amadey | ff0500a380008b913b550a84c7ddcc17f4a8c07b6778f24e7dc333988b1fe336

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a1dfe0fb4917f9f6c0585af695ffc45.exe
Size 244KB
Sample240208-wqa3eaae99
SHA256 ff0500a380008b913b550a84c7ddcc17f4a8c07b6778f24e7dc333988b1fe336
MD5 1a1dfe0fb4917f9f6c0585af695ffc45
SHA1 9cfbb619dc98498f9791cf8b759bd1fca6983243
SHA512 0d9d6f4a7f2ea94a4877cf51a35b86141ff9e2ffd855986de097200f1f6bac1fef641275932cd1ea759fc555343ae94d8582cad237b02956758bc2338457e64e
SSDEEP 3072:/wZm1wLxrRmddvRLByDde2D0IifymfM3Md6kbYZQTdNRunrcSO4Dtl16/AaqP:Am1widpLByDdPD0lBfMfZjrNh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

amadey

Version

4.14

http://anfesq.com
http://cbinr.com
http://rimakc.ru

Attributes

install_dir
68fd3d7ade
install_file
Utsysc.exe
strings_key
27ec7fd6f50f63b8af0c1d3deefcc8fe
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	FB38.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	Utsysc.exe

Deletes itself 1 IoCs

pid	Process
3516	Process not Found

Executes dropped EXE 3 IoCs

pid	Process
3408	FB38.exe
1344	Utsysc.exe
1976	Utsysc.exe

Loads dropped DLL 3 IoCs

pid	Process
860	rundll32.exe
2548	rundll32.exe
4652	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 34 IoCs

pid	pid_target	Process	procid_target
3020	3408	WerFault.exe	91
1260	3408	WerFault.exe	91
724	3408	WerFault.exe	91
2476	3408	WerFault.exe	91
3784	3408	WerFault.exe	91
2580	3408	WerFault.exe	91
4232	3408	WerFault.exe	91
3224	3408	WerFault.exe	91
1064	3408	WerFault.exe	91
5052	3408	WerFault.exe	91
216	1344	WerFault.exe	111
888	1344	WerFault.exe	111
1040	1344	WerFault.exe	111
2840	1344	WerFault.exe	111
3592	1344	WerFault.exe	111
1168	1344	WerFault.exe	111
860	1344	WerFault.exe	111
2704	1344	WerFault.exe	111
5104	1344	WerFault.exe	111
3920	1344	WerFault.exe	111
4332	1344	WerFault.exe	111
2116	1344	WerFault.exe	111
2972	1344	WerFault.exe	111
4032	1344	WerFault.exe	111
4184	1344	WerFault.exe	111
2948	1344	WerFault.exe	111
492	1344	WerFault.exe	111
2392	1344	WerFault.exe	111
4864	1344	WerFault.exe	111
4584	1344	WerFault.exe	111
4592	1344	WerFault.exe	111
4292	1344	WerFault.exe	111
3260	1976	WerFault.exe	162
4480	1344	WerFault.exe	111

