amadey | 1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861

Analysis

max time kernel
54s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 11:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe
Size

2.9MB
MD5

a400a179ad65094f7b320970bcc8cfe8
SHA1

fab9c984c6fa4cf0dc60158b431e8791f61540a5
SHA256

1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861
SHA512

1f9bf266d19bf316831b9e0eb632b9703bfea26fed0e478f9133130e5da80ca10ce1e5ebc9f14de0100680117d3623f32ca82923417713003a453a6650481419
SSDEEP

49152:2j9i4yt+QafH5qHpAiyv3DJtgfH2K7PjtKn4u+0WHm1GpXKmVTof5lZNlaHzeq7M:4uKng06m1GpXqGzef

Score

10^/10

amadey healer smokeloader backdoor dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/2796-39-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	t0635224.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 10 IoCs

pid	Process
4148	z2155605.exe
3664	z8334303.exe
3428	z0413831.exe
4852	z9062995.exe
1976	q2468755.exe
4932	r2254940.exe
4228	s9020131.exe
2688	t0635224.exe
1292	explonde.exe
1416	u9938380.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2155605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z8334303.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0413831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z9062995.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 1976 set thread context of 2796	1976	q2468755.exe	102
PID 4932 set thread context of 3580	4932	r2254940.exe	112
PID 4228 set thread context of 3084	4228	s9020131.exe	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3492	3792	WerFault.exe	81
2180	1976	WerFault.exe	100
1012	4932	WerFault.exe	107
2480	3580	WerFault.exe	112
4700	4228	WerFault.exe	117

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "229"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2796	AppLaunch.exe
2796	AppLaunch.exe
3084	AppLaunch.exe
3084	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	AppLaunch.exe
Token: SeShutdownPrivilege	992	shutdown.exe
Token: SeRemoteShutdownPrivilege	992	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4888	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2884	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	90
PID 3792 wrote to memory of 2884	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	90
PID 3792 wrote to memory of 2884	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	90
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3792 wrote to memory of 3012	3792	1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe	91
PID 3012 wrote to memory of 4148	3012	AppLaunch.exe	95
PID 3012 wrote to memory of 4148	3012	AppLaunch.exe	95
PID 3012 wrote to memory of 4148	3012	AppLaunch.exe	95
PID 4148 wrote to memory of 3664	4148	z2155605.exe	96
PID 4148 wrote to memory of 3664	4148	z2155605.exe	96
PID 4148 wrote to memory of 3664	4148	z2155605.exe	96
PID 3664 wrote to memory of 3428	3664	z8334303.exe	98
PID 3664 wrote to memory of 3428	3664	z8334303.exe	98
PID 3664 wrote to memory of 3428	3664	z8334303.exe	98
PID 3428 wrote to memory of 4852	3428	z0413831.exe	99
PID 3428 wrote to memory of 4852	3428	z0413831.exe	99
PID 3428 wrote to memory of 4852	3428	z0413831.exe	99
PID 4852 wrote to memory of 1976	4852	z9062995.exe	100
PID 4852 wrote to memory of 1976	4852	z9062995.exe	100
PID 4852 wrote to memory of 1976	4852	z9062995.exe	100
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 1976 wrote to memory of 2796	1976	q2468755.exe	102
PID 4852 wrote to memory of 4932	4852	z9062995.exe	107
PID 4852 wrote to memory of 4932	4852	z9062995.exe	107
PID 4852 wrote to memory of 4932	4852	z9062995.exe	107
PID 4932 wrote to memory of 396	4932	r2254940.exe	109
PID 4932 wrote to memory of 396	4932	r2254940.exe	109
PID 4932 wrote to memory of 396	4932	r2254940.exe	109
PID 4932 wrote to memory of 2056	4932	r2254940.exe	110
PID 4932 wrote to memory of 2056	4932	r2254940.exe	110
PID 4932 wrote to memory of 2056	4932	r2254940.exe	110
PID 4932 wrote to memory of 464	4932	r2254940.exe	111
PID 4932 wrote to memory of 464	4932	r2254940.exe	111
PID 4932 wrote to memory of 464	4932	r2254940.exe	111
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 4932 wrote to memory of 3580	4932	r2254940.exe	112
PID 3428 wrote to memory of 4228	3428	z0413831.exe	117
PID 3428 wrote to memory of 4228	3428	z0413831.exe	117
PID 3428 wrote to memory of 4228	3428	z0413831.exe	117
PID 4228 wrote to memory of 3084	4228	s9020131.exe	120
PID 4228 wrote to memory of 3084	4228	s9020131.exe	120
PID 4228 wrote to memory of 3084	4228	s9020131.exe	120

C:\Users\Admin\AppData\Local\Temp\1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe
"C:\Users\Admin\AppData\Local\Temp\1fbbcceb2d82de62eeb2e7b6c768d6bed22cd906e265e76bc075608a145bc861.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2155605.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2155605.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8334303.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8334303.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0413831.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0413831.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9062995.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9062995.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2468755.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2468755.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 580
        8⤵
        Program crash
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2254940.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2254940.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:396
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:2056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:464
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 552
        9⤵
        Program crash
        
        PID:2480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 588
        8⤵
        Program crash
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9020131.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9020131.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 148
        7⤵
        Program crash
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0635224.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0635224.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
        7⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -s -t 0
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9938380.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9938380.exe
      4⤵
      Executes dropped EXE
      PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 148
  2⤵
  - Program crash
  PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3792 -ip 3792
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1976 -ip 1976
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4932 -ip 4932
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3580 -ip 3580
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4228 -ip 4228
1⤵
PID:1428

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3949855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2155605.exe

Filesize
1.5MB

MD5
8f02c02b56095e18f7f171cdc1a252a1

SHA1
dfd6119b58378ca96f48e7922e23d70fc0c0f7bf

SHA256
fa87c710ce9ca6703beda7dbd9f886dd1555d4e2b75f97f5fc5e9e7cd641f426

SHA512
4410a35690f5aab135f86a3a7012c445adb656f5a37ea8e867797802312b50fa3f70921e84a1f22fcb845150ac849eead6168456b451a874d10acc81fa286a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2155605.exe

Filesize
1.5MB

MD5
8f02c02b56095e18f7f171cdc1a252a1

SHA1
dfd6119b58378ca96f48e7922e23d70fc0c0f7bf

SHA256
fa87c710ce9ca6703beda7dbd9f886dd1555d4e2b75f97f5fc5e9e7cd641f426

SHA512
4410a35690f5aab135f86a3a7012c445adb656f5a37ea8e867797802312b50fa3f70921e84a1f22fcb845150ac849eead6168456b451a874d10acc81fa286a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9938380.exe

Filesize
1.1MB

MD5
2cad1f33461f4a69d883bee9dcce2f81

SHA1
a7b14fdde04ec6ce635d543d7fddb400c8034321

SHA256
426e1de44b6ae699cb5bf53ab30653ad81516c3fdc65621c852d78ff7147140f

SHA512
95f89436f2b9ba3aa72ed67aea37c480e86b2a71f5745e8fcaa1e8ca03586180b49134ea4cb65a8c8abf5a62e47cb50ce2f7b869716e35d319178bdb4775dbb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9938380.exe

Filesize
1.1MB

MD5
2cad1f33461f4a69d883bee9dcce2f81

SHA1
a7b14fdde04ec6ce635d543d7fddb400c8034321

SHA256
426e1de44b6ae699cb5bf53ab30653ad81516c3fdc65621c852d78ff7147140f

SHA512
95f89436f2b9ba3aa72ed67aea37c480e86b2a71f5745e8fcaa1e8ca03586180b49134ea4cb65a8c8abf5a62e47cb50ce2f7b869716e35d319178bdb4775dbb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8334303.exe

Filesize
1.1MB

MD5
44d7b9b6955a2d0684a757ccbe02ccfa

SHA1
e6b9a34859a3fabda472b3b004c35008e38af901

SHA256
f82a8dfb3f35f0e8c1b7775df165337121c37781b836c13713f2c94547026e75

SHA512
523e6b70c214802f2c6fba7edc2c94209d52e97c33812b5a2810af9a803aea85324efad73b290f4976babee060531947c37a3b45f964642e02cad27c36f476bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8334303.exe

Filesize
1.1MB

MD5
44d7b9b6955a2d0684a757ccbe02ccfa

SHA1
e6b9a34859a3fabda472b3b004c35008e38af901

SHA256
f82a8dfb3f35f0e8c1b7775df165337121c37781b836c13713f2c94547026e75

SHA512
523e6b70c214802f2c6fba7edc2c94209d52e97c33812b5a2810af9a803aea85324efad73b290f4976babee060531947c37a3b45f964642e02cad27c36f476bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0635224.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0635224.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0413831.exe

Filesize
918KB

MD5
75e51a89365c57c7a4dcea8935b8c181

SHA1
602e4ca634b5771507654eaff4c48fbca3f6f274

SHA256
55a180185964aa2967410d431fdd5bf87b8ec405944626de5a9628672cd3b877

SHA512
514ad378ea5ea3e37159e4cf19555e3a7cb80a877ba9d9c75f8b8a8c942cfa042338ac09ce413976c3a0752f3e29a905e6f26b9521ea7be86e667d53d1c611a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0413831.exe

Filesize
918KB

MD5
75e51a89365c57c7a4dcea8935b8c181

SHA1
602e4ca634b5771507654eaff4c48fbca3f6f274

SHA256
55a180185964aa2967410d431fdd5bf87b8ec405944626de5a9628672cd3b877

SHA512
514ad378ea5ea3e37159e4cf19555e3a7cb80a877ba9d9c75f8b8a8c942cfa042338ac09ce413976c3a0752f3e29a905e6f26b9521ea7be86e667d53d1c611a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9020131.exe

Filesize
922KB

MD5
68a87f73877c04bac023494f98b5fae1

SHA1
5fcddeedd1dfb1a01bd3edbe3ba77711670015cf

SHA256
81c0f80be8c3e9438769c98eeacdc124e90253423da7c26039c7d7c81056750c

SHA512
68a7dcd66bad5f82f4c06d922ea7e0f56025b32bb46dc1af6d2372845f3fed8bb2d8d919438e209419316d8fe3cca0436cdec4db5bacdabb53f333ce0cccbea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9020131.exe

Filesize
922KB

MD5
68a87f73877c04bac023494f98b5fae1

SHA1
5fcddeedd1dfb1a01bd3edbe3ba77711670015cf

SHA256
81c0f80be8c3e9438769c98eeacdc124e90253423da7c26039c7d7c81056750c

SHA512
68a7dcd66bad5f82f4c06d922ea7e0f56025b32bb46dc1af6d2372845f3fed8bb2d8d919438e209419316d8fe3cca0436cdec4db5bacdabb53f333ce0cccbea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9062995.exe

Filesize
534KB

MD5
99c93b0bb1a7e67ff9e90832f346c432

SHA1
1c6ab8765147a6d3dc53439af25b3b2712f58743

SHA256
841756bd843eaa498b62a0aa699eab4a9266f2e001d3162edc652799fc0d4e60

SHA512
1aa88de4dd1212bfdb2e591808c92ad6d0617c228109fc74e30d1ad140d85eeb120859752b7b823edf8979555a996c0df5e6d0568d0fd3611b1f6b4e9dec4f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9062995.exe

Filesize
534KB

MD5
99c93b0bb1a7e67ff9e90832f346c432

SHA1
1c6ab8765147a6d3dc53439af25b3b2712f58743

SHA256
841756bd843eaa498b62a0aa699eab4a9266f2e001d3162edc652799fc0d4e60

SHA512
1aa88de4dd1212bfdb2e591808c92ad6d0617c228109fc74e30d1ad140d85eeb120859752b7b823edf8979555a996c0df5e6d0568d0fd3611b1f6b4e9dec4f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2468755.exe

Filesize
899KB

MD5
cd9b6e7057c49e6a3636dfde15cbc80d

SHA1
1eef1217f486d0d51e4843138b483119a1b54fd5

SHA256
5c0e07835d80a15286aa8ceebcbcf871379ae545d52ddcbfe6f9001b74d43ff0

SHA512
34d52597a09616f7c6d2bb36f17cdf215ce0780ee9c37b759dd6594c76b7f5adf96fe0c43ba90fcde43b8be393c50cec10a11fde47600426240cb997976f0a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2468755.exe

Filesize
899KB

MD5
cd9b6e7057c49e6a3636dfde15cbc80d

SHA1
1eef1217f486d0d51e4843138b483119a1b54fd5

SHA256
5c0e07835d80a15286aa8ceebcbcf871379ae545d52ddcbfe6f9001b74d43ff0

SHA512
34d52597a09616f7c6d2bb36f17cdf215ce0780ee9c37b759dd6594c76b7f5adf96fe0c43ba90fcde43b8be393c50cec10a11fde47600426240cb997976f0a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2254940.exe

Filesize
1.1MB

MD5
438fb444e7b4caa82ef1a0a819128933

SHA1
79ee7fab4f0730d0a6557eed598e28a67dbef436

SHA256
4761d344bdfa72287ba5cd184aa3307cb0c75b3fc6da8c3eac9b63ac6cb4e9e6

SHA512
9bc7795adf4f830ec7447d84589bcf8fa09ef2fb6809fa4e102fb4621a4132d59b08f55be14faa952fee7ea25a3bf24a560b0b6180eb06a0258bd44341e0006c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2254940.exe

Filesize
1.1MB

MD5
438fb444e7b4caa82ef1a0a819128933

SHA1
79ee7fab4f0730d0a6557eed598e28a67dbef436

SHA256
4761d344bdfa72287ba5cd184aa3307cb0c75b3fc6da8c3eac9b63ac6cb4e9e6

SHA512
9bc7795adf4f830ec7447d84589bcf8fa09ef2fb6809fa4e102fb4621a4132d59b08f55be14faa952fee7ea25a3bf24a560b0b6180eb06a0258bd44341e0006c

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
memory/2796-39-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2796-71-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/2796-42-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/2796-41-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3012-3-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/3012-40-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/3012-2-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/3012-1-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/3012-0-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/3084-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3084-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3580-50-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3580-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3580-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3580-46-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads