amadey | b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2023 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe
Size

515KB
MD5

e0fa4b39781d4edea452a146fa6c6c75
SHA1

783c1ce2f282be401630907e8cc649d6e7379c14
SHA256

b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06
SHA512

8e0487d7da0fbd69724c73098d6fa9132ecafb7c7b4f66181dfa969c19b0c82488f4aa6e98bf11d2ad2b09ccf6b0dc5faaddcd541a7197c79ae313bcd6008146
SSDEEP

6144:K8y+bnr+5p0yN90QE3A/syXLFQKvSLw08bPr8petCWZC3I76Em3B2aG7+kI1kjJZ:EMrty90e/zmKvS78Lr8CoITACdth7Bb

Score

10^/10

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.85

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

news

77.91.68.68:19071

Attributes

auth_value
99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000230ac-152.dat	healer
behavioral1/files/0x00070000000230ac-153.dat	healer
behavioral1/memory/4564-154-0x0000000000A90000-0x0000000000A9A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2745253.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2745253.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2745253.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2745253.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2745253.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2745253.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	b5664702.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	danke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	4C51.exe

Executes dropped EXE 10 IoCs

pid	Process
3448	v5576547.exe
4816	v7886808.exe
4564	a2745253.exe
792	b5664702.exe
4108	danke.exe
2808	c8361139.exe
1376	d3409830.exe
2480	danke.exe
3520	4C51.exe
808	danke.exe

Loads dropped DLL 3 IoCs

pid	Process
920	rundll32.exe
2616	rundll32.exe
464	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2745253.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5576547.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5576547.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7886808.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7886808.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8361139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8361139.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8361139.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
420	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	4C51.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4564	a2745253.exe
4564	a2745253.exe
2808	c8361139.exe
2808	c8361139.exe
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found
3212	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3212	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2808	c8361139.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	a2745253.exe
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found
Token: SeShutdownPrivilege	3212	Process not Found
Token: SeCreatePagefilePrivilege	3212	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
792	b5664702.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3448	1752	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe	86
PID 1752 wrote to memory of 3448	1752	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe	86
PID 1752 wrote to memory of 3448	1752	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe	86
PID 3448 wrote to memory of 4816	3448	v5576547.exe	87
PID 3448 wrote to memory of 4816	3448	v5576547.exe	87
PID 3448 wrote to memory of 4816	3448	v5576547.exe	87
PID 4816 wrote to memory of 4564	4816	v7886808.exe	88
PID 4816 wrote to memory of 4564	4816	v7886808.exe	88
PID 4816 wrote to memory of 792	4816	v7886808.exe	96
PID 4816 wrote to memory of 792	4816	v7886808.exe	96
PID 4816 wrote to memory of 792	4816	v7886808.exe	96
PID 792 wrote to memory of 4108	792	b5664702.exe	98
PID 792 wrote to memory of 4108	792	b5664702.exe	98
PID 792 wrote to memory of 4108	792	b5664702.exe	98
PID 3448 wrote to memory of 2808	3448	v5576547.exe	99
PID 3448 wrote to memory of 2808	3448	v5576547.exe	99
PID 3448 wrote to memory of 2808	3448	v5576547.exe	99
PID 4108 wrote to memory of 420	4108	danke.exe	100
PID 4108 wrote to memory of 420	4108	danke.exe	100
PID 4108 wrote to memory of 420	4108	danke.exe	100
PID 4108 wrote to memory of 3960	4108	danke.exe	102
PID 4108 wrote to memory of 3960	4108	danke.exe	102
PID 4108 wrote to memory of 3960	4108	danke.exe	102
PID 3960 wrote to memory of 3812	3960	cmd.exe	104
PID 3960 wrote to memory of 3812	3960	cmd.exe	104
PID 3960 wrote to memory of 3812	3960	cmd.exe	104
PID 3960 wrote to memory of 4284	3960	cmd.exe	105
PID 3960 wrote to memory of 4284	3960	cmd.exe	105
PID 3960 wrote to memory of 4284	3960	cmd.exe	105
PID 3960 wrote to memory of 1344	3960	cmd.exe	106
PID 3960 wrote to memory of 1344	3960	cmd.exe	106
PID 3960 wrote to memory of 1344	3960	cmd.exe	106
PID 3960 wrote to memory of 1868	3960	cmd.exe	107
PID 3960 wrote to memory of 1868	3960	cmd.exe	107
PID 3960 wrote to memory of 1868	3960	cmd.exe	107
PID 3960 wrote to memory of 4624	3960	cmd.exe	108
PID 3960 wrote to memory of 4624	3960	cmd.exe	108
PID 3960 wrote to memory of 4624	3960	cmd.exe	108
PID 3960 wrote to memory of 4976	3960	cmd.exe	109
PID 3960 wrote to memory of 4976	3960	cmd.exe	109
PID 3960 wrote to memory of 4976	3960	cmd.exe	109
PID 1752 wrote to memory of 1376	1752	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe	110
PID 1752 wrote to memory of 1376	1752	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe	110
PID 1752 wrote to memory of 1376	1752	b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe	110
PID 4108 wrote to memory of 920	4108	danke.exe	121
PID 4108 wrote to memory of 920	4108	danke.exe	121
PID 4108 wrote to memory of 920	4108	danke.exe	121
PID 3212 wrote to memory of 3520	3212	Process not Found	124
PID 3212 wrote to memory of 3520	3212	Process not Found	124
PID 3212 wrote to memory of 3520	3212	Process not Found	124
PID 3520 wrote to memory of 2196	3520	4C51.exe	125
PID 3520 wrote to memory of 2196	3520	4C51.exe	125
PID 3520 wrote to memory of 2196	3520	4C51.exe	125
PID 2196 wrote to memory of 2616	2196	control.exe	127
PID 2196 wrote to memory of 2616	2196	control.exe	127
PID 2196 wrote to memory of 2616	2196	control.exe	127
PID 2616 wrote to memory of 4788	2616	rundll32.exe	129
PID 2616 wrote to memory of 4788	2616	rundll32.exe	129
PID 4788 wrote to memory of 464	4788	RunDll32.exe	130
PID 4788 wrote to memory of 464	4788	RunDll32.exe	130
PID 4788 wrote to memory of 464	4788	RunDll32.exe	130

