amadey | 6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe
Size

728KB
MD5

5fe739d874ed8bfb3ff23ed8531bf28a
SHA1

06cd37f1159bd367a9f53a53e2b4456104d0f9f9
SHA256

6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4
SHA512

445aa02187c9e14584c948db3bcef2b9dc68cde3a10f7b2df4dc92dbbf071040aac9a78254bca2c537015a7529ecae44c38f625228174330a0b5f220b8a20fb9
SSDEEP

12288:Jh01jRiaQEcxlBlLYWmwKAVW+0IF13URl5mzLAHKOx0A3KOU1EqpFE:Jq1th81BhFVVhvcl/AA6J1EC

Score

10^/10

amadey fabookie spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.87

http://79.137.192.18/9bDc8sQ/index.php

Attributes

install_dir
577f58beff
install_file
yiueea.exe
strings_key
a5085075a537f09dec81cc154ec0af4d

rc4.plain

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral1/memory/3064-104-0x0000000003210000-0x0000000003341000-memory.dmp	family_fabookie
behavioral1/memory/3064-107-0x0000000003210000-0x0000000003341000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie

Executes dropped EXE 5 IoCs

pid	Process
3064	aafg31.exe
2780	latestplayer.exe
2308	yiueea.exe
1492	yiueea.exe
1828	yiueea.exe

Loads dropped DLL 4 IoCs

pid	Process
1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe
1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe
1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe
2780	latestplayer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2608	schtasks.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	aafg31.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	aafg31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	aafg31.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	aafg31.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	aafg31.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	aafg31.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3064	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	28
PID 1816 wrote to memory of 3064	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	28
PID 1816 wrote to memory of 3064	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	28
PID 1816 wrote to memory of 3064	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	28
PID 1816 wrote to memory of 2780	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	29
PID 1816 wrote to memory of 2780	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	29
PID 1816 wrote to memory of 2780	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	29
PID 1816 wrote to memory of 2780	1816	JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe	29
PID 2780 wrote to memory of 2308	2780	latestplayer.exe	30
PID 2780 wrote to memory of 2308	2780	latestplayer.exe	30
PID 2780 wrote to memory of 2308	2780	latestplayer.exe	30
PID 2780 wrote to memory of 2308	2780	latestplayer.exe	30
PID 2308 wrote to memory of 2608	2308	yiueea.exe	31
PID 2308 wrote to memory of 2608	2308	yiueea.exe	31
PID 2308 wrote to memory of 2608	2308	yiueea.exe	31
PID 2308 wrote to memory of 2608	2308	yiueea.exe	31
PID 2308 wrote to memory of 2644	2308	yiueea.exe	33
PID 2308 wrote to memory of 2644	2308	yiueea.exe	33
PID 2308 wrote to memory of 2644	2308	yiueea.exe	33
PID 2308 wrote to memory of 2644	2308	yiueea.exe	33
PID 2644 wrote to memory of 2508	2644	cmd.exe	35
PID 2644 wrote to memory of 2508	2644	cmd.exe	35
PID 2644 wrote to memory of 2508	2644	cmd.exe	35
PID 2644 wrote to memory of 2508	2644	cmd.exe	35
PID 2644 wrote to memory of 2504	2644	cmd.exe	36
PID 2644 wrote to memory of 2504	2644	cmd.exe	36
PID 2644 wrote to memory of 2504	2644	cmd.exe	36
PID 2644 wrote to memory of 2504	2644	cmd.exe	36
PID 2644 wrote to memory of 2552	2644	cmd.exe	37
PID 2644 wrote to memory of 2552	2644	cmd.exe	37
PID 2644 wrote to memory of 2552	2644	cmd.exe	37
PID 2644 wrote to memory of 2552	2644	cmd.exe	37
PID 2644 wrote to memory of 2572	2644	cmd.exe	38
PID 2644 wrote to memory of 2572	2644	cmd.exe	38
PID 2644 wrote to memory of 2572	2644	cmd.exe	38
PID 2644 wrote to memory of 2572	2644	cmd.exe	38
PID 2644 wrote to memory of 2584	2644	cmd.exe	39
PID 2644 wrote to memory of 2584	2644	cmd.exe	39
PID 2644 wrote to memory of 2584	2644	cmd.exe	39
PID 2644 wrote to memory of 2584	2644	cmd.exe	39
PID 2644 wrote to memory of 2676	2644	cmd.exe	40
PID 2644 wrote to memory of 2676	2644	cmd.exe	40
PID 2644 wrote to memory of 2676	2644	cmd.exe	40
PID 2644 wrote to memory of 2676	2644	cmd.exe	40
PID 1260 wrote to memory of 1492	1260	taskeng.exe	43
PID 1260 wrote to memory of 1492	1260	taskeng.exe	43
PID 1260 wrote to memory of 1492	1260	taskeng.exe	43
PID 1260 wrote to memory of 1492	1260	taskeng.exe	43
PID 1260 wrote to memory of 1828	1260	taskeng.exe	46
PID 1260 wrote to memory of 1828	1260	taskeng.exe	46
PID 1260 wrote to memory of 1828	1260	taskeng.exe	46
PID 1260 wrote to memory of 1828	1260	taskeng.exe	46

C:\Users\Admin\AppData\Local\Temp\JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe
"C:\Users\Admin\AppData\Local\Temp\JC_6936a56efd4d51f236841a94f58686ad099773e0adbef02561cda498347181f4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\aafg31.exe
  "C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\latestplayer.exe
  "C:\Users\Admin\AppData\Local\Temp\latestplayer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
    "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2508
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "yiueea.exe" /P "Admin:N"
        5⤵
        
        PID:2504
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "yiueea.exe" /P "Admin:R" /E
        5⤵
        
        PID:2552
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2572
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\577f58beff" /P "Admin:N"
        5⤵
        
        PID:2584
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\577f58beff" /P "Admin:R" /E
        5⤵
        
        PID:2676

C:\Windows\system32\taskeng.exe
taskeng.exe {510D53E8-55CC-48FF-8170-D135237FA329} S-1-5-21-3849525425-30183055-657688904-1000:KGPMNUDG\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  2⤵
  - Executes dropped EXE
  PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf1e3bc44f433631e8e9a9e9dd332321

SHA1
11658c57a91b16a969d44d7bb0ad8dc874180d73

SHA256
294ac490c9305c091c9b9ee528d82353c98a07f9f31cdf3eea05329ba8bafc44

SHA512
8fd739c93a3da1e73396951339adbc33862b2482d9b8e1eb9e420c89d6b674996936ea63187f1f51ac3d7d18fa8d7a845277538f4faf5e79ec06bde7266dd685

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4443.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar457E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
19591c7f415b69694663ac1cd868df8a

SHA1
96dcc8bd716da5d7f4a7a04a64128eca20653935

SHA256
2fb9d88e38570b217034813216dd3d0976b90e41c761ac40eb96c2944edd27eb

SHA512
4518a1b5681e17b1c5c67d6b961f286a194f5fe021ce106f3cd7f8df9a5b331f1af8edb8b401d7eae8444d78ab1cdc5ee7097230b79db7e646e5bc1c6d3579e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
19591c7f415b69694663ac1cd868df8a

SHA1
96dcc8bd716da5d7f4a7a04a64128eca20653935

SHA256
2fb9d88e38570b217034813216dd3d0976b90e41c761ac40eb96c2944edd27eb

SHA512
4518a1b5681e17b1c5c67d6b961f286a194f5fe021ce106f3cd7f8df9a5b331f1af8edb8b401d7eae8444d78ab1cdc5ee7097230b79db7e646e5bc1c6d3579e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestplayer.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestplayer.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
19591c7f415b69694663ac1cd868df8a

SHA1
96dcc8bd716da5d7f4a7a04a64128eca20653935

SHA256
2fb9d88e38570b217034813216dd3d0976b90e41c761ac40eb96c2944edd27eb

SHA512
4518a1b5681e17b1c5c67d6b961f286a194f5fe021ce106f3cd7f8df9a5b331f1af8edb8b401d7eae8444d78ab1cdc5ee7097230b79db7e646e5bc1c6d3579e5

Download Submit
\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
19591c7f415b69694663ac1cd868df8a

SHA1
96dcc8bd716da5d7f4a7a04a64128eca20653935

SHA256
2fb9d88e38570b217034813216dd3d0976b90e41c761ac40eb96c2944edd27eb

SHA512
4518a1b5681e17b1c5c67d6b961f286a194f5fe021ce106f3cd7f8df9a5b331f1af8edb8b401d7eae8444d78ab1cdc5ee7097230b79db7e646e5bc1c6d3579e5

Download Submit
\Users\Admin\AppData\Local\Temp\latestplayer.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
memory/3064-103-0x0000000003090000-0x0000000003201000-memory.dmp

Filesize
1.4MB

Download
memory/3064-104-0x0000000003210000-0x0000000003341000-memory.dmp

Filesize
1.2MB

Download
memory/3064-107-0x0000000003210000-0x0000000003341000-memory.dmp

Filesize
1.2MB

Download
memory/3064-10-0x00000000FFDB0000-0x00000000FFE1A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads