amadey | f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52

Analysis

max time kernel
26s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe
Size 1.0MB
Sample231003-mxtcwsaa5v
SHA256 f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52
MD5 e98630dcc665daaa37335c018f1e435f
SHA1 54d9b1eefa56ff6e9a63ed4a56ec9866683eb935
SHA512 9602b9965f62bf3e07aaaf238deff864509a39d40b471ab5a01039a25b53b1666ed4e6d37e96b0edf4ccf744b7024d20ed6891af0ef8b9ef2d4ad7761660c746
SSDEEP 24576:ByE3Vc/UZiWmjmm2A0LZG8dF3Wq2nzcbzK0vaLL3oHwL:0El7mjSA4GGSzc3KbUHw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey healer redline jordan dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

jordan

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000231f0-33.dat	healer
behavioral1/files/0x00070000000231f0-34.dat	healer
behavioral1/memory/380-35-0x0000000000800000-0x000000000080A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q7302032.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q7302032.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q7302032.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q7302032.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q7302032.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q7302032.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4344-50-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	u8853461.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	t5661416.exe

Executes dropped EXE 10 IoCs

pid	Process
4188	z1038406.exe
3740	z6306250.exe
3644	z3165562.exe
3820	z4137888.exe
380	q7302032.exe
4552	r8057301.exe
4508	s5722463.exe
5060	t5661416.exe
5096	explothe.exe
208	u8853461.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q7302032.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1038406.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z6306250.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z3165562.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z4137888.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4552 set thread context of 1900	4552	r8057301.exe	101
PID 4508 set thread context of 4344	4508	s5722463.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2728	1900	WerFault.exe	101
1052	4552	WerFault.exe	97
3680	4508	WerFault.exe	106

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4052	schtasks.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "229"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
380	q7302032.exe
380	q7302032.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	q7302032.exe
Token: SeShutdownPrivilege	3316	shutdown.exe
Token: SeRemoteShutdownPrivilege	3316	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
244	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4188	4116	f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe	86
PID 4116 wrote to memory of 4188	4116	f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe	86
PID 4116 wrote to memory of 4188	4116	f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe	86
PID 4188 wrote to memory of 3740	4188	z1038406.exe	87
PID 4188 wrote to memory of 3740	4188	z1038406.exe	87
PID 4188 wrote to memory of 3740	4188	z1038406.exe	87
PID 3740 wrote to memory of 3644	3740	z6306250.exe	88
PID 3740 wrote to memory of 3644	3740	z6306250.exe	88
PID 3740 wrote to memory of 3644	3740	z6306250.exe	88
PID 3644 wrote to memory of 3820	3644	z3165562.exe	89
PID 3644 wrote to memory of 3820	3644	z3165562.exe	89
PID 3644 wrote to memory of 3820	3644	z3165562.exe	89
PID 3820 wrote to memory of 380	3820	z4137888.exe	90
PID 3820 wrote to memory of 380	3820	z4137888.exe	90
PID 3820 wrote to memory of 4552	3820	z4137888.exe	97
PID 3820 wrote to memory of 4552	3820	z4137888.exe	97
PID 3820 wrote to memory of 4552	3820	z4137888.exe	97
PID 4552 wrote to memory of 1520	4552	r8057301.exe	99
PID 4552 wrote to memory of 1520	4552	r8057301.exe	99
PID 4552 wrote to memory of 1520	4552	r8057301.exe	99
PID 4552 wrote to memory of 3748	4552	r8057301.exe	100
PID 4552 wrote to memory of 3748	4552	r8057301.exe	100
PID 4552 wrote to memory of 3748	4552	r8057301.exe	100
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 4552 wrote to memory of 1900	4552	r8057301.exe	101
PID 3644 wrote to memory of 4508	3644	z3165562.exe	106
PID 3644 wrote to memory of 4508	3644	z3165562.exe	106
PID 3644 wrote to memory of 4508	3644	z3165562.exe	106
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 4508 wrote to memory of 4344	4508	s5722463.exe	108
PID 3740 wrote to memory of 5060	3740	z6306250.exe	111
PID 3740 wrote to memory of 5060	3740	z6306250.exe	111
PID 3740 wrote to memory of 5060	3740	z6306250.exe	111
PID 5060 wrote to memory of 5096	5060	t5661416.exe	112
PID 5060 wrote to memory of 5096	5060	t5661416.exe	112
PID 5060 wrote to memory of 5096	5060	t5661416.exe	112
PID 4188 wrote to memory of 208	4188	z1038406.exe	113
PID 4188 wrote to memory of 208	4188	z1038406.exe	113
PID 4188 wrote to memory of 208	4188	z1038406.exe	113
PID 5096 wrote to memory of 4052	5096	explothe.exe	114
PID 5096 wrote to memory of 4052	5096	explothe.exe	114
PID 5096 wrote to memory of 4052	5096	explothe.exe	114
PID 208 wrote to memory of 3672	208	u8853461.exe	116
PID 208 wrote to memory of 3672	208	u8853461.exe	116
PID 208 wrote to memory of 3672	208	u8853461.exe	116
PID 5096 wrote to memory of 4408	5096	explothe.exe	118
PID 5096 wrote to memory of 4408	5096	explothe.exe	118
PID 5096 wrote to memory of 4408	5096	explothe.exe	118
PID 3672 wrote to memory of 3316	3672	cmd.exe	120
PID 3672 wrote to memory of 3316	3672	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe
"C:\Users\Admin\AppData\Local\Temp\f476dc83a149b25ee84ef36e8065f67be2d1a0de0b94d89065b53a47e5d5fd52.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1038406.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1038406.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6306250.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6306250.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3165562.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3165562.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4137888.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4137888.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7302032.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7302032.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8057301.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8057301.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1520
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3748
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 540
        8⤵
        Program crash
        
