afc2e0de0c84396cf490bd009ae7

SHA1
7c8420ca2cc0b05ffb3f391a228a2b7a6a9aaebd

SHA256
e2ec5155a04b6cd7e88e88978ebbf88d4b79c71311a4acd4df665af1079779fe

SHA512
d61a322b10b00e4b2704d9074ae1db6f82a37153480c24cd2d9d0a257e43a81ce1302b74dd90458efe5a2a243f5dfbbff919657b5c0539bf82fdbc6c03cfcf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\kArufP_.cpl

Filesize
1.3MB

MD5
8898afc2e0de0c84396cf490bd009ae7

SHA1
7c8420ca2cc0b05ffb3f391a228a2b7a6a9aaebd

SHA256
e2ec5155a04b6cd7e88e88978ebbf88d4b79c71311a4acd4df665af1079779fe

SHA512
d61a322b10b00e4b2704d9074ae1db6f82a37153480c24cd2d9d0a257e43a81ce1302b74dd90458efe5a2a243f5dfbbff919657b5c0539bf82fdbc6c03cfcf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\kArufP_.cpl

Filesize
1.3MB

MD5
8898afc2e0de0c84396cf490bd009ae7

SHA1
7c8420ca2cc0b05ffb3f391a228a2b7a6a9aaebd

SHA256
e2ec5155a04b6cd7e88e88978ebbf88d4b79c71311a4acd4df665af1079779fe

SHA512
d61a322b10b00e4b2704d9074ae1db6f82a37153480c24cd2d9d0a257e43a81ce1302b74dd90458efe5a2a243f5dfbbff919657b5c0539bf82fdbc6c03cfcf42

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
272B

MD5
d867eabb1be5b45bc77bb06814e23640

SHA1
3139a51ce7e8462c31070363b9532c13cc52c82d

SHA256
38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349

SHA512
afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59

Download Submit
memory/1804-187-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/1804-189-0x00000000727E0000-0x0000000072F90000-memory.dmp

Filesize
7.7MB

Download
memory/1804-190-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/1804-182-0x0000000000BA0000-0x0000000000BD0000-memory.dmp

Filesize
192KB

Download
memory/1804-188-0x000000000AAF0000-0x000000000AB2C000-memory.dmp

Filesize
240KB

Download
memory/1804-186-0x000000000AA90000-0x000000000AAA2000-memory.dmp

Filesize
72KB

Download
memory/1804-183-0x00000000727E0000-0x0000000072F90000-memory.dmp

Filesize
7.7MB

Download
memory/1804-185-0x000000000AB50000-0x000000000AC5A000-memory.dmp

Filesize
1.0MB

Download
memory/1804-184-0x000000000B030000-0x000000000B648000-memory.dmp

Filesize
6.1MB

Download
memory/2076-157-0x00007FFB4EDE0000-0x00007FFB4F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2076-155-0x00007FFB4EDE0000-0x00007FFB4F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2076-154-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/3092-175-0x00000000014B0000-0x00000000014C6000-memory.dmp

Filesize
88KB

Download
memory/3112-176-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3112-173-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4632-244-0x0000000002CF0000-0x0000000002DD6000-memory.dmp

Filesize
920KB

Download
memory/4632-243-0x0000000002CF0000-0x0000000002DD6000-memory.dmp

Filesize
920KB

Download
memory/4632-241-0x0000000002CF0000-0x0000000002DD6000-memory.dmp

Filesize
920KB

Download
memory/4632-239-0x0000000002BF0000-0x0000000002CEF000-memory.dmp

Filesize
1020KB

Download
memory/4632-236-0x0000000002470000-0x0000000002476000-memory.dmp

Filesize
24KB

Download
memory/4768-227-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/4768-234-0x0000000002D80000-0x0000000002E66000-memory.dmp

Filesize
920KB

Download
memory/4768-233-0x0000000002D80000-0x0000000002E66000-memory.dmp

Filesize
920KB

Download
memory/4768-231-0x0000000002D80000-0x0000000002E66000-memory.dmp

Filesize
920KB

Download
memory/4768-230-0x0000000002D80000-0x0000000002E66000-memory.dmp

Filesize
920KB

Download
memory/4768-229-0x0000000002C80000-0x0000000002D7F000-memory.dmp

Filesize
1020KB

Download
memory/4768-226-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download