C:\Users\Admin\AppData\Local\Temp\b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe
"C:\Users\Admin\AppData\Local\Temp\b681b1cebf5b2bb62156d0caf0e67eadbc305ab0b4274898b6bdd409d16e7e06.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5576547.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5576547.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7886808.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7886808.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2745253.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2745253.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5664702.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5664702.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4108
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:420
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:N"
        7⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "danke.exe" /P "Admin:R" /E
        7⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:N"
        7⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\3ec1f323b5" /P "Admin:R" /E
        7⤵
        
        PID:4976
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:920
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8361139.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8361139.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2808
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3409830.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3409830.exe
  2⤵
  - Executes dropped EXE
  PID:1376

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:2480

C:\Users\Admin\AppData\Local\Temp\4C51.exe
C:\Users\Admin\AppData\Local\Temp\4C51.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\6H6AK8G_.cpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\6H6AK8G_.cpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\6H6AK8G_.cpL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\6H6AK8G_.cpL",
        5⤵
        Loads dropped DLL
        
        PID:464

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
1⤵
- Executes dropped EXE
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C51.exe

Filesize
1.6MB

MD5
1fe45d60c424f8de6ee8df494abcc834

SHA1
e0f6be71a88c8664cc67e34269ebc6357124a685

SHA256
7ce653e72925794a6ee7944aeb45fb5ee5128fe1f93b869edc52076411a864c4

SHA512
13d189c27e8598015f7d6deb0010a406fb5bad57db924e123c6c0e0c57e63a1995faabafab2aef00d6f22f7003a8b27fc20e4f84ec1b8cb762ceb93f630f1cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C51.exe

Filesize
1.6MB

MD5
1fe45d60c424f8de6ee8df494abcc834

SHA1
e0f6be71a88c8664cc67e34269ebc6357124a685

SHA256
7ce653e72925794a6ee7944aeb45fb5ee5128fe1f93b869edc52076411a864c4

SHA512
13d189c27e8598015f7d6deb0010a406fb5bad57db924e123c6c0e0c57e63a1995faabafab2aef00d6f22f7003a8b27fc20e4f84ec1b8cb762ceb93f630f1cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\6H6AK8G_.cpL

