amadey | 82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-09-2023 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe
Size

918KB
MD5

98628dba1be12d83b13f1b2bd25d85b6
SHA1

e5ade0031e4f6b4a67189010dcb1fc015a7ad5ef
SHA256

82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30
SHA512

789c5111f2c00caf2e10faa49834766d8731fc7d0efdbfeccdae1ac11180680f001e3254ac0b6fc4bf69449c1d61761a7990fce907605969a093408a668886f1
SSDEEP

24576:TdO/YtNyqi2tAlwYZAVBHPXvkUNF3PEjVwaxG:gkNA2aW8ADP/1fiVwaxG

Score

10^/10

amadey fabookie spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.83

5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1188-86-0x0000000003130000-0x0000000003261000-memory.dmp	family_fabookie
behavioral1/memory/1188-89-0x0000000003130000-0x0000000003261000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Executes dropped EXE 5 IoCs

Processes:

oldplayer.exess41.exeoneetx.exeoneetx.exeoneetx.exe

pid process

2204 oldplayer.exe
1188 ss41.exe
2720 oneetx.exe
1584 oneetx.exe
2064 oneetx.exe

pid	process
2204	oldplayer.exe
1188	ss41.exe
2720	oneetx.exe
1584	oneetx.exe
2064	oneetx.exe

Loads dropped DLL 4 IoCs

Processes:

JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exeoldplayer.exe

pid	process
2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe
2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe
2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe
2204	oldplayer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2828 schtasks.exe

pid	process
2828	schtasks.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

ss41.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	ss41.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ss41.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ss41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ss41.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ss41.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

oldplayer.exe

pid process

2204 oldplayer.exe

pid	process
2204	oldplayer.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exeoldplayer.exeoneetx.execmd.exetaskeng.exe

description	pid	process	target process
PID 2196 wrote to memory of 2204	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	oldplayer.exe
PID 2196 wrote to memory of 2204	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	oldplayer.exe
PID 2196 wrote to memory of 2204	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	oldplayer.exe
PID 2196 wrote to memory of 2204	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	oldplayer.exe
PID 2196 wrote to memory of 1188	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	ss41.exe
PID 2196 wrote to memory of 1188	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	ss41.exe
PID 2196 wrote to memory of 1188	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	ss41.exe
PID 2196 wrote to memory of 1188	2196	JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe	ss41.exe
PID 2204 wrote to memory of 2720	2204	oldplayer.exe	oneetx.exe
PID 2204 wrote to memory of 2720	2204	oldplayer.exe	oneetx.exe
PID 2204 wrote to memory of 2720	2204	oldplayer.exe	oneetx.exe
PID 2204 wrote to memory of 2720	2204	oldplayer.exe	oneetx.exe
PID 2720 wrote to memory of 2828	2720	oneetx.exe	schtasks.exe
PID 2720 wrote to memory of 2828	2720	oneetx.exe	schtasks.exe
PID 2720 wrote to memory of 2828	2720	oneetx.exe	schtasks.exe
PID 2720 wrote to memory of 2828	2720	oneetx.exe	schtasks.exe
PID 2720 wrote to memory of 2096	2720	oneetx.exe	cmd.exe
PID 2720 wrote to memory of 2096	2720	oneetx.exe	cmd.exe
PID 2720 wrote to memory of 2096	2720	oneetx.exe	cmd.exe
PID 2720 wrote to memory of 2096	2720	oneetx.exe	cmd.exe
PID 2096 wrote to memory of 2704	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2704	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2704	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2704	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 1944	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 1944	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 1944	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 1944	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2764	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2764	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2764	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2764	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2564	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2564	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2564	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2564	2096	cmd.exe	cmd.exe
PID 2096 wrote to memory of 2584	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2584	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2584	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2584	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2612	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2612	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2612	2096	cmd.exe	cacls.exe
PID 2096 wrote to memory of 2612	2096	cmd.exe	cacls.exe
PID 2944 wrote to memory of 1584	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 1584	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 1584	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 1584	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 2064	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 2064	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 2064	2944	taskeng.exe	oneetx.exe
PID 2944 wrote to memory of 2064	2944	taskeng.exe	oneetx.exe

C:\Users\Admin\AppData\Local\Temp\JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe
"C:\Users\Admin\AppData\Local\Temp\JC_82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:2828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2704

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:1944

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2564

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
5⤵
PID:2584

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
5⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\ss41.exe
"C:\Users\Admin\AppData\Local\Temp\ss41.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1188

C:\Windows\system32\taskeng.exe
taskeng.exe {C5CCCCED-0BE1-43DF-823D-2F0B073D0485} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
2⤵
- Executes dropped EXE
PID:1584

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
2⤵
- Executes dropped EXE
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab712C.tmp
Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar719C.tmp
Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
715KB

MD5
ee767793010f352fe7af89e00e31e469

SHA1
d8b031befe57c39dfc3312ab8c18330d69f110d6

SHA256
b20a10018c71a9dffe1b76b1be20fd71abc3bb4ccc5c485012288de14caaba5a

SHA512
6fd1702199dbec14b4c85f36e0b8ff14ead1ca7ade40892038d6042a47752a04428a603cfb5b8daca71bfd6bae754a4416fed5092ae6180904e3f3b75c783840

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
715KB

MD5
ee767793010f352fe7af89e00e31e469

SHA1
d8b031befe57c39dfc3312ab8c18330d69f110d6

SHA256
b20a10018c71a9dffe1b76b1be20fd71abc3bb4ccc5c485012288de14caaba5a

SHA512
6fd1702199dbec14b4c85f36e0b8ff14ead1ca7ade40892038d6042a47752a04428a603cfb5b8daca71bfd6bae754a4416fed5092ae6180904e3f3b75c783840

Download Submit
\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
\Users\Admin\AppData\Local\Temp\oldplayer.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
715KB

MD5
ee767793010f352fe7af89e00e31e469

SHA1
d8b031befe57c39dfc3312ab8c18330d69f110d6

SHA256
b20a10018c71a9dffe1b76b1be20fd71abc3bb4ccc5c485012288de14caaba5a

SHA512
6fd1702199dbec14b4c85f36e0b8ff14ead1ca7ade40892038d6042a47752a04428a603cfb5b8daca71bfd6bae754a4416fed5092ae6180904e3f3b75c783840

Download Submit
\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
715KB

MD5
ee767793010f352fe7af89e00e31e469

SHA1
d8b031befe57c39dfc3312ab8c18330d69f110d6

SHA256
b20a10018c71a9dffe1b76b1be20fd71abc3bb4ccc5c485012288de14caaba5a

SHA512
6fd1702199dbec14b4c85f36e0b8ff14ead1ca7ade40892038d6042a47752a04428a603cfb5b8daca71bfd6bae754a4416fed5092ae6180904e3f3b75c783840

Download Submit
memory/1188-86-0x0000000003130000-0x0000000003261000-memory.dmp

Filesize
1.2MB

Download
memory/1188-85-0x0000000002FB0000-0x0000000003121000-memory.dmp

Filesize
1.4MB

Download
memory/1188-89-0x0000000003130000-0x0000000003261000-memory.dmp

Filesize
1.2MB

Download
memory/1188-14-0x00000000FF070000-0x00000000FF127000-memory.dmp

Filesize
732KB

Download
memory/2204-15-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download