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1a1dfe0fb4917f9f6c0585af695ffc45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1a1dfe0fb4917f9f6c0585af695ffc45.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1a1dfe0fb4917f9f6c0585af695ffc45.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1184	1a1dfe0fb4917f9f6c0585af695ffc45.exe
1184	1a1dfe0fb4917f9f6c0585af695ffc45.exe
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found
3516	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1184	1a1dfe0fb4917f9f6c0585af695ffc45.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3408	FB38.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3408	3516	Process not Found	91
PID 3516 wrote to memory of 3408	3516	Process not Found	91
PID 3516 wrote to memory of 3408	3516	Process not Found	91
PID 3408 wrote to memory of 1344	3408	FB38.exe	111
PID 3408 wrote to memory of 1344	3408	FB38.exe	111
PID 3408 wrote to memory of 1344	3408	FB38.exe	111
PID 1344 wrote to memory of 4880	1344	Utsysc.exe	128
PID 1344 wrote to memory of 4880	1344	Utsysc.exe	128
PID 1344 wrote to memory of 4880	1344	Utsysc.exe	128
PID 1344 wrote to memory of 444	1344	Utsysc.exe	160
PID 1344 wrote to memory of 444	1344	Utsysc.exe	160
PID 1344 wrote to memory of 444	1344	Utsysc.exe	160
PID 1344 wrote to memory of 4028	1344	Utsysc.exe	161
PID 1344 wrote to memory of 4028	1344	Utsysc.exe	161
PID 1344 wrote to memory of 4028	1344	Utsysc.exe	161
PID 1344 wrote to memory of 860	1344	Utsysc.exe	165
PID 1344 wrote to memory of 860	1344	Utsysc.exe	165
PID 1344 wrote to memory of 860	1344	Utsysc.exe	165
PID 1344 wrote to memory of 2548	1344	Utsysc.exe	166
PID 1344 wrote to memory of 2548	1344	Utsysc.exe	166
PID 1344 wrote to memory of 2548	1344	Utsysc.exe	166
PID 1344 wrote to memory of 4652	1344	Utsysc.exe	167
PID 1344 wrote to memory of 4652	1344	Utsysc.exe	167
PID 1344 wrote to memory of 4652	1344	Utsysc.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a1dfe0fb4917f9f6c0585af695ffc45.exe
"C:\Users\Admin\AppData\Local\Temp\1a1dfe0fb4917f9f6c0585af695ffc45.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1184

C:\Users\Admin\AppData\Local\Temp\FB38.exe
C:\Users\Admin\AppData\Local\Temp\FB38.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 584
  2⤵
  - Program crash
  PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 632
  2⤵
  - Program crash
  PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 732
  2⤵
  - Program crash
  PID:724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 820
  2⤵
  - Program crash
  PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 852
  2⤵
  - Program crash
  PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 840
  2⤵
  - Program crash
  PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1100
  2⤵
  - Program crash
  PID:4232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1124
  2⤵
  - Program crash
  PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1244
  2⤵
  - Program crash
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 604
    3⤵
    - Program crash
    PID:216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 816
    3⤵
    - Program crash
    PID:888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 872
    3⤵
    - Program crash
    PID:1040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1012
    3⤵
    - Program crash
    PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 872
    3⤵
    - Program crash
    PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 992
    3⤵
    - Program crash
    PID:1168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 988
    3⤵
    - Program crash
    PID:860
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 936
    3⤵
    - Program crash
    PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1124
    3⤵
    - Program crash
    PID:5104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 640
    3⤵
    - Program crash
    PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1216
    3⤵
    - Program crash
    PID:4332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1232
    3⤵
    - Program crash
    PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1248
    3⤵
    - Program crash
    PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1272
    3⤵
    - Program crash
    PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1280
    3⤵
    - Program crash
    PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1316
    3⤵
    - Program crash
    PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1312
    3⤵
    - Program crash
    PID:492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1548
    3⤵
    - Program crash
    PID:2392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1692
    3⤵
    - Program crash
    PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1688
    3⤵
    - Program crash
    PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1032
    3⤵
    - Program crash
    PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 640
    3⤵
    - Program crash
    PID:4292
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    PID:444
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:860
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:2548
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1236
    3⤵
    - Program crash
    PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1648
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3408 -ip 3408
1⤵
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3408 -ip 3408
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3408 -ip 3408
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3408 -ip 3408
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3408 -ip 3408
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3408 -ip 3408
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3408 -ip 3408
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3408 -ip 3408
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3408 -ip 3408
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3408 -ip 3408
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1344 -ip 1344
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1344 -ip 1344
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1344 -ip 1344
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1344 -ip 1344
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1344 -ip 1344
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1344 -ip 1344
1⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1344 -ip 1344
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1344 -ip 1344
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1344 -ip 1344
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1344 -ip 1344
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1344 -ip 1344
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1344 -ip 1344
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1344 -ip 1344
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1344 -ip 1344
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1344 -ip 1344
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1344 -ip 1344
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1344 -ip 1344
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1344 -ip 1344
1⤵
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1344 -ip 1344
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1344 -ip 1344
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1344 -ip 1344
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1344 -ip 1344
1⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
1⤵
- Executes dropped EXE
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 432
  2⤵
  - Program crash
  PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1976 -ip 1976
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1344 -ip 1344
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

356085813370

Path C:\Users\Admin\AppData\Local\Temp\356085813370
Size 74KB
SHA256 81bcea8b6fc3799b17c20b740cdfaece966056607b3287790b0b82241c8ffb9e
MD5 c47e1e8ff1d80bb161807e998a8a713a
SHA1 d45acdfda1bd2c6b827b6cae3f2f49abee1fab8f
SHA512 c5552ad2e12400d419e7708f000a7815966338a72aad8458d314e4e8fc8a0452779f138a0aed97501a54ca9e70776c8c8985979ad12fd9f37af8119ce6a34d17
SSDEEP 1536:saub6Lcad97ev7cz8tAzpLE6cAd7sqwGqvo+oqs8FmfGT8fN3R:pux/7c11dZ7sqfqvo+oqIfGgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

FB38.exe

Path C:\Users\Admin\AppData\Local\Temp\FB38.exe
Size 349KB
SHA256 6060ce8f51a10ae5ebc3b2c8dbdccca2fe30e626652f170bca0a1b2256f5464b
MD5 d713561644bc8d1c46520cebc01358fb
SHA1 fe1c875267ab7e66fc2831d95e513d73bbb1cb47
SHA512 750bba5febe4275606400ffb8dd14332858c132bec0113f9970298f3f1c809a01483349eddf0330c77d6c16d7bee412a7e246d59b987b2a385c6d23067c0bad8
SSDEEP 6144:w3hATyb78RwGAGDebIWQjoN2j1f+4+GSAkrOWzNCU2OC:MATfwGCbIWSj1fvSAkrOyUOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll
Size 102KB
SHA256 97e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
MD5 4194e9b8b694b1e9b672c36f0d868e32
SHA1 252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA512 f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
SSDEEP 3072:SbEDxEOC3+EX4W2sosmLWuQRAwQrT7xUCYNS60Z:iM7HQ+sCWuQRYoNS60Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll
Size 66KB
SHA256 3ba0df6fcda86029371ccf65eb0504b532ea3858b26bdf7dedbbefb5b896db18
MD5 e5b11787373e9caac1adf453993f1c2a
SHA1 d5417f6f536a48b1996ef3c3a1f02b161c67b404
SHA512 d1fcca2fa21e16472a7a8b896f5ce97a22e490ee9a755a19f3acd6425c1ee4a66386a6151b8dda85b3ba2cb9c715eddd6d8eebe0101a61281407179068b8b398
SSDEEP 384:576X80bSCJMiv2PGKwt7MlgPJ8lRVzi6gv4o90+GhRAzM2RP6PWFOh0GL3mIaS8h:5+8w1kzi6gAo9CIzRUM/qmrS8Tzui
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-3-0x00000000005A0000-0x00000000005AB000-memory.dmp

Download

memory/1184-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/1184-1-0x0000000000700000-0x0000000000800000-memory.dmp

Download

memory/1184-2-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/1344-35-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-34-0x0000000002D00000-0x0000000002E00000-memory.dmp

Download

memory/1344-39-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-87-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-43-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-89-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-55-0x0000000002D00000-0x0000000002E00000-memory.dmp

Download

memory/1344-56-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-91-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-68-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1344-69-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/1976-72-0x0000000002D80000-0x0000000002E80000-memory.dmp

Download

memory/1976-73-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/3408-16-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

Download

memory/3408-37-0x0000000004850000-0x00000000048BF000-memory.dmp

Download

memory/3408-36-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/3408-18-0x0000000000400000-0x0000000002C04000-memory.dmp

Download

memory/3408-17-0x0000000004850000-0x00000000048BF000-memory.dmp

Download

memory/3516-4-0x0000000002B30000-0x0000000002B46000-memory.dmp

Download