amadey | 579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20

Analysis

max time kernel
120s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 21:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe
Size

967KB
MD5

ccd3df826d56c920cf6b2ad141f40fe4
SHA1

508b81ebaf27aafad30ad0008007f96d24b88384
SHA256

579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20
SHA512

e7a934dea74d563d59500e8dc632b5ab1e2436fb2a55803b9b48620d2ca5ca41fabe3923d567a07e25d9efc8a98b83cafeed7ee8f160a2893fcc00a3d7fc1226
SSDEEP

24576:7ybnQmlwVJpQgAtGMlqRd9cFIVPPdBe7U:ubfCjpQTtGtOIB

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/2424-43-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2424-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2424-45-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2424-47-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231ef-33.dat	healer
behavioral2/files/0x00070000000231ef-34.dat	healer
behavioral2/memory/2664-35-0x0000000000200000-0x000000000020A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q6441269.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q6441269.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q6441269.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q6441269.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q6441269.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q6441269.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	t8457021.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	u6525598.exe

Executes dropped EXE 10 IoCs

pid	Process
2108	z7361472.exe
2744	z9932384.exe
1424	z8222557.exe
3804	z3594892.exe
2664	q6441269.exe
3380	r1252636.exe
4812	s8244108.exe
4924	t8457021.exe
4912	explothe.exe
932	u6525598.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q6441269.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7361472.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9932384.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z8222557.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z3594892.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3380 set thread context of 2424	3380	r1252636.exe	102
PID 4812 set thread context of 1784	4812	s8244108.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1596	2424	WerFault.exe	102
4384	3380	WerFault.exe	100
3604	4812	WerFault.exe	112

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4084	schtasks.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "229"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	q6441269.exe
2664	q6441269.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	q6441269.exe
Token: SeShutdownPrivilege	3772	shutdown.exe
Token: SeRemoteShutdownPrivilege	3772	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3380	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2108	2680	579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe	86
PID 2680 wrote to memory of 2108	2680	579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe	86
PID 2680 wrote to memory of 2108	2680	579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe	86
PID 2108 wrote to memory of 2744	2108	z7361472.exe	87
PID 2108 wrote to memory of 2744	2108	z7361472.exe	87
PID 2108 wrote to memory of 2744	2108	z7361472.exe	87
PID 2744 wrote to memory of 1424	2744	z9932384.exe	88
PID 2744 wrote to memory of 1424	2744	z9932384.exe	88
PID 2744 wrote to memory of 1424	2744	z9932384.exe	88
PID 1424 wrote to memory of 3804	1424	z8222557.exe	89
PID 1424 wrote to memory of 3804	1424	z8222557.exe	89
PID 1424 wrote to memory of 3804	1424	z8222557.exe	89
PID 3804 wrote to memory of 2664	3804	z3594892.exe	90
PID 3804 wrote to memory of 2664	3804	z3594892.exe	90
PID 3804 wrote to memory of 3380	3804	z3594892.exe	100
PID 3804 wrote to memory of 3380	3804	z3594892.exe	100
PID 3804 wrote to memory of 3380	3804	z3594892.exe	100
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 3380 wrote to memory of 2424	3380	r1252636.exe	102
PID 1424 wrote to memory of 4812	1424	z8222557.exe	112
PID 1424 wrote to memory of 4812	1424	z8222557.exe	112
PID 1424 wrote to memory of 4812	1424	z8222557.exe	112
PID 4812 wrote to memory of 3696	4812	s8244108.exe	114
PID 4812 wrote to memory of 3696	4812	s8244108.exe	114
PID 4812 wrote to memory of 3696	4812	s8244108.exe	114
PID 4812 wrote to memory of 4212	4812	s8244108.exe	115
PID 4812 wrote to memory of 4212	4812	s8244108.exe	115
PID 4812 wrote to memory of 4212	4812	s8244108.exe	115
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 4812 wrote to memory of 1784	4812	s8244108.exe	116
PID 2744 wrote to memory of 4924	2744	z9932384.exe	119
PID 2744 wrote to memory of 4924	2744	z9932384.exe	119
PID 2744 wrote to memory of 4924	2744	z9932384.exe	119
PID 4924 wrote to memory of 4912	4924	t8457021.exe	121
PID 4924 wrote to memory of 4912	4924	t8457021.exe	121
PID 4924 wrote to memory of 4912	4924	t8457021.exe	121
PID 2108 wrote to memory of 932	2108	z7361472.exe	122
PID 2108 wrote to memory of 932	2108	z7361472.exe	122
PID 2108 wrote to memory of 932	2108	z7361472.exe	122
PID 4912 wrote to memory of 4084	4912	explothe.exe	123
PID 4912 wrote to memory of 4084	4912	explothe.exe	123
PID 4912 wrote to memory of 4084	4912	explothe.exe	123
PID 932 wrote to memory of 4664	932	u6525598.exe	124
PID 932 wrote to memory of 4664	932	u6525598.exe	124
PID 932 wrote to memory of 4664	932	u6525598.exe	124
PID 4912 wrote to memory of 2932	4912	explothe.exe	127
PID 4912 wrote to memory of 2932	4912	explothe.exe	127
PID 4912 wrote to memory of 2932	4912	explothe.exe	127
PID 2932 wrote to memory of 2188	2932	cmd.exe	129
PID 2932 wrote to memory of 2188	2932	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe
"C:\Users\Admin\AppData\Local\Temp\579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7361472.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7361472.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9932384.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9932384.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8222557.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8222557.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3594892.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3594892.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6441269.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6441269.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1252636.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1252636.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 560
        8⤵
        Program crash
        
        PID:1596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 152
        7⤵
        Program crash
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8244108.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8244108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4812
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3696
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4212
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 588
        6⤵
        Program crash
        
        PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8457021.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8457021.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4084
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:3384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6525598.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6525598.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
      4⤵
      PID:4664
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -s -t 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3380 -ip 3380
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2424 -ip 2424
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4812 -ip 4812
1⤵
PID:3668

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7361472.exe

Filesize
892KB

MD5
e38936473b046a44bd9dc5778701dd1f

SHA1
d7b04750b6773e74548c08f569002a4033d0f3f3

SHA256
bb5c466cdddfa8f3607f8d223d3c423b9a77ecdbb1b17ea4ede36cd09f89effb

SHA512
a30ca51d00ce09fe06cd0adfcaf8f19e46fdbc79fa4de5ec2a039afed7814eaa768dee72ccff57eaefba399e813f8836c3c5fd6ca06d950a3f9b42fad9fa75df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7361472.exe

Filesize
892KB

MD5
e38936473b046a44bd9dc5778701dd1f

SHA1
d7b04750b6773e74548c08f569002a4033d0f3f3

SHA256
bb5c466cdddfa8f3607f8d223d3c423b9a77ecdbb1b17ea4ede36cd09f89effb

SHA512
a30ca51d00ce09fe06cd0adfcaf8f19e46fdbc79fa4de5ec2a039afed7814eaa768dee72ccff57eaefba399e813f8836c3c5fd6ca06d950a3f9b42fad9fa75df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6525598.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6525598.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9932384.exe

Filesize
709KB

MD5
c1dffa2fb18f83ad0f82a74b363a4dce

SHA1
1b7bf206407f7e5e3aabc6ee7ad446b4dc7ca03e

SHA256
fe302c49c3a06ac78b64fa073b0682ec31d290224d9ab8ab6a31bace19d39a75

SHA512
98df32e9b9915d10ac523c4ce2e02bd8c20b47a0dcd990275059b01691e95dead67a306fb6266d757efec78c02f3ae44d2966812348fa5f497a56b84b316594c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9932384.exe

Filesize
709KB

MD5
c1dffa2fb18f83ad0f82a74b363a4dce

SHA1
1b7bf206407f7e5e3aabc6ee7ad446b4dc7ca03e

SHA256
fe302c49c3a06ac78b64fa073b0682ec31d290224d9ab8ab6a31bace19d39a75

SHA512
98df32e9b9915d10ac523c4ce2e02bd8c20b47a0dcd990275059b01691e95dead67a306fb6266d757efec78c02f3ae44d2966812348fa5f497a56b84b316594c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8457021.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8457021.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8222557.exe

Filesize
527KB

MD5
65bb672b25f9a5c7af35733e1b08c16e

SHA1
3db571f3afe391a331c7bc6b42b9dea8a013cf3d

SHA256
4d03964d74aac1cc0459edef9db2550e97259aa8aebd0180b38c61c0e8a5426b

SHA512
111ab05b90fb7af811e5b862dfdc6263f06958499ec847c9d9a8d7899907cfddcb93adaf05157e6c3f850bc8960bb29443710e6bb1d03b6293361a6e0fcc47ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8222557.exe

Filesize
527KB

MD5
65bb672b25f9a5c7af35733e1b08c16e

SHA1
3db571f3afe391a331c7bc6b42b9dea8a013cf3d

SHA256
4d03964d74aac1cc0459edef9db2550e97259aa8aebd0180b38c61c0e8a5426b

SHA512
111ab05b90fb7af811e5b862dfdc6263f06958499ec847c9d9a8d7899907cfddcb93adaf05157e6c3f850bc8960bb29443710e6bb1d03b6293361a6e0fcc47ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8244108.exe

Filesize
310KB

MD5
0760b749447b8065721c74a5fa206161

SHA1
cebaf807a4c0c08486047606b26e7a46ed9430b7

SHA256
fb721a1f18b306c92903de64101a2b0ead4b3e50aedeb64fc281b8bf15dbda3a

SHA512
deccb747fe1828824291fa356c9622108bbbf746d0450b87f0b1cc44280041b5e1047571b7f767d11f6f3ed5d405f98379bbcda0508543af11d97ed22ab08861

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8244108.exe

Filesize
310KB

MD5
0760b749447b8065721c74a5fa206161

SHA1
cebaf807a4c0c08486047606b26e7a46ed9430b7

SHA256
fb721a1f18b306c92903de64101a2b0ead4b3e50aedeb64fc281b8bf15dbda3a

SHA512
deccb747fe1828824291fa356c9622108bbbf746d0450b87f0b1cc44280041b5e1047571b7f767d11f6f3ed5d405f98379bbcda0508543af11d97ed22ab08861

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3594892.exe

Filesize
296KB

MD5
fa3d7feebdaf2b1a59a75e95f3d2d723

SHA1
6d84f624d69f4f7dcc484fe4d71cec0e80f0ca08

SHA256
5c2c29874610646622e0a28bcd2c763fcdd21a4159382434a30818697ed4f765

SHA512
3fd2b528dcab301c26690851414e759049b0d9d2ca5f4a7b8637df8d8c01c7fa868fa2a0a6918f8eda4ab09d2057ad44c1d5b25223026a97c61d7efb33496bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3594892.exe

Filesize
296KB

MD5
fa3d7feebdaf2b1a59a75e95f3d2d723

SHA1
6d84f624d69f4f7dcc484fe4d71cec0e80f0ca08

SHA256
5c2c29874610646622e0a28bcd2c763fcdd21a4159382434a30818697ed4f765

SHA512
3fd2b528dcab301c26690851414e759049b0d9d2ca5f4a7b8637df8d8c01c7fa868fa2a0a6918f8eda4ab09d2057ad44c1d5b25223026a97c61d7efb33496bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6441269.exe

Filesize
11KB

MD5
06a2ecf3fd314e9345f934f7e3c050c3

SHA1
9b7d1ada9399af38eda0bfe101fdf12976b624f9

SHA256
f5075c6fca5071a1eb851f308ebf6bfc812d136fb37a20a956503c8f08509a02

SHA512
b1c0e67d5599ec4a34d273608d7942b6318d568110a7541ef9dca0afb47c5a6d1db7d2daf330a88dcf2f8f2160ca364d8ba9a625425b4bdc74e4481ea360a7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6441269.exe

Filesize
11KB

MD5
06a2ecf3fd314e9345f934f7e3c050c3

SHA1
9b7d1ada9399af38eda0bfe101fdf12976b624f9

SHA256
f5075c6fca5071a1eb851f308ebf6bfc812d136fb37a20a956503c8f08509a02

SHA512
b1c0e67d5599ec4a34d273608d7942b6318d568110a7541ef9dca0afb47c5a6d1db7d2daf330a88dcf2f8f2160ca364d8ba9a625425b4bdc74e4481ea360a7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1252636.exe

Filesize
276KB

MD5
df101493b8998a3bf7fd737e689a1ce4

SHA1
50f1071e194da3ea97532beda86cd72c069bf0b0

SHA256
cadfaeb7ab390f8b7951533c4ad27e6d7452a58b60f5c09bc25596f29b24617f

SHA512
7b99ab8516900af7442f7230a204ea4cc6ffc50504d2b362709d26d1b7e3cc598c6cf95c483e2ae46263d67683b3bcb1dee2478516b3b39998366202d64b4d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1252636.exe

Filesize
276KB

MD5
df101493b8998a3bf7fd737e689a1ce4

SHA1
50f1071e194da3ea97532beda86cd72c069bf0b0

SHA256
cadfaeb7ab390f8b7951533c4ad27e6d7452a58b60f5c09bc25596f29b24617f

SHA512
7b99ab8516900af7442f7230a204ea4cc6ffc50504d2b362709d26d1b7e3cc598c6cf95c483e2ae46263d67683b3bcb1dee2478516b3b39998366202d64b4d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
memory/1784-58-0x00000000051C0000-0x00000000051C6000-memory.dmp

Filesize
24KB

Download
memory/1784-69-0x000000000AD30000-0x000000000B348000-memory.dmp

Filesize
6.1MB

Download
memory/1784-52-0x0000000073B20000-0x00000000742D0000-memory.dmp

Filesize
7.7MB

Download
memory/1784-74-0x0000000073B20000-0x00000000742D0000-memory.dmp

Filesize
7.7MB

Download
memory/1784-72-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/1784-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1784-73-0x000000000A740000-0x000000000A752000-memory.dmp

Filesize
72KB

Download
memory/1784-71-0x000000000A820000-0x000000000A92A000-memory.dmp

Filesize
1.0MB

Download
memory/1784-70-0x0000000073B20000-0x00000000742D0000-memory.dmp

Filesize
7.7MB

Download
memory/2424-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2424-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2424-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2424-47-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2664-35-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/2664-36-0x00007FFE241F0000-0x00007FFE24CB1000-memory.dmp

Filesize
10.8MB

Download
memory/2664-37-0x00007FFE241F0000-0x00007FFE24CB1000-memory.dmp

Filesize
10.8MB

Download
memory/2664-39-0x00007FFE241F0000-0x00007FFE24CB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads