amadey | 3b401ad80c730dfddfef80d2892eff11976d6119a826d38c6385ed92538116ae

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
Size

1.0MB
MD5

0830a724de65918814ae5e69e8171d85
SHA1

1dc88bdfbba7407a92247b39eddffc9a23c4942c
SHA256

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54
SHA512

d3ddc185ec31b7bcbf2107073179d1c8b3078a9355b73d51916ec40b8e1fbde3ca984fcd5002f5724c2d6f5769b5a78c75327c1e86a79c5933cf7d1353e067ac
SSDEEP

24576:hyWeOkP/BrZbCTONNVDiug53DxeUNH5Rcod:UX7hrX3dg53DES

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2296-40-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2296-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2296-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2296-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4652-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

t9526289.exeexplonde.exeu2476647.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	t9526289.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	u2476647.exe

Executes dropped EXE 13 IoCs

Processes:

z6001529.exez4836897.exez9605534.exez4334399.exeq3010868.exer9086790.exes5008759.exet9526289.exeexplonde.exeu2476647.exew5738307.exeexplonde.exeexplonde.exe

pid	process
4436	z6001529.exe
2848	z4836897.exe
4932	z9605534.exe
1580	z4334399.exe
2212	q3010868.exe
3928	r9086790.exe
1088	s5008759.exe
2376	t9526289.exe
4384	explonde.exe
1404	u2476647.exe
3476	w5738307.exe
4860	explonde.exe
3296	explonde.exe

Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1968 rundll32.exe
1720 rundll32.exe

pid	process
1968	rundll32.exe
1720	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exez6001529.exez4836897.exez9605534.exez4334399.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6001529.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z4836897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z9605534.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z4334399.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

q3010868.exer9086790.exes5008759.exe

description	pid	process	target process
PID 2212 set thread context of 4652	2212	q3010868.exe	AppLaunch.exe
PID 3928 set thread context of 2296	3928	r9086790.exe	AppLaunch.exe
PID 1088 set thread context of 212	1088	s5008759.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4752	2212	WerFault.exe	q3010868.exe
1444	3928	WerFault.exe	r9086790.exe
2464	2296	WerFault.exe	AppLaunch.exe
4640	1088	WerFault.exe	s5008759.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4016 schtasks.exe
3844 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

4652 AppLaunch.exe
4652 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4652 AppLaunch.exe

pid	process
4016	schtasks.exe
3844	schtasks.exe

pid	process
4652	AppLaunch.exe
4652	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4652	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exez6001529.exez4836897.exez9605534.exez4334399.exeq3010868.exer9086790.exes5008759.exet9526289.exeexplonde.exe

description	pid	process	target process
PID 2640 wrote to memory of 4436	2640	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2640 wrote to memory of 4436	2640	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2640 wrote to memory of 4436	2640	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 4436 wrote to memory of 2848	4436	z6001529.exe	z4836897.exe
PID 4436 wrote to memory of 2848	4436	z6001529.exe	z4836897.exe
PID 4436 wrote to memory of 2848	4436	z6001529.exe	z4836897.exe
PID 2848 wrote to memory of 4932	2848	z4836897.exe	z9605534.exe
PID 2848 wrote to memory of 4932	2848	z4836897.exe	z9605534.exe
PID 2848 wrote to memory of 4932	2848	z4836897.exe	z9605534.exe
PID 4932 wrote to memory of 1580	4932	z9605534.exe	z4334399.exe
PID 4932 wrote to memory of 1580	4932	z9605534.exe	z4334399.exe
PID 4932 wrote to memory of 1580	4932	z9605534.exe	z4334399.exe
PID 1580 wrote to memory of 2212	1580	z4334399.exe	q3010868.exe
PID 1580 wrote to memory of 2212	1580	z4334399.exe	q3010868.exe
PID 1580 wrote to memory of 2212	1580	z4334399.exe	q3010868.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 2212 wrote to memory of 4652	2212	q3010868.exe	AppLaunch.exe
PID 1580 wrote to memory of 3928	1580	z4334399.exe	r9086790.exe
PID 1580 wrote to memory of 3928	1580	z4334399.exe	r9086790.exe
PID 1580 wrote to memory of 3928	1580	z4334399.exe	r9086790.exe
PID 3928 wrote to memory of 1716	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 1716	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 1716	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 3928 wrote to memory of 2296	3928	r9086790.exe	AppLaunch.exe
PID 4932 wrote to memory of 1088	4932	z9605534.exe	s5008759.exe
PID 4932 wrote to memory of 1088	4932	z9605534.exe	s5008759.exe
PID 4932 wrote to memory of 1088	4932	z9605534.exe	s5008759.exe
PID 1088 wrote to memory of 4844	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 4844	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 4844	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 1088 wrote to memory of 212	1088	s5008759.exe	AppLaunch.exe
PID 2848 wrote to memory of 2376	2848	z4836897.exe	t9526289.exe
PID 2848 wrote to memory of 2376	2848	z4836897.exe	t9526289.exe
PID 2848 wrote to memory of 2376	2848	z4836897.exe	t9526289.exe
PID 2376 wrote to memory of 4384	2376	t9526289.exe	explonde.exe
PID 2376 wrote to memory of 4384	2376	t9526289.exe	explonde.exe
PID 2376 wrote to memory of 4384	2376	t9526289.exe	explonde.exe
PID 4436 wrote to memory of 1404	4436	z6001529.exe	u2476647.exe
PID 4436 wrote to memory of 1404	4436	z6001529.exe	u2476647.exe
PID 4436 wrote to memory of 1404	4436	z6001529.exe	u2476647.exe
PID 4384 wrote to memory of 4016	4384	explonde.exe	schtasks.exe
PID 4384 wrote to memory of 4016	4384	explonde.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
"C:\Users\Admin\AppData\Local\Temp\bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4436

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2848

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 140
7⤵
- Program crash
PID:4752

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9086790.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9086790.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:1716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 540
8⤵
- Program crash
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 584
7⤵
- Program crash
PID:1444

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5008759.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5008759.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 152
6⤵
- Program crash
PID:4640

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9526289.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9526289.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
6⤵
- Creates scheduled task(s)
PID:4016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
6⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:944

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:N"
7⤵
PID:3828

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:R" /E
7⤵
PID:4508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2300

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
7⤵
PID:4420

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
7⤵
PID:4892

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
6⤵
- Loads dropped DLL
PID:1968

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2476647.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2476647.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:1404

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
4⤵
PID:4528

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
5⤵
- Creates scheduled task(s)
PID:3844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
5⤵
PID:3424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:3704

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
6⤵
PID:3388

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
6⤵
PID:3428

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
6⤵
PID:3292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:3768

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
6⤵
PID:4152

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:1720

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5738307.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5738307.exe
2⤵
- Executes dropped EXE
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2212 -ip 2212
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3928 -ip 3928
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2296 -ip 2296
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1088 -ip 1088
1⤵
PID:4764

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3296

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5738307.exe
Filesize
22KB

MD5
70f5464e4c3e00340d8e9065002fad00

SHA1
91d750a5af20d7e22bcecfb78cc2f7664bdacb50

SHA256
095c2c38caeddda798517efe564c8c5de7a0f2f16064543db13fba5d49bf1ddc

SHA512
824b9cd6a84d860db182adb8bd8c85adf3cd0f858fdcac903ef0c98ed1ac246d2e9b0ecbdeb542c5572b8b1ce841ee17bc28a6c3336c9daab5c16be8659f37dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5738307.exe
Filesize
22KB

MD5
70f5464e4c3e00340d8e9065002fad00

SHA1
91d750a5af20d7e22bcecfb78cc2f7664bdacb50

SHA256
095c2c38caeddda798517efe564c8c5de7a0f2f16064543db13fba5d49bf1ddc

SHA512
824b9cd6a84d860db182adb8bd8c85adf3cd0f858fdcac903ef0c98ed1ac246d2e9b0ecbdeb542c5572b8b1ce841ee17bc28a6c3336c9daab5c16be8659f37dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
Filesize
964KB

MD5
566881171ec1ec419c79362e572c6058

SHA1
c9980837edc2ec9bd281821001e6d57f22440653

SHA256
42d27c5bd52cb9b2e961b412ca32cd139f78eed11e2530fc20532bc16628c999

SHA512
4caf51e3cd1c10274ac541184da1dbff57bce1e06e15a2f9d2f240b3f322bf969d5e4b84c93ad30f1e80f0dd9c27de1e32ec77782d7f8a8d722091aca0976ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
Filesize
964KB

MD5
566881171ec1ec419c79362e572c6058

SHA1
c9980837edc2ec9bd281821001e6d57f22440653

SHA256
42d27c5bd52cb9b2e961b412ca32cd139f78eed11e2530fc20532bc16628c999

SHA512
4caf51e3cd1c10274ac541184da1dbff57bce1e06e15a2f9d2f240b3f322bf969d5e4b84c93ad30f1e80f0dd9c27de1e32ec77782d7f8a8d722091aca0976ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2476647.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
Filesize
781KB

MD5
66e4aac9c8943115b249d782b4fadf2e

SHA1
1fa309b00f9049453f6974531fbc5d95c4df46c1

SHA256
2201afb22012e38a428f8377b34e9b231c9403fdc782b49bb7835fe74596e270

SHA512
5d05f8aafa5029d33986c318a706ac7d13dd524366e6c6c753728a49d94fe383ff54ba0f0b30fb2c67eead88298b9c4b4a410f66853b389214ad20401a5dc912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
Filesize
781KB

MD5
66e4aac9c8943115b249d782b4fadf2e

SHA1
1fa309b00f9049453f6974531fbc5d95c4df46c1

SHA256
2201afb22012e38a428f8377b34e9b231c9403fdc782b49bb7835fe74596e270

SHA512
5d05f8aafa5029d33986c318a706ac7d13dd524366e6c6c753728a49d94fe383ff54ba0f0b30fb2c67eead88298b9c4b4a410f66853b389214ad20401a5dc912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9526289.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9526289.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
Filesize
599KB

MD5
0ae3013a7ffffcb1d414af2da402ea49

SHA1
0fbf6b8cf49a0e97d773feb6010755b135ea7e96

SHA256
a018677628ccc618cb6eec53470890663b280b294e93f159dc2357ee56fa90ea

SHA512
482ef4b87907313c398ce4296ac9017c91d206eca0ea2456a81ca6fdb93ac8c66fe719c4e6782f910ee5cd07849f09deeecc695971bec0aa58c4179c31ecba83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
Filesize
599KB

MD5
0ae3013a7ffffcb1d414af2da402ea49

SHA1
0fbf6b8cf49a0e97d773feb6010755b135ea7e96

SHA256
a018677628ccc618cb6eec53470890663b280b294e93f159dc2357ee56fa90ea

SHA512
482ef4b87907313c398ce4296ac9017c91d206eca0ea2456a81ca6fdb93ac8c66fe719c4e6782f910ee5cd07849f09deeecc695971bec0aa58c4179c31ecba83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5008759.exe
Filesize
380KB

MD5
c2e23c6c66a9ccd021779623011c5e8e

SHA1
32b4d683e4e800c87d2e2bb691db808e78ec85cf

SHA256
02cdaf77c42119aca23b5e43128b7608302bfbc94dffd2ee839fcf9f143118c5

SHA512
8adafbb0504b255505a31efab812e1229b28982f52fc60f1edb323720c4471edf18684477b3cb192bd86390f7ad3049194dca7493c33f4b1d5ad82a03a1132ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5008759.exe
Filesize
380KB

MD5
c2e23c6c66a9ccd021779623011c5e8e

SHA1
32b4d683e4e800c87d2e2bb691db808e78ec85cf

SHA256
02cdaf77c42119aca23b5e43128b7608302bfbc94dffd2ee839fcf9f143118c5

SHA512
8adafbb0504b255505a31efab812e1229b28982f52fc60f1edb323720c4471edf18684477b3cb192bd86390f7ad3049194dca7493c33f4b1d5ad82a03a1132ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
Filesize
336KB

MD5
46d638cf61e11b7df691f532014709eb

SHA1
db3563060af1992f2a89d08446d22d5853f96359

SHA256
f56104c1cb3f82ddfdf842786e73ce332f6ba72d1f332d79f47e889abd59c6e3

SHA512
ed00fe7ffc2015062c2e824ef0b18c9534f2630a537ec42fe67e27dd1ac5749f4aed1c435ba193cbde2ab33cbcc8fc06a8687a7742fb677aeba32a50209eb11a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
Filesize
336KB

MD5
46d638cf61e11b7df691f532014709eb

SHA1
db3563060af1992f2a89d08446d22d5853f96359

SHA256
f56104c1cb3f82ddfdf842786e73ce332f6ba72d1f332d79f47e889abd59c6e3

SHA512
ed00fe7ffc2015062c2e824ef0b18c9534f2630a537ec42fe67e27dd1ac5749f4aed1c435ba193cbde2ab33cbcc8fc06a8687a7742fb677aeba32a50209eb11a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9086790.exe
Filesize
346KB

MD5
b5e8059b012b542e94cb04d6d5b46bdf

SHA1
92ee83e532f4046f3e4a9f91a572c4eaba47d273

SHA256
1692a92b27a97da50b0d9dccc3e3243e02f467c27601f30243f22394c8446279

SHA512
5bc89898c815a1b1edb6aa6a006fe5f0dd694e52908b2459db7062c5ea4d01d05d6322d8a149ba06f988274f1187a1cd139bae2bbe05566b2c861f1179ffb57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9086790.exe
Filesize
346KB

MD5
b5e8059b012b542e94cb04d6d5b46bdf

SHA1
92ee83e532f4046f3e4a9f91a572c4eaba47d273

SHA256
1692a92b27a97da50b0d9dccc3e3243e02f467c27601f30243f22394c8446279

SHA512
5bc89898c815a1b1edb6aa6a006fe5f0dd694e52908b2459db7062c5ea4d01d05d6322d8a149ba06f988274f1187a1cd139bae2bbe05566b2c861f1179ffb57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/212-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/212-57-0x00000000052A0000-0x00000000052B2000-memory.dmp

Filesize
72KB

Download
memory/212-69-0x00000000742B0000-0x0000000074A60000-memory.dmp

Filesize
7.7MB

Download
memory/212-63-0x0000000005340000-0x000000000537C000-memory.dmp

Filesize
240KB

Download
memory/212-51-0x0000000005920000-0x0000000005F38000-memory.dmp

Filesize
6.1MB

Download
memory/212-54-0x0000000005410000-0x000000000551A000-memory.dmp

Filesize
1.0MB

Download
memory/212-64-0x0000000005380000-0x00000000053CC000-memory.dmp

Filesize
304KB

Download
memory/212-49-0x0000000005250000-0x0000000005256000-memory.dmp

Filesize
24KB

Download
memory/212-80-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/212-56-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/212-50-0x00000000742B0000-0x0000000074A60000-memory.dmp

Filesize
7.7MB

Download
memory/2296-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4652-36-0x00000000742B0000-0x0000000074A60000-memory.dmp

Filesize
7.7MB

Download
memory/4652-55-0x00000000742B0000-0x0000000074A60000-memory.dmp

Filesize
7.7MB

Download
memory/4652-52-0x00000000742B0000-0x0000000074A60000-memory.dmp

Filesize
7.7MB

Download
memory/4652-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download