Filesize
1.2MB

MD5
45b3981b7d1a9fda8b239afcfdc6bb64

SHA1
9a4b932fa6557f975b4548189e3cbd000ccff4f9

SHA256
c0fc65551acd5faa9d6ce5f0dee9d677b6ca996dac64160deb767721621a1682

SHA512
8053687e876fc31641df3fac4002249a9e42a81d59e68f633c5416a4a0bcdc39628172fb0052341477f8235415d50f49ebb8aa23e3f8563e3d3b7d2bfac8cfe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6H6aK8g_.cpl

Filesize
1.2MB

MD5
45b3981b7d1a9fda8b239afcfdc6bb64

SHA1
9a4b932fa6557f975b4548189e3cbd000ccff4f9

SHA256
c0fc65551acd5faa9d6ce5f0dee9d677b6ca996dac64160deb767721621a1682

SHA512
8053687e876fc31641df3fac4002249a9e42a81d59e68f633c5416a4a0bcdc39628172fb0052341477f8235415d50f49ebb8aa23e3f8563e3d3b7d2bfac8cfe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6H6aK8g_.cpl

Filesize
1.2MB

MD5
45b3981b7d1a9fda8b239afcfdc6bb64

SHA1
9a4b932fa6557f975b4548189e3cbd000ccff4f9

SHA256
c0fc65551acd5faa9d6ce5f0dee9d677b6ca996dac64160deb767721621a1682

SHA512
8053687e876fc31641df3fac4002249a9e42a81d59e68f633c5416a4a0bcdc39628172fb0052341477f8235415d50f49ebb8aa23e3f8563e3d3b7d2bfac8cfe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6H6aK8g_.cpl

Filesize
1.2MB

MD5
45b3981b7d1a9fda8b239afcfdc6bb64

SHA1
9a4b932fa6557f975b4548189e3cbd000ccff4f9

SHA256
c0fc65551acd5faa9d6ce5f0dee9d677b6ca996dac64160deb767721621a1682

SHA512
8053687e876fc31641df3fac4002249a9e42a81d59e68f633c5416a4a0bcdc39628172fb0052341477f8235415d50f49ebb8aa23e3f8563e3d3b7d2bfac8cfe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3409830.exe

Filesize
173KB

MD5
0b5aeca9c68ce3cefab4f25189e6abe8

SHA1
2852ba47a541edf968b21826c8767bed1c57ac81

SHA256
4b67162af92e7998f8afc24bad719941d3b5df62bc85839e9506f7d58ed9bcd1

SHA512
7472ad2efe46172097d01a789cee1e7f58c5489a31e2109e77406b780fe2ce3d90359b93b80be195dbe833ec0d1636acadf3fe099b9c7079b498511bef22071b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3409830.exe

Filesize
173KB

MD5
0b5aeca9c68ce3cefab4f25189e6abe8

SHA1
2852ba47a541edf968b21826c8767bed1c57ac81

SHA256
4b67162af92e7998f8afc24bad719941d3b5df62bc85839e9506f7d58ed9bcd1

SHA512
7472ad2efe46172097d01a789cee1e7f58c5489a31e2109e77406b780fe2ce3d90359b93b80be195dbe833ec0d1636acadf3fe099b9c7079b498511bef22071b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5576547.exe

Filesize
359KB

MD5
803ca94500c4497d0a1f358d4c853141

SHA1
5d70742fed03929e833894d62fd8d480fab90eda

SHA256
cd83cb052362751d1948801ac6410664ab6b2ca466fb7de8dc3c6c48034208be

SHA512
6e3cb9ae5854db363727bd84acd1f98cc734e864c4f3db35000c80f114c9bcf57243417553c5beb4dad935f4dcdac6540c3d4213e60fa280e517e1cbc5be32bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5576547.exe