        PID:2728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 140
        7⤵
        Program crash
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5722463.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5722463.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4508
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 156
        6⤵
        Program crash
        
        PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5661416.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5661416.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4052
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4856
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8853461.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8853461.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -s -t 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4552 -ip 4552
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1900 -ip 1900
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4508 -ip 4508
1⤵
PID:644

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3998055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z1038406.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1038406.exe
Size 905KB
SHA256 1ca0281677c413d440407cf5950a153a06ee1428dff933d477a32a488e7e8610
MD5 a6892d2c33299e39a091e9b3e25e38e4
SHA1 4472b5e2272fc0ff3f5c8f5eab2e933cd708938e
SHA512 f5c62e9dc1a373addc66a4048abb484b0923b384d444a534e6b493baaa27417b8fcaf211d4e8b35028db3095f657950d7b04c361885ac3a7a2cabdac7f2f896a
SSDEEP 24576:yyPAihCdmaomnZ08dT3/u2nzSizaEFg9Xloy:ZfCd080k9zSmaZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

z1038406.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1038406.exe
Size 905KB
SHA256 1ca0281677c413d440407cf5950a153a06ee1428dff933d477a32a488e7e8610
MD5 a6892d2c33299e39a091e9b3e25e38e4
SHA1 4472b5e2272fc0ff3f5c8f5eab2e933cd708938e
SHA512 f5c62e9dc1a373addc66a4048abb484b0923b384d444a534e6b493baaa27417b8fcaf211d4e8b35028db3095f657950d7b04c361885ac3a7a2cabdac7f2f896a
SSDEEP 24576:yyPAihCdmaomnZ08dT3/u2nzSizaEFg9Xloy:ZfCd080k9zSmaZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

u8853461.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8853461.exe
Size 219KB
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
SSDEEP 6144:87Vj3uVUn27+6qQx41QPF2nnugMeS7SpY:6wYfQx9FOnugMeS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

u8853461.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8853461.exe
Size 219KB
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
SSDEEP 6144:87Vj3uVUn27+6qQx41QPF2nnugMeS7SpY:6wYfQx9FOnugMeS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

z6306250.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6306250.exe
Size 723KB
SHA256 ff7a63f29879aa9a50248315579943b8763737f422241064b4e645ae970cc0d3
MD5 451abc477b0d4d8b18b36da0193606d6
SHA1 468e1218114f0e16aed6c61e09bee609d868bf9c
SHA512 7015b5b29b80fefd7a250a1ad4f7b74b91dee3a811feee7c20326814a65807fb06ddb13dea90d928002fa12739a367827d3cca140e4af53242f47b1d4f86165e
SSDEEP 12288:8MrIy90CbfsHUHPGom9FSIt27ch8dYV3OW3auo2cXz6f5Sfme4gkzB9DST//mYa6:kyLfZeomxw28dm3/o2szB8zo//mZdw
MD5 SHA1 SHA512 SSDEEP

Submit Download

z6306250.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6306250.exe
Size 723KB
SHA256 ff7a63f29879aa9a50248315579943b8763737f422241064b4e645ae970cc0d3
MD5 451abc477b0d4d8b18b36da0193606d6
SHA1 468e1218114f0e16aed6c61e09bee609d868bf9c
SHA512 7015b5b29b80fefd7a250a1ad4f7b74b91dee3a811feee7c20326814a65807fb06ddb13dea90d928002fa12739a367827d3cca140e4af53242f47b1d4f86165e
SSDEEP 12288:8MrIy90CbfsHUHPGom9FSIt27ch8dYV3OW3auo2cXz6f5Sfme4gkzB9DST//mYa6:kyLfZeomxw28dm3/o2szB8zo//mZdw
MD5 SHA1 SHA512 SSDEEP

Submit Download

t5661416.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5661416.exe
Size 219KB
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
SSDEEP 6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

t5661416.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5661416.exe
Size 219KB
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
SSDEEP 6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3165562.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3165562.exe
Size 540KB
SHA256 1207cfe25f08b37b83c48993bf3b48674526bf74529ab9db644632a0eff9fe2e
MD5 7cce5423fbe45b460be4be528fd4e73d
SHA1 7d63fe0e1cc91bfe5d06c743eb5cdd8bdd57cd25
SHA512 d42459e76f844a8ed118f8c8651b2440b45f44f99f9e2433c869740e539f66cb875d9383ce3cb56b7d28e1cdb49c67b8d15b82b329cfd3056180958d321ad7d6
SSDEEP 12288:SMr8y90ieLp23Jh8dYV3vWhaui2cXzNf5SfGeAgk1BfbSTVc:SyFeL0v8dvh/i2szmM1OVc
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3165562.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3165562.exe
Size 540KB
SHA256 1207cfe25f08b37b83c48993bf3b48674526bf74529ab9db644632a0eff9fe2e
MD5 7cce5423fbe45b460be4be528fd4e73d
SHA1 7d63fe0e1cc91bfe5d06c743eb5cdd8bdd57cd25
SHA512 d42459e76f844a8ed118f8c8651b2440b45f44f99f9e2433c869740e539f66cb875d9383ce3cb56b7d28e1cdb49c67b8d15b82b329cfd3056180958d321ad7d6
SSDEEP 12288:SMr8y90ieLp23Jh8dYV3vWhaui2cXzNf5SfGeAgk1BfbSTVc:SyFeL0v8dvh/i2szmM1OVc
MD5 SHA1 SHA512 SSDEEP

Submit Download

s5722463.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5722463.exe
Size 367KB
SHA256 37956cf87ca9291ca6bfd4e1e0b97eedb85b29ac20118ea740fe1652d46e934d
MD5 2bf7798f30a43f419ef70f08e8bd5c98
SHA1 34e7a0cd8dc6a69189700cb81d5467d9f8c8d2cc
SHA512 ef46ab54840d8a38253de0d0ba4a82a283434d03a6d8f151bc157534711cc18faaec80d878bacb0b0183372bb5d0491323aeb65a4164af5ca1af53c615029f37
SSDEEP 6144:aiesdAA2vAPkqcONfCbqTIQCy6ybDy9bg7UXye9PeO3xh6+wLrcH6fhxC6BIwjdx:aiesd7AqcIfC2TIQCy6ybDy9bg7Gyexc
MD5 SHA1 SHA512 SSDEEP

Submit Download

s5722463.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5722463.exe
Size 367KB
SHA256 37956cf87ca9291ca6bfd4e1e0b97eedb85b29ac20118ea740fe1652d46e934d
MD5 2bf7798f30a43f419ef70f08e8bd5c98
SHA1 34e7a0cd8dc6a69189700cb81d5467d9f8c8d2cc
SHA512 ef46ab54840d8a38253de0d0ba4a82a283434d03a6d8f151bc157534711cc18faaec80d878bacb0b0183372bb5d0491323aeb65a4164af5ca1af53c615029f37
SSDEEP 6144:aiesdAA2vAPkqcONfCbqTIQCy6ybDy9bg7UXye9PeO3xh6+wLrcH6fhxC6BIwjdx:aiesd7AqcIfC2TIQCy6ybDy9bg7Gyexc
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4137888.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4137888.exe
Size 293KB
SHA256 0468d427d3c418bc8d38b667b31258ce500f05031e8c4ccbc8d707a91feedc81
MD5 56d3acee01ed42f7c382121bb71466a0
SHA1 9683420a0a8f0576f13adb1bd896ff2fa5e8b259
SHA512 84478db5f76f08145a159c2adbe8febfed3b6174afb0f3a1bf2c402366da729ed137346c0d74f0478919f27d3389295ad20d00e19549cd813479c618fd70ba48
SSDEEP 6144:Kvy+bnr+Op0yN90QEnY+I3PkWha+pR0JtBqXjA+90f7PrjNH:hMriy90pYV3sWhauItcXzKD5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4137888.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4137888.exe
Size 293KB
SHA256 0468d427d3c418bc8d38b667b31258ce500f05031e8c4ccbc8d707a91feedc81
MD5 56d3acee01ed42f7c382121bb71466a0
SHA1 9683420a0a8f0576f13adb1bd896ff2fa5e8b259
SHA512 84478db5f76f08145a159c2adbe8febfed3b6174afb0f3a1bf2c402366da729ed137346c0d74f0478919f27d3389295ad20d00e19549cd813479c618fd70ba48
SSDEEP 6144:Kvy+bnr+Op0yN90QEnY+I3PkWha+pR0JtBqXjA+90f7PrjNH:hMriy90pYV3sWhauItcXzKD5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

q7302032.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7302032.exe
Size 12KB
SHA256 c054c7ac3c9195388f2cf0e9bbf30d59d982fea3d87600f3ef216a1db99593fc
MD5 460ba587cccd7bfaa6ad182668949fe0
SHA1 b2b253c4103dc3b65faa07f14fb1cf4b04d4adc6
SHA512 ec671a7d60bd4ef4e057beba2dfa5899f27a57b1e4940c397104934a65b1e9e7ea4b215708f7512c84c1ba1c4f539028f7da5fbde80d60a8ae7ed955405fdf2a
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

q7302032.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7302032.exe
Size 12KB
SHA256 c054c7ac3c9195388f2cf0e9bbf30d59d982fea3d87600f3ef216a1db99593fc
MD5 460ba587cccd7bfaa6ad182668949fe0
SHA1 b2b253c4103dc3b65faa07f14fb1cf4b04d4adc6
SHA512 ec671a7d60bd4ef4e057beba2dfa5899f27a57b1e4940c397104934a65b1e9e7ea4b215708f7512c84c1ba1c4f539028f7da5fbde80d60a8ae7ed955405fdf2a
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r8057301.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8057301.exe
Size 285KB
SHA256 67289f501468c15cb021e1102f84e557f09846f1468106e96acdb53752434314
MD5 cf624331c5e30723e3e2f5148863a40a
SHA1 9fbba90eba52be9ed363c2a4961f1c730f54f7ea
SHA512 83019aa4595b90599eb90ff5a23514a5f072bf55b13ae07f829f6a8a0bf6598301eaee2319234478ca601b782ad52aa4191ba6a24a1eb56cf88eb3001326d758
SSDEEP 6144:bU+Elo4WGFw16HcyZiReBVDcp+9t9OXDt9uBox:bU+ElodKHcyZ9Dv9t9GwCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

r8057301.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8057301.exe
Size 285KB
SHA256 67289f501468c15cb021e1102f84e557f09846f1468106e96acdb53752434314
MD5 cf624331c5e30723e3e2f5148863a40a
SHA1 9fbba90eba52be9ed363c2a4961f1c730f54f7ea
SHA512 83019aa4595b90599eb90ff5a23514a5f072bf55b13ae07f829f6a8a0bf6598301eaee2319234478ca601b782ad52aa4191ba6a24a1eb56cf88eb3001326d758
SSDEEP 6144:bU+Elo4WGFw16HcyZiReBVDcp+9t9OXDt9uBox:bU+ElodKHcyZ9Dv9t9GwCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

explothe.exe

Path C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Size 219KB
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
SSDEEP 6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

explothe.exe

Path C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Size 219KB
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
SSDEEP 6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

explothe.exe

Path C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Size 219KB
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
SSDEEP 6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-35-0x0000000000800000-0x000000000080A000-memory.dmp

Download

memory/380-36-0x00007FFE24890000-0x00007FFE25351000-memory.dmp

Download

memory/380-38-0x00007FFE24890000-0x00007FFE25351000-memory.dmp

Download

memory/1900-44-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1900-42-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1900-43-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1900-46-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4344-50-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4344-60-0x0000000007830000-0x000000000783A000-memory.dmp

Download

memory/4344-65-0x0000000008940000-0x0000000008F58000-memory.dmp

Download

memory/4344-66-0x0000000007B80000-0x0000000007C8A000-memory.dmp

Download

memory/4344-67-0x0000000007AB0000-0x0000000007AC2000-memory.dmp

Download

memory/4344-68-0x0000000007B10000-0x0000000007B4C000-memory.dmp

Download

memory/4344-51-0x0000000073B70000-0x0000000074320000-memory.dmp

Download

memory/4344-54-0x0000000007A60000-0x0000000007A70000-memory.dmp

Download

memory/4344-72-0x0000000007C90000-0x0000000007CDC000-memory.dmp

Download

memory/4344-53-0x0000000007860000-0x00000000078F2000-memory.dmp

Download

memory/4344-52-0x0000000007D70000-0x0000000008314000-memory.dmp

Download

memory/4344-76-0x0000000073B70000-0x0000000074320000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads