amadey | 299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe
Size

1.3MB
MD5

22cc73a3a0e21b199b8b3bdf37308aa7
SHA1

723f97ee9efafc36fcaca0f1b1d05e5153575054
SHA256

299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052
SHA512

71e7e4d452941423362048ba4ebcb5fe2ffb427908fba8ecbea85d843f3a63afd0f05cf8b45925d851e4ad652336ccc455c8ee2a5b5cba806483ed516cc1c554
SSDEEP

24576:Iylxrjf9cldlhzl2HnfvEUOihzVnKPYGyHrA7QD/pQyTT0fkoxcYomKfxv7Lj/d:Plx3fm5hzq3EXihhKglA7QDLIso297vr

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3928-43-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3928-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3928-45-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3928-47-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/1724-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	t5459958.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	u9922392.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 14 IoCs

pid	Process
3216	z4912447.exe
3744	z7461306.exe
4608	z8686361.exe
3680	z4937664.exe
3804	q6105089.exe
2628	r5423647.exe
1992	s1686155.exe
1012	t5459958.exe
4628	explonde.exe
2832	u9922392.exe
2232	legota.exe
1780	w3615851.exe
3340	explonde.exe
2884	legota.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4912447.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7461306.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z8686361.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z4937664.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 1724	3804	q6105089.exe	89
PID 2628 set thread context of 3928	2628	r5423647.exe	95
PID 1992 set thread context of 1324	1992	s1686155.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
224	3804	WerFault.exe	87
972	2628	WerFault.exe	93
3368	3928	WerFault.exe	95
1432	1992	WerFault.exe	100

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1872	schtasks.exe
4540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	AppLaunch.exe
1724	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3216	4524	299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe	83
PID 4524 wrote to memory of 3216	4524	299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe	83
PID 4524 wrote to memory of 3216	4524	299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe	83
PID 3216 wrote to memory of 3744	3216	z4912447.exe	84
PID 3216 wrote to memory of 3744	3216	z4912447.exe	84
PID 3216 wrote to memory of 3744	3216	z4912447.exe	84
PID 3744 wrote to memory of 4608	3744	z7461306.exe	85
PID 3744 wrote to memory of 4608	3744	z7461306.exe	85
PID 3744 wrote to memory of 4608	3744	z7461306.exe	85
PID 4608 wrote to memory of 3680	4608	z8686361.exe	86
PID 4608 wrote to memory of 3680	4608	z8686361.exe	86
PID 4608 wrote to memory of 3680	4608	z8686361.exe	86
PID 3680 wrote to memory of 3804	3680	z4937664.exe	87
PID 3680 wrote to memory of 3804	3680	z4937664.exe	87
PID 3680 wrote to memory of 3804	3680	z4937664.exe	87
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3804 wrote to memory of 1724	3804	q6105089.exe	89
PID 3680 wrote to memory of 2628	3680	z4937664.exe	93
PID 3680 wrote to memory of 2628	3680	z4937664.exe	93
PID 3680 wrote to memory of 2628	3680	z4937664.exe	93
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 2628 wrote to memory of 3928	2628	r5423647.exe	95
PID 4608 wrote to memory of 1992	4608	z8686361.exe	100
PID 4608 wrote to memory of 1992	4608	z8686361.exe	100
PID 4608 wrote to memory of 1992	4608	z8686361.exe	100
PID 1992 wrote to memory of 1348	1992	s1686155.exe	102
PID 1992 wrote to memory of 1348	1992	s1686155.exe	102
PID 1992 wrote to memory of 1348	1992	s1686155.exe	102
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 1992 wrote to memory of 1324	1992	s1686155.exe	103
PID 3744 wrote to memory of 1012	3744	z7461306.exe	106
PID 3744 wrote to memory of 1012	3744	z7461306.exe	106
PID 3744 wrote to memory of 1012	3744	z7461306.exe	106
PID 1012 wrote to memory of 4628	1012	t5459958.exe	107
PID 1012 wrote to memory of 4628	1012	t5459958.exe	107
PID 1012 wrote to memory of 4628	1012	t5459958.exe	107
PID 3216 wrote to memory of 2832	3216	z4912447.exe	108
PID 3216 wrote to memory of 2832	3216	z4912447.exe	108
PID 3216 wrote to memory of 2832	3216	z4912447.exe	108
PID 4628 wrote to memory of 1872	4628	explonde.exe	109
PID 4628 wrote to memory of 1872	4628	explonde.exe	109
PID 4628 wrote to memory of 1872	4628	explonde.exe	109
PID 2832 wrote to memory of 2232	2832	u9922392.exe	111
PID 2832 wrote to memory of 2232	2832	u9922392.exe	111

C:\Users\Admin\AppData\Local\Temp\299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe
"C:\Users\Admin\AppData\Local\Temp\299c690989c5589957d74d11d7921267bdbde08cb9ffa778764605a51bcc1052.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4912447.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4912447.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7461306.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7461306.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8686361.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8686361.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4937664.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4937664.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6105089.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6105089.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 148
        7⤵
        Program crash
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5423647.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5423647.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 540
        8⤵
        Program crash
        
        PID:3368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 140
        7⤵
        Program crash
        
        PID:972
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1686155.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1686155.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1348
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 584
        6⤵
        Program crash
        
        PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5459958.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5459958.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1872
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:2196
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9922392.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9922392.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2232
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4540
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:1880
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:228
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:4024
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:4792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2392
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:2660
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:1296
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3615851.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3615851.exe
  2⤵
  - Executes dropped EXE
  PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3804 -ip 3804
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2628 -ip 2628
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3928 -ip 3928
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1992 -ip 1992
1⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3615851.exe

Filesize
22KB

MD5
57a2cf539fbbe73b28b0cfc25562a7c7

SHA1
3eb85fc8f32a992c14e61f34c20da7b596daba3b

SHA256
f6a0d1554ef408d3e38cd04b4c4142ef333d90b4287f08fd66ed04fd91aa929f

SHA512
3d60be534176c45a76a8fa3ca1911af14e26570f9c7e0025399cff8e05dd74856b21be2d28e65df4f3088ecc2445219051933c4a3696b8ac3ce29888af3ea949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3615851.exe

Filesize
22KB

MD5
57a2cf539fbbe73b28b0cfc25562a7c7

SHA1
3eb85fc8f32a992c14e61f34c20da7b596daba3b

SHA256
f6a0d1554ef408d3e38cd04b4c4142ef333d90b4287f08fd66ed04fd91aa929f

SHA512
3d60be534176c45a76a8fa3ca1911af14e26570f9c7e0025399cff8e05dd74856b21be2d28e65df4f3088ecc2445219051933c4a3696b8ac3ce29888af3ea949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4912447.exe

Filesize
1.2MB

MD5
0155cccf0cdeed692f3710fd14e29b38

SHA1
ab4e87ebda77410289a4a8a585798248275e056a

SHA256
656cfb316a931d8180d6cd3371595d489af30ac070183472f23caea0fa94a5da

SHA512
090651a8904cc402dc4770bddd9631aeaa8aa349419d679a364ed17831f0138e33c932c5037cc5b5a3e2a5f49254813881cc962306c6eb5d6952b950b660a3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4912447.exe

Filesize
1.2MB

MD5
0155cccf0cdeed692f3710fd14e29b38

SHA1
ab4e87ebda77410289a4a8a585798248275e056a

SHA256
656cfb316a931d8180d6cd3371595d489af30ac070183472f23caea0fa94a5da

SHA512
090651a8904cc402dc4770bddd9631aeaa8aa349419d679a364ed17831f0138e33c932c5037cc5b5a3e2a5f49254813881cc962306c6eb5d6952b950b660a3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9922392.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9922392.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7461306.exe

Filesize
1.1MB

MD5
e49133f13a603249dd5d60a844825659

SHA1
1034ddd146dbccbbaeb4dd165ead35825c665afb

SHA256
d32580a2dd051cef12fff74434a065723892076475ed8f93ae96cf1d959cc38b

SHA512
2a42258dd2154d465f8b00dbff8d83b4c1affd56a9af7bce0154b656a57c2539334492e8800f3fb3afb5c068b8db46bf4a299d2ed460c5abbbaa095ac6d3eb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7461306.exe

Filesize
1.1MB

MD5
e49133f13a603249dd5d60a844825659

SHA1
1034ddd146dbccbbaeb4dd165ead35825c665afb

SHA256
d32580a2dd051cef12fff74434a065723892076475ed8f93ae96cf1d959cc38b

SHA512
2a42258dd2154d465f8b00dbff8d83b4c1affd56a9af7bce0154b656a57c2539334492e8800f3fb3afb5c068b8db46bf4a299d2ed460c5abbbaa095ac6d3eb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5459958.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5459958.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8686361.exe

Filesize
893KB

MD5
5015baa99640350caad0ac2629a1fbc5

SHA1
001ce9ca4e73fcfe2dcb503ae207b06f8a99aa0e

SHA256
66c92110452f7c14b8bc9c2a1fa72ed8139656aef958609d6abf82e9dcedd556

SHA512
c207d3b95321de7057a6477b49c5c26f070a7095c97d35986f691a23afb9ad4d850a0305cd083ca658a13341e77aaa774b267cdd1a9e4abccf0895d5125961cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8686361.exe

Filesize
893KB

MD5
5015baa99640350caad0ac2629a1fbc5

SHA1
001ce9ca4e73fcfe2dcb503ae207b06f8a99aa0e

SHA256
66c92110452f7c14b8bc9c2a1fa72ed8139656aef958609d6abf82e9dcedd556

SHA512
c207d3b95321de7057a6477b49c5c26f070a7095c97d35986f691a23afb9ad4d850a0305cd083ca658a13341e77aaa774b267cdd1a9e4abccf0895d5125961cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1686155.exe

Filesize
1.0MB

MD5
927cbe047bc4882e9f037dacee757213

SHA1
3f997963a722586d12ea2605de8ba7ba5b226f2c

SHA256
f31b67785a3ed4e457883eecf085dda8bad3d722d3f89a301f991f1be5aba58d

SHA512
4de8085e5a1dc87b0286026bf13e742cff367091f1b539f9e2bb59fbc41470cbf2f78ae3be465811b55f75a1b5241dd92d760b9fa34396802da2b02b7f919c3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1686155.exe

Filesize
1.0MB

MD5
927cbe047bc4882e9f037dacee757213

SHA1
3f997963a722586d12ea2605de8ba7ba5b226f2c

SHA256
f31b67785a3ed4e457883eecf085dda8bad3d722d3f89a301f991f1be5aba58d

SHA512
4de8085e5a1dc87b0286026bf13e742cff367091f1b539f9e2bb59fbc41470cbf2f78ae3be465811b55f75a1b5241dd92d760b9fa34396802da2b02b7f919c3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4937664.exe

Filesize
502KB

MD5
bada1129daf4c872e4207ee4c904415f

SHA1
9eec9bd4da25e3250c6deffe3a4ad8d820a6babe

SHA256
d4ba65dade72fc874bf00de3464566df99f36761157ba5e68163e7ebf61757c0

SHA512
b384df53d474b321484a406256580034f87b2e4fc31aca9d0618b2983de4d045703d70251dd932b26db8d86a85c058c62b23b02a8eec63abbd76d3770946ec42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4937664.exe

Filesize
502KB

MD5
bada1129daf4c872e4207ee4c904415f

SHA1
9eec9bd4da25e3250c6deffe3a4ad8d820a6babe

SHA256
d4ba65dade72fc874bf00de3464566df99f36761157ba5e68163e7ebf61757c0

SHA512
b384df53d474b321484a406256580034f87b2e4fc31aca9d0618b2983de4d045703d70251dd932b26db8d86a85c058c62b23b02a8eec63abbd76d3770946ec42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6105089.exe

Filesize
860KB

MD5
25f013ff2c596c907ff532da510198df

SHA1
cb406bc9beac98f0413fc04691eda9e55891e694

SHA256
d453edacede3ece872bf885e9edebbbe09015aa2ba98b1bde6272009c058e634

SHA512
7d047a9328261955a08c55ac22261e0bd1c78e8a80ea2ee3b291860a4301431e160da3e54ac17f7db083f68c2b0e44328e35b0c1e489a8afba609bcf621ddbd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6105089.exe

Filesize
860KB

MD5
25f013ff2c596c907ff532da510198df

SHA1
cb406bc9beac98f0413fc04691eda9e55891e694

SHA256
d453edacede3ece872bf885e9edebbbe09015aa2ba98b1bde6272009c058e634

SHA512
7d047a9328261955a08c55ac22261e0bd1c78e8a80ea2ee3b291860a4301431e160da3e54ac17f7db083f68c2b0e44328e35b0c1e489a8afba609bcf621ddbd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5423647.exe

Filesize
1016KB

MD5
b1d1c093839c607986c5b06db6262e11

SHA1
ec0fea19661d2d764cf2932e98bd32cee21d35d8

SHA256
bdac7f6a0371cc737e9e8289d88ae90f31ff41060cc74d5eb1784c6fab7dfce2

SHA512
207399ee9dd1704163c5f650650131662e0145d716e28debf7b17207c7df40fa9dfd81b7247e34832bd55b6ae7ffb360ec63d9c71e440b505dbafdc4d67fcbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5423647.exe

Filesize
1016KB

MD5
b1d1c093839c607986c5b06db6262e11

SHA1
ec0fea19661d2d764cf2932e98bd32cee21d35d8

SHA256
bdac7f6a0371cc737e9e8289d88ae90f31ff41060cc74d5eb1784c6fab7dfce2

SHA512
207399ee9dd1704163c5f650650131662e0145d716e28debf7b17207c7df40fa9dfd81b7247e34832bd55b6ae7ffb360ec63d9c71e440b505dbafdc4d67fcbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
memory/1324-72-0x000000000A840000-0x000000000A88C000-memory.dmp

Filesize
304KB

Download
memory/1324-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1324-62-0x000000000A730000-0x000000000A83A000-memory.dmp

Filesize
1.0MB

Download
memory/1324-63-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/1324-64-0x000000000A660000-0x000000000A672000-memory.dmp

Filesize
72KB

Download
memory/1324-69-0x000000000A6C0000-0x000000000A6FC000-memory.dmp

Filesize
240KB

Download
memory/1324-55-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/1324-54-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/1324-53-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/1324-61-0x000000000ABC0000-0x000000000B1D8000-memory.dmp

Filesize
6.1MB

Download
memory/1324-89-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/1724-41-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/1724-37-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/1724-36-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/1724-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3928-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3928-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3928-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3928-47-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download