amadey | ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe
Size

1.0MB
MD5

ab0d5382476bba0585dc868d57cd91c2
SHA1

f449e9aa49052dfb44aca537fac68df541fea1d8
SHA256

ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223
SHA512

050c63b27a5a5fec890d9de7a4a9bc10eb8e3c5c8e734d7b5651f4515108e6c4259ccee1783b09cd78b5cff730a455e3e8c558b49baf4b0adfb3d7c1aa02b1d4
SSDEEP

12288:AMrNy90ZrZ3YupG2b+HldTbV+/VC5jouJVNg5h6Q/+NHjPfHZ3JaOnfVN1+HN4wH:9yotkLo6o6Q/+NTHZ5T9IN9Hps8RaG3

Score

10^/10

amadey healer redline trush dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

trush

77.91.124.82:19071

Attributes

auth_value
c13814867cde8193679cd0cad2d774be

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000230ce-33.dat	healer
behavioral2/files/0x00070000000230ce-34.dat	healer
behavioral2/memory/3996-35-0x0000000000990000-0x000000000099A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q0400793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q0400793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q0400793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q0400793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q0400793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q0400793.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	t8420145.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	u8296859.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 14 IoCs

pid	Process
3840	z1571932.exe
2500	z0706575.exe
1708	z0681522.exe
4968	z8504861.exe
3996	q0400793.exe
3936	r4443052.exe
568	s6845159.exe
4980	t8420145.exe
3200	explonde.exe
3484	u8296859.exe
4168	legota.exe
4916	w3934548.exe
4364	explonde.exe
1412	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
1448	rundll32.exe
4352	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q0400793.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0706575.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0681522.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z8504861.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1571932.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 3644	3936	r4443052.exe	97
PID 568 set thread context of 3004	568	s6845159.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1056	3936	WerFault.exe	96
1612	3644	WerFault.exe	97
3984	568	WerFault.exe	102

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4320	schtasks.exe
4388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	q0400793.exe
3996	q0400793.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	q0400793.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3840	1252	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe	86
PID 1252 wrote to memory of 3840	1252	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe	86
PID 1252 wrote to memory of 3840	1252	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe	86
PID 3840 wrote to memory of 2500	3840	z1571932.exe	87
PID 3840 wrote to memory of 2500	3840	z1571932.exe	87
PID 3840 wrote to memory of 2500	3840	z1571932.exe	87
PID 2500 wrote to memory of 1708	2500	z0706575.exe	88
PID 2500 wrote to memory of 1708	2500	z0706575.exe	88
PID 2500 wrote to memory of 1708	2500	z0706575.exe	88
PID 1708 wrote to memory of 4968	1708	z0681522.exe	89
PID 1708 wrote to memory of 4968	1708	z0681522.exe	89
PID 1708 wrote to memory of 4968	1708	z0681522.exe	89
PID 4968 wrote to memory of 3996	4968	z8504861.exe	90
PID 4968 wrote to memory of 3996	4968	z8504861.exe	90
PID 4968 wrote to memory of 3936	4968	z8504861.exe	96
PID 4968 wrote to memory of 3936	4968	z8504861.exe	96
PID 4968 wrote to memory of 3936	4968	z8504861.exe	96
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 3936 wrote to memory of 3644	3936	r4443052.exe	97
PID 1708 wrote to memory of 568	1708	z0681522.exe	102
PID 1708 wrote to memory of 568	1708	z0681522.exe	102
PID 1708 wrote to memory of 568	1708	z0681522.exe	102
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 568 wrote to memory of 3004	568	s6845159.exe	103
PID 2500 wrote to memory of 4980	2500	z0706575.exe	106
PID 2500 wrote to memory of 4980	2500	z0706575.exe	106
PID 2500 wrote to memory of 4980	2500	z0706575.exe	106
PID 4980 wrote to memory of 3200	4980	t8420145.exe	108
PID 4980 wrote to memory of 3200	4980	t8420145.exe	108
PID 4980 wrote to memory of 3200	4980	t8420145.exe	108
PID 3840 wrote to memory of 3484	3840	z1571932.exe	109
PID 3840 wrote to memory of 3484	3840	z1571932.exe	109
PID 3840 wrote to memory of 3484	3840	z1571932.exe	109
PID 3484 wrote to memory of 4168	3484	u8296859.exe	110
PID 3484 wrote to memory of 4168	3484	u8296859.exe	110
PID 3484 wrote to memory of 4168	3484	u8296859.exe	110
PID 3200 wrote to memory of 4320	3200	explonde.exe	111
PID 3200 wrote to memory of 4320	3200	explonde.exe	111
PID 3200 wrote to memory of 4320	3200	explonde.exe	111
PID 4168 wrote to memory of 4388	4168	legota.exe	112
PID 4168 wrote to memory of 4388	4168	legota.exe	112
PID 4168 wrote to memory of 4388	4168	legota.exe	112
PID 1252 wrote to memory of 4916	1252	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe	115
PID 1252 wrote to memory of 4916	1252	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe	115
PID 1252 wrote to memory of 4916	1252	ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe	115
PID 4168 wrote to memory of 2496	4168	legota.exe	118
PID 4168 wrote to memory of 2496	4168	legota.exe	118
PID 4168 wrote to memory of 2496	4168	legota.exe	118
PID 3200 wrote to memory of 2808	3200	explonde.exe	117
PID 3200 wrote to memory of 2808	3200	explonde.exe	117

C:\Users\Admin\AppData\Local\Temp\ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe
"C:\Users\Admin\AppData\Local\Temp\ecc24b7e2e6747506a54c02f4c8d4856580ddae81aa20229dd133d009ccd5223.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1571932.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1571932.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0706575.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0706575.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0681522.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0681522.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8504861.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8504861.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0400793.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0400793.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4443052.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4443052.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 540
        8⤵
        Program crash
        
        PID:1612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 556
        7⤵
        Program crash
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6845159.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6845159.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:568
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 552
        6⤵
        Program crash
        
        PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8420145.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8420145.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3200
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4320
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:1696
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:4352
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8296859.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8296859.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4388
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:2496
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:5044
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:3940
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:2580
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1116
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:3520
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:4780
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3934548.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3934548.exe
  2⤵
  - Executes dropped EXE
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3936 -ip 3936
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3644 -ip 3644
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 568 -ip 568
1⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3934548.exe

Filesize
19KB

MD5
818a3fe6c398abc386b29a0d131c1f04

SHA1
429b444373d91742934ec850440f4dae5e82848b

SHA256
d11afc7202925575d2a48a3b3c26e76769adc1e58e4578996d299df4c642bd2a

SHA512
f36ed7ce7216bcc99bbeca13f473dc4ecf81b995014422d192322a897905c220c32b7627bc5398241891b6ef917db90f2c5b1e880ba3a2c323d225018eb7b3bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3934548.exe

Filesize
19KB

MD5
818a3fe6c398abc386b29a0d131c1f04

SHA1
429b444373d91742934ec850440f4dae5e82848b

SHA256
d11afc7202925575d2a48a3b3c26e76769adc1e58e4578996d299df4c642bd2a

SHA512
f36ed7ce7216bcc99bbeca13f473dc4ecf81b995014422d192322a897905c220c32b7627bc5398241891b6ef917db90f2c5b1e880ba3a2c323d225018eb7b3bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1571932.exe

Filesize
966KB

MD5
efb1829dc9181eaf2e4681e14081e9a3

SHA1
824b2aa94543b179077ce6b1c1325ef38234807f

SHA256
e652aaf4097d5a5d8ca0804f1215a30e383b34b4a1768fb6a615a921116ee91d

SHA512
2dbb5f042b63f5268cbcbcbb45ff8631fc934e8d91d7f59be8aa17216f85073b2dfe1c217ee932998f3447b1e261bc3fbb06473906cb313367565771adaad173

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1571932.exe

Filesize
966KB

MD5
efb1829dc9181eaf2e4681e14081e9a3

SHA1
824b2aa94543b179077ce6b1c1325ef38234807f

SHA256
e652aaf4097d5a5d8ca0804f1215a30e383b34b4a1768fb6a615a921116ee91d

SHA512
2dbb5f042b63f5268cbcbcbb45ff8631fc934e8d91d7f59be8aa17216f85073b2dfe1c217ee932998f3447b1e261bc3fbb06473906cb313367565771adaad173

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8296859.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8296859.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0706575.exe

Filesize
787KB

MD5
1ea5c95831dc4467e84f9b6d97a38cdb

SHA1
23fda2fe2bfd9ecf9bd28c40ab90b96be2e5f531

SHA256
aa12b7b64b3ab6636828bcb7396bae45bdc2dbd46ff471262d606a725ef910ea

SHA512
560b26a41522e6d275239425bc1c4da8e17b8e523b5038f0d3e07ac2d3d2abf327fd7010680bd3e82b2f2e45c9b97325917f95ab78d442ba8191aae05dcab613

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0706575.exe

Filesize
787KB

MD5
1ea5c95831dc4467e84f9b6d97a38cdb

SHA1
23fda2fe2bfd9ecf9bd28c40ab90b96be2e5f531

SHA256
aa12b7b64b3ab6636828bcb7396bae45bdc2dbd46ff471262d606a725ef910ea

SHA512
560b26a41522e6d275239425bc1c4da8e17b8e523b5038f0d3e07ac2d3d2abf327fd7010680bd3e82b2f2e45c9b97325917f95ab78d442ba8191aae05dcab613

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8420145.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8420145.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0681522.exe

Filesize
603KB

MD5
f61f3edfe065ae7357b9eec0950d1654

SHA1
0c5e5ca30a1f4d8260c7f7e8bfdc42d61fa0491d

SHA256
09727525c3813956f20c8d2b261ba33c541b9f06de5c967c39a3e318ec69334a

SHA512
b489efe84c91035fa147d35c2555c579228dc8adb3d6f04f94ea1ef40c3f4925e9395368b11303cf9fa5e9cd7d2dc5a8d20d5ce003e430603f754cc996ad84fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0681522.exe

Filesize
603KB

MD5
f61f3edfe065ae7357b9eec0950d1654

SHA1
0c5e5ca30a1f4d8260c7f7e8bfdc42d61fa0491d

SHA256
09727525c3813956f20c8d2b261ba33c541b9f06de5c967c39a3e318ec69334a

SHA512
b489efe84c91035fa147d35c2555c579228dc8adb3d6f04f94ea1ef40c3f4925e9395368b11303cf9fa5e9cd7d2dc5a8d20d5ce003e430603f754cc996ad84fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6845159.exe

Filesize
384KB

MD5
e7028405c6c007b68d2b054986dbc603

SHA1
1d99ddd092a5ae8fe7eae9185de1e55276ce443c

SHA256
0294370fed4c6689ef6d997f6b3da59b98210ca0d0038bcde705ad4627167ca3

SHA512
7b2c914bf7c014b96e18d21f7d0e95c795f232067fb090f7cbb5a6f5e8c980ed4f81ab7d60174e745cd858bbfc39046716849d930a492f701a64db932fca036a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6845159.exe

Filesize
384KB

MD5
e7028405c6c007b68d2b054986dbc603

SHA1
1d99ddd092a5ae8fe7eae9185de1e55276ce443c

SHA256
0294370fed4c6689ef6d997f6b3da59b98210ca0d0038bcde705ad4627167ca3

SHA512
7b2c914bf7c014b96e18d21f7d0e95c795f232067fb090f7cbb5a6f5e8c980ed4f81ab7d60174e745cd858bbfc39046716849d930a492f701a64db932fca036a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8504861.exe

Filesize
339KB

MD5
b6bdc718927125c885339a382950e56b

SHA1
d6b76a3226362a3e1e8dc0ad96d433c9cde51b47

SHA256
666aae8f26839256864ec4636d6ff7db5cb8c44897f6341db3a1c831bda5edf9

SHA512
1c1ec4c48b02f441b42a4c174afad6177f412c8776218f8ae796b8532fba343b96fd4e0427055429047db2fa01de89959acc82f7b6fd133e37a5ae48b63f3dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8504861.exe

Filesize
339KB

MD5
b6bdc718927125c885339a382950e56b

SHA1
d6b76a3226362a3e1e8dc0ad96d433c9cde51b47

SHA256
666aae8f26839256864ec4636d6ff7db5cb8c44897f6341db3a1c831bda5edf9

SHA512
1c1ec4c48b02f441b42a4c174afad6177f412c8776218f8ae796b8532fba343b96fd4e0427055429047db2fa01de89959acc82f7b6fd133e37a5ae48b63f3dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0400793.exe

Filesize
12KB

MD5
ec6a49e3433c5eec9aafca187547e6c9

SHA1
09a0bcdea91a480aaba06d0fae6fc96b41259a52

SHA256
6f73eddae0f8b9d7a8aa0de9a10f8703fd5802218bf34dfb1ce0d881673b9858

SHA512
1b1b98cb8c47d727f4b5d481befcbe061f72e3a6d3091466844d60b12f7e5bff7a648aec399dc14664a2e475f52d72fd2306a16a0a8cbd13fc0c7e8edc4fd515

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0400793.exe

Filesize
12KB

MD5
ec6a49e3433c5eec9aafca187547e6c9

SHA1
09a0bcdea91a480aaba06d0fae6fc96b41259a52

SHA256
6f73eddae0f8b9d7a8aa0de9a10f8703fd5802218bf34dfb1ce0d881673b9858

SHA512
1b1b98cb8c47d727f4b5d481befcbe061f72e3a6d3091466844d60b12f7e5bff7a648aec399dc14664a2e475f52d72fd2306a16a0a8cbd13fc0c7e8edc4fd515

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4443052.exe

Filesize
365KB

MD5
0f2cccd5f8cf6700b16e461ac417c0e4

SHA1
20c8f74e86f4ff7bec0352eb665cb77760a31e30

SHA256
21f8e0c3da05699c9805f9c1e42a2789ce4b8355d7fb633d7175785d1cf035db

SHA512
515fc5fdc93ae707c9551b448d9342c4c111de4e429e3ae4482013eebf0bd0031921fbc05e0e35fc012f8fd0440f5c135c5fbb05ad9e257c617b0072687a7aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4443052.exe

Filesize
365KB

MD5
0f2cccd5f8cf6700b16e461ac417c0e4

SHA1
20c8f74e86f4ff7bec0352eb665cb77760a31e30

SHA256
21f8e0c3da05699c9805f9c1e42a2789ce4b8355d7fb633d7175785d1cf035db

SHA512
515fc5fdc93ae707c9551b448d9342c4c111de4e429e3ae4482013eebf0bd0031921fbc05e0e35fc012f8fd0440f5c135c5fbb05ad9e257c617b0072687a7aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/3004-87-0x00000000058B0000-0x00000000058C2000-memory.dmp

Filesize
72KB

Download
memory/3004-100-0x000000000AF60000-0x000000000AFAC000-memory.dmp

Filesize
304KB

Download
memory/3004-82-0x000000000B540000-0x000000000BB58000-memory.dmp

Filesize
6.1MB

Download
memory/3004-80-0x00000000734F0000-0x0000000073CA0000-memory.dmp

Filesize
7.7MB

Download
memory/3004-60-0x00000000734F0000-0x0000000073CA0000-memory.dmp

Filesize
7.7MB

Download
memory/3004-85-0x000000000B030000-0x000000000B13A000-memory.dmp

Filesize
1.0MB

Download
memory/3004-86-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/3004-81-0x00000000031C0000-0x00000000031C6000-memory.dmp

Filesize
24KB

Download
memory/3004-88-0x000000000AF20000-0x000000000AF5C000-memory.dmp

Filesize
240KB

Download
memory/3004-89-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/3004-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3644-43-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3644-45-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3644-47-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3644-44-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3996-39-0x00007FFE920D0000-0x00007FFE92B91000-memory.dmp

Filesize
10.8MB

Download
memory/3996-35-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/3996-36-0x00007FFE920D0000-0x00007FFE92B91000-memory.dmp

Filesize
10.8MB

Download
memory/3996-37-0x00007FFE920D0000-0x00007FFE92B91000-memory.dmp

Filesize
10.8MB

Download