Filesize
359KB

MD5
803ca94500c4497d0a1f358d4c853141

SHA1
5d70742fed03929e833894d62fd8d480fab90eda

SHA256
cd83cb052362751d1948801ac6410664ab6b2ca466fb7de8dc3c6c48034208be

SHA512
6e3cb9ae5854db363727bd84acd1f98cc734e864c4f3db35000c80f114c9bcf57243417553c5beb4dad935f4dcdac6540c3d4213e60fa280e517e1cbc5be32bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8361139.exe

Filesize
34KB

MD5
12263453f79ef9084d26d7d3dfb8b9f1

SHA1
8000bf6f0d2c00fe46ebbbb369298cc2c443151c

SHA256
e312249f56e08fbf2e21d8379490142b8b07639a6d620fb4bfc3cfdaf0fee70e

SHA512
d88eda7e01c279f43e586e3d1be1c25a5044eeaa5e07157fc553976ec879424aa1917038d61741703bb0483bccfb83664f8e4c75a0d60552310e4a50a5a231ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c8361139.exe

Filesize
34KB

MD5
12263453f79ef9084d26d7d3dfb8b9f1

SHA1
8000bf6f0d2c00fe46ebbbb369298cc2c443151c

SHA256
e312249f56e08fbf2e21d8379490142b8b07639a6d620fb4bfc3cfdaf0fee70e

SHA512
d88eda7e01c279f43e586e3d1be1c25a5044eeaa5e07157fc553976ec879424aa1917038d61741703bb0483bccfb83664f8e4c75a0d60552310e4a50a5a231ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7886808.exe

Filesize
235KB

MD5
eb7d129be81853069d8cf37f5b47f13f

SHA1
99455b6d8488952469f73a8f4a79809e710652cb

SHA256
c13d7d328744435a8563a1584d380695813474ab03ca575a00fdb29600aadcbb

SHA512
b7d59a01296db2e0dfd4c95ba7c12d748aa1d846b5dbb7c30f7b7edc2988599133364a11ade38c8dff281932547dcbd0c5bf0e51e0a967e29dd2dd6c4d2b61e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7886808.exe

Filesize
235KB

MD5
eb7d129be81853069d8cf37f5b47f13f

SHA1
99455b6d8488952469f73a8f4a79809e710652cb

SHA256
c13d7d328744435a8563a1584d380695813474ab03ca575a00fdb29600aadcbb

SHA512
b7d59a01296db2e0dfd4c95ba7c12d748aa1d846b5dbb7c30f7b7edc2988599133364a11ade38c8dff281932547dcbd0c5bf0e51e0a967e29dd2dd6c4d2b61e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2745253.exe

Filesize
12KB

MD5
34d87570bce2bf959734cd90577467f1

SHA1
b2a404921d1cc4ec93ba3b83f287c81bc988c528

SHA256
5c2a2f9f1b9391d15a5fa42dad70449545dbcfc27607e1ac9994e45a0ac0e819

SHA512
23446207aee1294e9223edb787d121a4559bd10d43ac0c6fae74ea007f14a88446751655f5439cd16f4876cd41b9aa22e411597c5c867054e3db1b3021237f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a2745253.exe

Filesize
12KB

MD5
34d87570bce2bf959734cd90577467f1

SHA1
b2a404921d1cc4ec93ba3b83f287c81bc988c528

SHA256
5c2a2f9f1b9391d15a5fa42dad70449545dbcfc27607e1ac9994e45a0ac0e819

SHA512
23446207aee1294e9223edb787d121a4559bd10d43ac0c6fae74ea007f14a88446751655f5439cd16f4876cd41b9aa22e411597c5c867054e3db1b3021237f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5664702.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5664702.exe

Filesize
229KB

MD5
865971d0e397d30b59ccc96519b260de

SHA1
5011101720bcedab376848a7de563372c9e7287f

SHA256
f99bddf9f36e6b8a68edb1ff4d18ca62c0b8fd1f636de71703bc5cbfb97d83e4

SHA512
35f00ca121449929a4eda04608bc174a63f2737e4ad9eb994c477a91d25d15748970da8d6c201ab36cb7e94f0dea3e1ed8b9717583fb48765d8b31d139015568

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
dc587d08b8ca3cd62e5dc057d41a966b

SHA1
0ba6a88377c74a0c53b956d405ad17dd5f8c4164

SHA256
7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

SHA512
7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
272B

MD5
d867eabb1be5b45bc77bb06814e23640

SHA1
3139a51ce7e8462c31070363b9532c13cc52c82d

SHA256
38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349

SHA512
afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59

Download Submit
memory/464-283-0x0000000003080000-0x0000000003161000-memory.dmp

Filesize
900KB

Download
memory/464-275-0x00000000010A0000-0x00000000010A6000-memory.dmp

Filesize
24KB

Download
memory/464-279-0x0000000002F80000-0x000000000307B000-memory.dmp

Filesize
1004KB

Download
memory/464-281-0x0000000003080000-0x0000000003161000-memory.dmp

Filesize
900KB

Download
memory/464-284-0x0000000003080000-0x0000000003161000-memory.dmp

Filesize
900KB

Download
memory/1376-191-0x0000000004890000-0x00000000048A0000-memory.dmp

Filesize
64KB

Download
memory/1376-183-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/1376-190-0x00000000731C0000-0x0000000073970000-memory.dmp

Filesize
7.7MB

Download
memory/1376-189-0x0000000004AC0000-0x0000000004AFC000-memory.dmp

Filesize
240KB

Download
memory/1376-187-0x0000000004A60000-0x0000000004A72000-memory.dmp

Filesize
72KB

Download
memory/1376-188-0x0000000004890000-0x00000000048A0000-memory.dmp

Filesize
64KB

Download
memory/1376-186-0x0000000004B20000-0x0000000004C2A000-memory.dmp

Filesize
1.0MB

Download
memory/1376-185-0x0000000005000000-0x0000000005618000-memory.dmp

Filesize
6.1MB

Download
memory/1376-184-0x00000000000D0000-0x0000000000100000-memory.dmp

Filesize
192KB

Download
memory/2616-272-0x0000000002FC0000-0x00000000030A1000-memory.dmp

Filesize
900KB

Download
memory/2616-265-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/2616-264-0x0000000001120000-0x0000000001126000-memory.dmp

Filesize
24KB

Download
memory/2616-268-0x0000000002EC0000-0x0000000002FBB000-memory.dmp

Filesize
1004KB

Download
memory/2616-269-0x0000000002FC0000-0x00000000030A1000-memory.dmp

Filesize
900KB

Download
memory/2616-270-0x0000000002FC0000-0x00000000030A1000-memory.dmp

Filesize
900KB

Download
memory/2616-273-0x0000000002FC0000-0x00000000030A1000-memory.dmp

Filesize
900KB

Download
memory/2808-174-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-178-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3212-222-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-176-0x0000000004180000-0x0000000004196000-memory.dmp

Filesize
88KB

Download
memory/3212-213-0x00000000082D0000-0x00000000082E0000-memory.dmp

Filesize
64KB

Download
memory/3212-218-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-219-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-221-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-223-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-215-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-220-0x0000000008300000-0x0000000008310000-memory.dmp

Filesize
64KB

Download
memory/3212-225-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-224-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-227-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-228-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-212-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-211-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-209-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-208-0x0000000008300000-0x0000000008310000-memory.dmp

Filesize
64KB

Download
memory/3212-207-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-206-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-217-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-205-0x0000000008300000-0x0000000008310000-memory.dmp

Filesize
64KB

Download
memory/3212-192-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-193-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-201-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-204-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-195-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-203-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-202-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-199-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-198-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-197-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/3212-194-0x00000000082D0000-0x00000000082E0000-memory.dmp

Filesize
64KB

Download
memory/3212-196-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/4564-154-0x0000000000A90000-0x0000000000A9A000-memory.dmp

Filesize
40KB

Download
memory/4564-155-0x00007FFF8A550000-0x00007FFF8B011000-memory.dmp

Filesize
10.8MB

Download
memory/4564-156-0x00007FFF8A550000-0x00007FFF8B011000-memory.dmp

Filesize
10.8MB

Download
memory/4564-158-0x00007FFF8A550000-0x00007FFF8B011000-memory.dmp

Filesize
10.8MB

Download