amadey | fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90

Analysis

max time kernel
152s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe
Size

994KB
MD5

377ed6988bf4050b701fbc6118cc19ec
SHA1

6516efa34a64861d3dbc1b0b9db4f42d081c2528
SHA256

fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90
SHA512

771c517f4b754cc1fdac4add8ef40494d0ceef69f6b7fe667089b0e09dbc1930283c4100ae9e4f8a5f29b026d250e01b72357e55e41d0dfed6563a772cdfa4d4
SSDEEP

24576:1yXMmjNjnmtJOONx7MOH2onMMm/QD58kE3h:QXMsNjnS4Y7TWkMMm/Iy/3

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3052-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3052-43-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3052-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3052-46-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231c5-33.dat	healer
behavioral2/files/0x00080000000231c5-34.dat	healer
behavioral2/memory/5040-35-0x00000000009E0000-0x00000000009EA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q1529595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q1529595.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q1529595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q1529595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q1529595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q1529595.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	t7944559.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	u9928137.exe

Executes dropped EXE 14 IoCs

pid	Process
2264	z1101304.exe
1232	z5749368.exe
1636	z7803993.exe
2568	z3509958.exe
5040	q1529595.exe
4556	r7148277.exe
3736	s6222964.exe
4312	t7944559.exe
2300	explothe.exe
3564	u9928137.exe
2112	legota.exe
1644	w2149483.exe
3804	explothe.exe
3136	legota.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q1529595.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z3509958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1101304.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5749368.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z7803993.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 3052	4556	r7148277.exe	104
PID 3736 set thread context of 1544	3736	s6222964.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2244	3052	WerFault.exe	104
496	4556	WerFault.exe	102
4288	3736	WerFault.exe	113

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3388	schtasks.exe
1088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	q1529595.exe
5040	q1529595.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	q1529595.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2264	3908	fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe	86
PID 3908 wrote to memory of 2264	3908	fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe	86
PID 3908 wrote to memory of 2264	3908	fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe	86
PID 2264 wrote to memory of 1232	2264	z1101304.exe	88
PID 2264 wrote to memory of 1232	2264	z1101304.exe	88
PID 2264 wrote to memory of 1232	2264	z1101304.exe	88
PID 1232 wrote to memory of 1636	1232	z5749368.exe	89
PID 1232 wrote to memory of 1636	1232	z5749368.exe	89
PID 1232 wrote to memory of 1636	1232	z5749368.exe	89
PID 1636 wrote to memory of 2568	1636	z7803993.exe	91
PID 1636 wrote to memory of 2568	1636	z7803993.exe	91
PID 1636 wrote to memory of 2568	1636	z7803993.exe	91
PID 2568 wrote to memory of 5040	2568	z3509958.exe	92
PID 2568 wrote to memory of 5040	2568	z3509958.exe	92
PID 2568 wrote to memory of 4556	2568	z3509958.exe	102
PID 2568 wrote to memory of 4556	2568	z3509958.exe	102
PID 2568 wrote to memory of 4556	2568	z3509958.exe	102
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 4556 wrote to memory of 3052	4556	r7148277.exe	104
PID 1636 wrote to memory of 3736	1636	z7803993.exe	113
PID 1636 wrote to memory of 3736	1636	z7803993.exe	113
PID 1636 wrote to memory of 3736	1636	z7803993.exe	113
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 3736 wrote to memory of 1544	3736	s6222964.exe	115
PID 1232 wrote to memory of 4312	1232	z5749368.exe	118
PID 1232 wrote to memory of 4312	1232	z5749368.exe	118
PID 1232 wrote to memory of 4312	1232	z5749368.exe	118
PID 4312 wrote to memory of 2300	4312	t7944559.exe	119
PID 4312 wrote to memory of 2300	4312	t7944559.exe	119
PID 4312 wrote to memory of 2300	4312	t7944559.exe	119
PID 2264 wrote to memory of 3564	2264	z1101304.exe	120
PID 2264 wrote to memory of 3564	2264	z1101304.exe	120
PID 2264 wrote to memory of 3564	2264	z1101304.exe	120
PID 2300 wrote to memory of 3388	2300	explothe.exe	121
PID 2300 wrote to memory of 3388	2300	explothe.exe	121
PID 2300 wrote to memory of 3388	2300	explothe.exe	121
PID 2300 wrote to memory of 4640	2300	explothe.exe	123
PID 2300 wrote to memory of 4640	2300	explothe.exe	123
PID 2300 wrote to memory of 4640	2300	explothe.exe	123
PID 4640 wrote to memory of 1476	4640	cmd.exe	125
PID 4640 wrote to memory of 1476	4640	cmd.exe	125
PID 4640 wrote to memory of 1476	4640	cmd.exe	125
PID 4640 wrote to memory of 3796	4640	cmd.exe	126
PID 4640 wrote to memory of 3796	4640	cmd.exe	126
PID 4640 wrote to memory of 3796	4640	cmd.exe	126
PID 3564 wrote to memory of 2112	3564	u9928137.exe	127
PID 3564 wrote to memory of 2112	3564	u9928137.exe	127
PID 3564 wrote to memory of 2112	3564	u9928137.exe	127
PID 3908 wrote to memory of 1644	3908	fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe	128
PID 3908 wrote to memory of 1644	3908	fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe	128

C:\Users\Admin\AppData\Local\Temp\fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe
"C:\Users\Admin\AppData\Local\Temp\fbaaf142d79893fa37e6660341cd9130ad99d286884dba77eee9ee008a2a1f90.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1101304.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1101304.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5749368.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5749368.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7803993.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7803993.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3509958.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3509958.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1529595.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1529595.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7148277.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7148277.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 540
        8⤵
        Program crash
        
        PID:2244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 584
        7⤵
        Program crash
        
        PID:496
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6222964.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6222964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 152
        6⤵
        Program crash
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7944559.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7944559.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3388
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:4900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9928137.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9928137.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2112
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1088
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:2556
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:3952
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4996
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:3260
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2044
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:212
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:2140
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2149483.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2149483.exe
  2⤵
  - Executes dropped EXE
  PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4556 -ip 4556
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3052 -ip 3052
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3736 -ip 3736
1⤵
PID:4824

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2149483.exe

Filesize
23KB

MD5
5f743f5d6f83702752d94a3235908fec

SHA1
b8b723c7a71753d4ccd95123283e39efe3cae202

SHA256
bcf59b82c856523563a7323cd9d08614743355066615c94cc6d8f91fe3bf7634

SHA512
59e7a97eb293b5f52ed04d3bfc7a2dd3833c4676573d2e599fb44bedace2adb7da516a4e86b3fbf373b415129c49553fcdf236eac3c77c22648f4df1f9d14d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2149483.exe

Filesize
23KB

MD5
5f743f5d6f83702752d94a3235908fec

SHA1
b8b723c7a71753d4ccd95123283e39efe3cae202

SHA256
bcf59b82c856523563a7323cd9d08614743355066615c94cc6d8f91fe3bf7634

SHA512
59e7a97eb293b5f52ed04d3bfc7a2dd3833c4676573d2e599fb44bedace2adb7da516a4e86b3fbf373b415129c49553fcdf236eac3c77c22648f4df1f9d14d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1101304.exe

Filesize
892KB

MD5
0f6fb44ed64d409e7b22681d6eccf35a

SHA1
cddf8832797d0b86899200dc78e8b3bd628cb824

SHA256
ea0ee31c7040738ad083db91f618126aaa7d8aec67197d94e68ffa6ae6b40689

SHA512
46eb171de3ef09f49bc52ccec01dbd0491d6dc55e2e83bbcbf034ab5a61ae657cee348258f77f77d05f66fc5b7901a10717a88daf4705c217303dafb0ad93b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1101304.exe

Filesize
892KB

MD5
0f6fb44ed64d409e7b22681d6eccf35a

SHA1
cddf8832797d0b86899200dc78e8b3bd628cb824

SHA256
ea0ee31c7040738ad083db91f618126aaa7d8aec67197d94e68ffa6ae6b40689

SHA512
46eb171de3ef09f49bc52ccec01dbd0491d6dc55e2e83bbcbf034ab5a61ae657cee348258f77f77d05f66fc5b7901a10717a88daf4705c217303dafb0ad93b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9928137.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9928137.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5749368.exe

Filesize
709KB

MD5
24ecc57390242b77f453882f38f388b6

SHA1
3bdfa84d6aeaf6b4ebb3425504765acf67b424e8

SHA256
6cc87071e2158312085c87c31b8272178f5e2c27da57b755fb2c7e05fc6daf1a

SHA512
7c1ba2c26cbf70f12afdfa505d12a66d33a0631c1e2aa99849636952641c30193bd3c7005d3989d623d476661fc48f3b69d87384dcf6d0e76926fd457b1ebc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5749368.exe

Filesize
709KB

MD5
24ecc57390242b77f453882f38f388b6

SHA1
3bdfa84d6aeaf6b4ebb3425504765acf67b424e8

SHA256
6cc87071e2158312085c87c31b8272178f5e2c27da57b755fb2c7e05fc6daf1a

SHA512
7c1ba2c26cbf70f12afdfa505d12a66d33a0631c1e2aa99849636952641c30193bd3c7005d3989d623d476661fc48f3b69d87384dcf6d0e76926fd457b1ebc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7944559.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7944559.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7803993.exe

Filesize
527KB

MD5
6b2d990dc07cf8c2e172d03474b23404

SHA1
73ccd488cf1b5466f62bf3c27e131ed3bc902cb3

SHA256
c87129f6e0a615abd35be86ef6cdcd066865311e5802d20d264c6db19a50dc4d

SHA512
d845b76f67d715da8d80ce20dc4ff38600c6c31667aa1cc4a14589e155edd728b6e11ded4c7c5f3585a0ce5628d171d41abf4632bf87e54a4183c2d7d6c35f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7803993.exe

Filesize
527KB

MD5
6b2d990dc07cf8c2e172d03474b23404

SHA1
73ccd488cf1b5466f62bf3c27e131ed3bc902cb3

SHA256
c87129f6e0a615abd35be86ef6cdcd066865311e5802d20d264c6db19a50dc4d

SHA512
d845b76f67d715da8d80ce20dc4ff38600c6c31667aa1cc4a14589e155edd728b6e11ded4c7c5f3585a0ce5628d171d41abf4632bf87e54a4183c2d7d6c35f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6222964.exe

Filesize
310KB

MD5
861e8d2170e82fecd19492b63bbd5fa6

SHA1
84d9dbbaf992ff23c31dac2165ef39ca3eadf8db

SHA256
47859ee9e62478aab82cea2f583dc924fddadf52bbe9f17eb068a24928fd0d60

SHA512
798a5fb3d5cebd7fa9336c4d4027f00862a2adab24924e65024f4898a4e423dfcced124ce556ea823f9079ac9ba0fcc0c6b1ca29c98884c764626bfefaa2e29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6222964.exe

Filesize
310KB

MD5
861e8d2170e82fecd19492b63bbd5fa6

SHA1
84d9dbbaf992ff23c31dac2165ef39ca3eadf8db

SHA256
47859ee9e62478aab82cea2f583dc924fddadf52bbe9f17eb068a24928fd0d60

SHA512
798a5fb3d5cebd7fa9336c4d4027f00862a2adab24924e65024f4898a4e423dfcced124ce556ea823f9079ac9ba0fcc0c6b1ca29c98884c764626bfefaa2e29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3509958.exe

Filesize
296KB

MD5
895409a60865c8ae2567dd6f6c08ed57

SHA1
bbc2fa3424e906ff91c494ef9e52aceec99f8cfa

SHA256
08c84a534fb485e46eacd8061ba866d4dc2aba36d34f70a33c842818cdee8ee5

SHA512
d127d51044d283f49850f86cb52910c7bc6c776ecc5e9654dccbc05151c6e7fc109ac4e3f60a7d843fb9fd94d448692b6a49a841bac5b6fbf8bd85b8dd0b779e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3509958.exe

Filesize
296KB

MD5
895409a60865c8ae2567dd6f6c08ed57

SHA1
bbc2fa3424e906ff91c494ef9e52aceec99f8cfa

SHA256
08c84a534fb485e46eacd8061ba866d4dc2aba36d34f70a33c842818cdee8ee5

SHA512
d127d51044d283f49850f86cb52910c7bc6c776ecc5e9654dccbc05151c6e7fc109ac4e3f60a7d843fb9fd94d448692b6a49a841bac5b6fbf8bd85b8dd0b779e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1529595.exe

Filesize
11KB

MD5
417bf355ff406c10fd30628dc9629590

SHA1
2679d7839e4e361ea016e99e453b981002dc2d71

SHA256
9eea16179fbb0add20846370c57fc4973b3f6726983712d8314df208527b6b9b

SHA512
da8d590bb3a786087512aa99ed2e081aac67780b6b5e14a03e13dee3a2f59f23c8b21617b9ce961bfed5644626b433fbd8ceb4965a1e5e796113c1a8473bf966

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1529595.exe

Filesize
11KB

MD5
417bf355ff406c10fd30628dc9629590

SHA1
2679d7839e4e361ea016e99e453b981002dc2d71

SHA256
9eea16179fbb0add20846370c57fc4973b3f6726983712d8314df208527b6b9b

SHA512
da8d590bb3a786087512aa99ed2e081aac67780b6b5e14a03e13dee3a2f59f23c8b21617b9ce961bfed5644626b433fbd8ceb4965a1e5e796113c1a8473bf966

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7148277.exe

Filesize
276KB

MD5
4186d77c96511ae22ef295132a469f08

SHA1
da0498d6bc8ae72ba77910879523e47875e6a9bf

SHA256
28c41fcf920a949921c7c6c43195b9bc38c60eec39c4a156fd704c6c33a43caa

SHA512
e0f4104b538089e7fc8ecc818681a2adbf615c2ac0be2be9fb1ba3c1718037da69ded59a894a1a5252400f938fb742deef30bad07d29f95d737f0e8d67b833a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7148277.exe

Filesize
276KB

MD5
4186d77c96511ae22ef295132a469f08

SHA1
da0498d6bc8ae72ba77910879523e47875e6a9bf

SHA256
28c41fcf920a949921c7c6c43195b9bc38c60eec39c4a156fd704c6c33a43caa

SHA512
e0f4104b538089e7fc8ecc818681a2adbf615c2ac0be2be9fb1ba3c1718037da69ded59a894a1a5252400f938fb742deef30bad07d29f95d737f0e8d67b833a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
memory/1544-69-0x0000000005570000-0x00000000055AC000-memory.dmp

Filesize
240KB

Download
memory/1544-75-0x00000000055D0000-0x000000000561C000-memory.dmp

Filesize
304KB

Download
memory/1544-65-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/1544-63-0x00000000056D0000-0x00000000057DA000-memory.dmp

Filesize
1.0MB

Download
memory/1544-58-0x0000000005BE0000-0x00000000061F8000-memory.dmp

Filesize
6.1MB

Download
memory/1544-52-0x00000000054C0000-0x00000000054C6000-memory.dmp

Filesize
24KB

Download
memory/1544-51-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/1544-50-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1544-87-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/1544-64-0x0000000005510000-0x0000000005522000-memory.dmp

Filesize
72KB

Download
memory/1544-82-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/3052-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-46-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5040-40-0x00007FF909E10000-0x00007FF90A8D1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-36-0x00007FF909E10000-0x00007FF90A8D1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-35-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download