amadey | 0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
Size

240KB
MD5

3eb0f1a7f7dc39b8230f91de573b1857
SHA1

fccc917a6282990d8396ed50c1a421703936d686
SHA256

0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46
SHA512

4ea8ed82e16f06ae0d37cced469a1fe3957c76de9cd5a178c49c2caa106bf88177de7c66567682271f9578da759311afa91f9f4e5f8cce894ca9529a2e6987e7
SSDEEP

3072:1mpp1+6UnEV0gVKKs3TFGjlVlmF+3J1Fecz1mS/Hq4Ho5DkhtXEpkSg:MH1RVRVKBovmIzFeS1vfq4Hukhyq

Score

10^/10

amadey djvu redline smokeloader logsdiller cloud (tg: @logsdillabot)pub1 backdoor collection discovery infostealer persistence ransomware spyware trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

http://wirtshauspost.at/tmp/

http://msktk.ru/tmp/

http://soetegem.com/tmp/

http://gromograd.ru/tmp/

http://talesofpirates.net/tmp/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/raud/get.php

Attributes

extension
.mlrd
offline_id
FjtJkuhRHnUARRt9GnbbgUTa6ErhJq4ZM668xSt1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-xN3VuzQl0a Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0805JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.255.152.132:36011

Extracted

Family

amadey

Version

3.87

http://79.137.192.18/9bDc8sQ/index.php

Attributes

install_dir
577f58beff
install_file
yiueea.exe
strings_key
a5085075a537f09dec81cc154ec0af4d

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral2/memory/1328-21-0x00000000049A0000-0x0000000004ABB000-memory.dmp	family_djvu
behavioral2/memory/4324-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4324-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4324-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4324-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4324-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4324-72-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3484-81-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3484-83-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3484-85-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/3076-44-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/1812-121-0x0000000000580000-0x00000000005DA000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	ED4E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	153D.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	yiueea.exe

Executes dropped EXE 10 IoCs

pid	Process
1328	ED4E.exe
1068	EF81.exe
4324	ED4E.exe
1184	646.exe
408	153D.exe
632	19A3.exe
4472	yiueea.exe
4160	ED4E.exe
3484	ED4E.exe
4144	yiueea.exe

Loads dropped DLL 1 IoCs

pid	Process
1592	regsvr32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4852	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\efa87c00-f24a-495e-9ec1-c8a15569e935\\ED4E.exe\" --AutoStart"	ED4E.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
67	api.2ip.ua
68	api.2ip.ua

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1328 set thread context of 4324	1328	ED4E.exe	98
PID 1068 set thread context of 3076	1068	EF81.exe	106
PID 4160 set thread context of 3484	4160	ED4E.exe	116
PID 1184 set thread context of 1812	1184	646.exe	127

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	3484	WerFault.exe	116

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	19A3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	19A3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	19A3.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1644	NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
1644	NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1644	NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
632	19A3.exe
3132	Process not Found
3132	Process not Found
3132	Process not Found
3132	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeShutdownPrivilege	3132	Process not Found
Token: SeCreatePagefilePrivilege	3132	Process not Found
Token: SeDebugPrivilege	3076	AppLaunch.exe
Token: SeDebugPrivilege	1812	jsc.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3132	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1328	3132	Process not Found	95
PID 3132 wrote to memory of 1328	3132	Process not Found	95
PID 3132 wrote to memory of 1328	3132	Process not Found	95
PID 3132 wrote to memory of 1068	3132	Process not Found	96
PID 3132 wrote to memory of 1068	3132	Process not Found	96
PID 3132 wrote to memory of 1068	3132	Process not Found	96
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 1328 wrote to memory of 4324	1328	ED4E.exe	98
PID 4324 wrote to memory of 4852	4324	ED4E.exe	102
PID 4324 wrote to memory of 4852	4324	ED4E.exe	102
PID 4324 wrote to memory of 4852	4324	ED4E.exe	102
PID 3132 wrote to memory of 1184	3132	Process not Found	103
PID 3132 wrote to memory of 1184	3132	Process not Found	103
PID 3132 wrote to memory of 3476	3132	Process not Found	104
PID 3132 wrote to memory of 3476	3132	Process not Found	104
PID 3476 wrote to memory of 1592	3476	regsvr32.exe	105
PID 3476 wrote to memory of 1592	3476	regsvr32.exe	105
PID 3476 wrote to memory of 1592	3476	regsvr32.exe	105
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 1068 wrote to memory of 3076	1068	EF81.exe	106
PID 3132 wrote to memory of 408	3132	Process not Found	107
PID 3132 wrote to memory of 408	3132	Process not Found	107
PID 3132 wrote to memory of 408	3132	Process not Found	107
PID 3132 wrote to memory of 632	3132	Process not Found	108
PID 3132 wrote to memory of 632	3132	Process not Found	108
PID 3132 wrote to memory of 632	3132	Process not Found	108
PID 4324 wrote to memory of 4160	4324	ED4E.exe	109
PID 4324 wrote to memory of 4160	4324	ED4E.exe	109
PID 4324 wrote to memory of 4160	4324	ED4E.exe	109
PID 408 wrote to memory of 4472	408	153D.exe	110
PID 408 wrote to memory of 4472	408	153D.exe	110
PID 408 wrote to memory of 4472	408	153D.exe	110
PID 4472 wrote to memory of 3316	4472	yiueea.exe	112
PID 4472 wrote to memory of 3316	4472	yiueea.exe	112
PID 4472 wrote to memory of 3316	4472	yiueea.exe	112
PID 4472 wrote to memory of 3352	4472	yiueea.exe	114
PID 4472 wrote to memory of 3352	4472	yiueea.exe	114
PID 4472 wrote to memory of 3352	4472	yiueea.exe	114
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 4160 wrote to memory of 3484	4160	ED4E.exe	116
PID 3352 wrote to memory of 4040	3352	cmd.exe	118
PID 3352 wrote to memory of 4040	3352	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46exe_JC.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1644

C:\Users\Admin\AppData\Local\Temp\ED4E.exe
C:\Users\Admin\AppData\Local\Temp\ED4E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\ED4E.exe
  C:\Users\Admin\AppData\Local\Temp\ED4E.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\efa87c00-f24a-495e-9ec1-c8a15569e935" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\ED4E.exe
    "C:\Users\Admin\AppData\Local\Temp\ED4E.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\ED4E.exe
      "C:\Users\Admin\AppData\Local\Temp\ED4E.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:3484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 216
        5⤵
        Program crash
        
        PID:3732

C:\Users\Admin\AppData\Local\Temp\EF81.exe
C:\Users\Admin\AppData\Local\Temp\EF81.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3076

C:\Users\Admin\AppData\Local\Temp\646.exe
C:\Users\Admin\AppData\Local\Temp\646.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1812

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\B97.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\B97.dll
  2⤵
  - Loads dropped DLL
  PID:1592

C:\Users\Admin\AppData\Local\Temp\153D.exe
C:\Users\Admin\AppData\Local\Temp\153D.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4040
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:N"
      4⤵
      PID:3576
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:R" /E
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:N"
      4⤵
      PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4572
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:R" /E
      4⤵
      PID:5000

C:\Users\Admin\AppData\Local\Temp\19A3.exe
C:\Users\Admin\AppData\Local\Temp\19A3.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3484 -ip 3484
1⤵
PID:4156

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3948

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4180

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
1⤵
- Executes dropped EXE
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\153D.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\153D.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\19A3.exe

Filesize
237KB

MD5
a0dc2db849379678c981ff38e6864db0

SHA1
df1684b25e0fe4af92b0cf0cf4e6dfcac795f458

SHA256
eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d

SHA512
6caaf092866e0a1c272adb6790042e0480b621c089701f16c3efd2cabd14874560180ee3d7fa460ee22074a3dfed3a88e72272b479978be85dfb7037cb01ad6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\19A3.exe

Filesize
237KB

MD5
a0dc2db849379678c981ff38e6864db0

SHA1
df1684b25e0fe4af92b0cf0cf4e6dfcac795f458

SHA256
eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d

SHA512
6caaf092866e0a1c272adb6790042e0480b621c089701f16c3efd2cabd14874560180ee3d7fa460ee22074a3dfed3a88e72272b479978be85dfb7037cb01ad6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\646.exe

Filesize
8.9MB

MD5
22b5ba8e29ad46aea74520369763650a

SHA1
5477b1f2384bc99e50cf8414c6adfe2e9c0ab2ec

SHA256
ebd8083f3e802cac490686d05a3fe08e2305a6657a9af5ef38fe772496f621ec

SHA512
38cb42bbb50a3aca19c3af8af01bf5d46e27841f50df2fc421183550daad6b65f91c3e454705a9e3ad9706a198c7bd928d6e2d1487a369cd7d3788e547e6eead

Download Submit
C:\Users\Admin\AppData\Local\Temp\B97.dll

Filesize
2.3MB

MD5
55f1c499b31e58a29f6dacea7580fb69

SHA1
c6e5c6a4bb84374a6b172e8eb0c43aaab5423e1a

SHA256
b2fadb2f33351919a782043b2898b201b7420fd1d57800a1d144710156640854

SHA512
9c2f2189e686e05585c6afef0cb4608b5c81ec89f48b992c600fa95ede32a51dc1ee53df518f97b3fb1c8c096adbc3534562f3d6af921bd9b1781fa9dd7786e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\B97.dll

Filesize
2.3MB

MD5
55f1c499b31e58a29f6dacea7580fb69

SHA1
c6e5c6a4bb84374a6b172e8eb0c43aaab5423e1a

SHA256
b2fadb2f33351919a782043b2898b201b7420fd1d57800a1d144710156640854

SHA512
9c2f2189e686e05585c6afef0cb4608b5c81ec89f48b992c600fa95ede32a51dc1ee53df518f97b3fb1c8c096adbc3534562f3d6af921bd9b1781fa9dd7786e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ED4E.exe

Filesize
728KB

MD5
b5a49d7c6a9c31248c0676d0fc921967

SHA1
e2226592e6cebf82f5de1e76380bbb01291344bb

SHA256
e62936b1d28e5d77393275f6075ec71d424568469a2c7b6cec687553aeacfb22

SHA512
20f3f6b77bf6fb5c090730410bd110c017a92a9cae407850d9c254491fd0aca2d14ef7c3b94ca112ca6725360d2264188a335addd8c79d4b7ffde0832a0bbe8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ED4E.exe

Filesize
728KB

MD5
b5a49d7c6a9c31248c0676d0fc921967

SHA1
e2226592e6cebf82f5de1e76380bbb01291344bb

SHA256
e62936b1d28e5d77393275f6075ec71d424568469a2c7b6cec687553aeacfb22

SHA512
20f3f6b77bf6fb5c090730410bd110c017a92a9cae407850d9c254491fd0aca2d14ef7c3b94ca112ca6725360d2264188a335addd8c79d4b7ffde0832a0bbe8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ED4E.exe

Filesize
728KB

MD5
b5a49d7c6a9c31248c0676d0fc921967

SHA1
e2226592e6cebf82f5de1e76380bbb01291344bb

SHA256
e62936b1d28e5d77393275f6075ec71d424568469a2c7b6cec687553aeacfb22

SHA512
20f3f6b77bf6fb5c090730410bd110c017a92a9cae407850d9c254491fd0aca2d14ef7c3b94ca112ca6725360d2264188a335addd8c79d4b7ffde0832a0bbe8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ED4E.exe

Filesize
728KB

MD5
b5a49d7c6a9c31248c0676d0fc921967

SHA1
e2226592e6cebf82f5de1e76380bbb01291344bb

SHA256
e62936b1d28e5d77393275f6075ec71d424568469a2c7b6cec687553aeacfb22

SHA512
20f3f6b77bf6fb5c090730410bd110c017a92a9cae407850d9c254491fd0aca2d14ef7c3b94ca112ca6725360d2264188a335addd8c79d4b7ffde0832a0bbe8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ED4E.exe

Filesize
728KB

MD5
b5a49d7c6a9c31248c0676d0fc921967

SHA1
e2226592e6cebf82f5de1e76380bbb01291344bb

SHA256
e62936b1d28e5d77393275f6075ec71d424568469a2c7b6cec687553aeacfb22

SHA512
20f3f6b77bf6fb5c090730410bd110c017a92a9cae407850d9c254491fd0aca2d14ef7c3b94ca112ca6725360d2264188a335addd8c79d4b7ffde0832a0bbe8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EF81.exe

Filesize
1.2MB

MD5
5b293206e810d2871736e1ecbd9cc196

SHA1
47c0baadfba1876cb8ffdff6f057f16f2076197f

SHA256
f31ce717ef107b5c0901a0c8581553b71ad7a09180e28a1575b0955905519628

SHA512
110ae30f84747fb35cc75f6b2608aea5f90f25c3b2c49105deedc121d2ab8036949f58acc3d436b5d4584c9c1a7a30bac74f501b786f4e71d6414950d19fbb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\EF81.exe

Filesize
1.2MB

MD5
5b293206e810d2871736e1ecbd9cc196

SHA1
47c0baadfba1876cb8ffdff6f057f16f2076197f

SHA256
f31ce717ef107b5c0901a0c8581553b71ad7a09180e28a1575b0955905519628

SHA512
110ae30f84747fb35cc75f6b2608aea5f90f25c3b2c49105deedc121d2ab8036949f58acc3d436b5d4584c9c1a7a30bac74f501b786f4e71d6414950d19fbb32

Download Submit
C:\Users\Admin\AppData\Local\efa87c00-f24a-495e-9ec1-c8a15569e935\ED4E.exe

Filesize
728KB

MD5
b5a49d7c6a9c31248c0676d0fc921967

SHA1
e2226592e6cebf82f5de1e76380bbb01291344bb

SHA256
e62936b1d28e5d77393275f6075ec71d424568469a2c7b6cec687553aeacfb22

SHA512
20f3f6b77bf6fb5c090730410bd110c017a92a9cae407850d9c254491fd0aca2d14ef7c3b94ca112ca6725360d2264188a335addd8c79d4b7ffde0832a0bbe8c

Download Submit
C:\Users\Admin\AppData\Roaming\actuwjt

Filesize
237KB

MD5
a0dc2db849379678c981ff38e6864db0

SHA1
df1684b25e0fe4af92b0cf0cf4e6dfcac795f458

SHA256
eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d

SHA512
6caaf092866e0a1c272adb6790042e0480b621c089701f16c3efd2cabd14874560180ee3d7fa460ee22074a3dfed3a88e72272b479978be85dfb7037cb01ad6b

Download Submit
memory/632-64-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/632-91-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/632-61-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download
memory/632-62-0x0000000000820000-0x000000000082B000-memory.dmp

Filesize
44KB

Download
memory/1184-117-0x00007FF7ECBD0000-0x00007FF7ED521000-memory.dmp

Filesize
9.3MB

Download
memory/1184-122-0x00007FF7ECBD0000-0x00007FF7ED521000-memory.dmp

Filesize
9.3MB

Download
memory/1184-93-0x00007FF7ECBD0000-0x00007FF7ED521000-memory.dmp

Filesize
9.3MB

Download
memory/1328-20-0x00000000047C0000-0x000000000485F000-memory.dmp

Filesize
636KB

Download
memory/1328-21-0x00000000049A0000-0x0000000004ABB000-memory.dmp

Filesize
1.1MB

Download
memory/1592-101-0x0000000002530000-0x0000000002631000-memory.dmp

Filesize
1.0MB

Download
memory/1592-105-0x0000000002530000-0x0000000002631000-memory.dmp

Filesize
1.0MB

Download
memory/1592-66-0x0000000010000000-0x0000000010251000-memory.dmp

Filesize
2.3MB

Download
memory/1592-102-0x0000000002530000-0x0000000002631000-memory.dmp

Filesize
1.0MB

Download
memory/1592-88-0x0000000000AB0000-0x0000000000BCB000-memory.dmp

Filesize
1.1MB

Download
memory/1592-104-0x0000000002530000-0x0000000002631000-memory.dmp

Filesize
1.0MB

Download
memory/1592-65-0x0000000000790000-0x0000000000796000-memory.dmp

Filesize
24KB

Download
memory/1644-5-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/1644-2-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/1644-3-0x0000000000820000-0x000000000082B000-memory.dmp

Filesize
44KB

Download
memory/1644-1-0x00000000008A0000-0x00000000009A0000-memory.dmp

Filesize
1024KB

Download
memory/1812-157-0x0000000008AD0000-0x0000000008AEE000-memory.dmp

Filesize
120KB

Download
memory/1812-126-0x0000000073790000-0x0000000073F40000-memory.dmp

Filesize
7.7MB

Download
memory/1812-127-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1812-132-0x0000000073790000-0x0000000073F40000-memory.dmp

Filesize
7.7MB

Download
memory/1812-133-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1812-159-0x0000000073790000-0x0000000073F40000-memory.dmp

Filesize
7.7MB

Download
memory/1812-121-0x0000000000580000-0x00000000005DA000-memory.dmp

Filesize
360KB

Download
memory/1812-135-0x0000000004BF0000-0x0000000004C66000-memory.dmp

Filesize
472KB

Download
memory/3076-82-0x0000000007BB0000-0x0000000007C42000-memory.dmp

Filesize
584KB

Download
memory/3076-87-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

Filesize
40KB

Download
memory/3076-94-0x0000000008C30000-0x0000000009248000-memory.dmp

Filesize
6.1MB

Download
memory/3076-96-0x0000000008610000-0x000000000871A000-memory.dmp

Filesize
1.0MB

Download
memory/3076-98-0x0000000007E90000-0x0000000007EA2000-memory.dmp

Filesize
72KB

Download
memory/3076-99-0x0000000007EF0000-0x0000000007F2C000-memory.dmp

Filesize
240KB

Download
memory/3076-100-0x0000000007F30000-0x0000000007F7C000-memory.dmp

Filesize
304KB

Download
memory/3076-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3076-73-0x0000000073790000-0x0000000073F40000-memory.dmp

Filesize
7.7MB

Download
memory/3076-160-0x0000000009AF0000-0x0000000009B40000-memory.dmp

Filesize
320KB

Download
memory/3076-86-0x0000000007D00000-0x0000000007D10000-memory.dmp

Filesize
64KB

Download
memory/3076-108-0x0000000073790000-0x0000000073F40000-memory.dmp

Filesize
7.7MB

Download
memory/3076-110-0x00000000087B0000-0x0000000008816000-memory.dmp

Filesize
408KB

Download
memory/3076-111-0x0000000007D00000-0x0000000007D10000-memory.dmp

Filesize
64KB

Download
memory/3076-155-0x0000000009E20000-0x000000000A34C000-memory.dmp

Filesize
5.2MB

Download
memory/3076-136-0x0000000009720000-0x00000000098E2000-memory.dmp

Filesize
1.8MB

Download
memory/3076-78-0x0000000008060000-0x0000000008604000-memory.dmp

Filesize
5.6MB

Download
memory/3132-4-0x0000000001390000-0x00000000013A6000-memory.dmp

Filesize
88KB

Download
memory/3132-89-0x0000000008F40000-0x0000000008F56000-memory.dmp

Filesize
88KB

Download
memory/3484-83-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3484-85-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3484-81-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3948-113-0x0000000000EA0000-0x0000000000F15000-memory.dmp

Filesize
468KB

Download
memory/3948-114-0x0000000000E30000-0x0000000000E9B000-memory.dmp

Filesize
428KB

Download
memory/3948-156-0x0000000000E30000-0x0000000000E9B000-memory.dmp

Filesize
428KB

Download
memory/3948-112-0x0000000000E30000-0x0000000000E9B000-memory.dmp

Filesize
428KB

Download
memory/3948-128-0x0000000000EA0000-0x0000000000F15000-memory.dmp

Filesize
468KB

Download
memory/4160-77-0x0000000004830000-0x00000000048C4000-memory.dmp

Filesize
592KB

Download
memory/4180-120-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/4180-118-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/4180-119-0x0000000000690000-0x0000000000697000-memory.dmp

Filesize
28KB

Download
memory/4324-72-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4324-63-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4324-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4324-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4324-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4324-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download