amadey | d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe
Size 231KB
Sample240211-psv22aab86
SHA256 d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04
MD5 1e9fc57e2d3485ebf1a6644a102eec0f
SHA1 e05afe6f6cbade9f047da2aae7fabf2597d0c59a
SHA512 d04c73a2e87ddb83bb562e461a35d7ae789f28db29da6955b0177a057ca35c096e448087a466e507b62582df411047dc4cbe4a72461dca825b9698017fc60163
SSDEEP 3072:EsU0xrEjyAKH3BbOIFHKcsuaIeuIu0dq30JIdwUXM7U5dCOzpD:5ayAm1OIBMIIX0wEwQDz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey smokeloader pub3 backdoor collection discovery spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

amadey

Version

4.14

http://anfesq.com
http://cbinr.com
http://rimakc.ru

Attributes

install_dir
68fd3d7ade
install_file
Utsysc.exe
strings_key
27ec7fd6f50f63b8af0c1d3deefcc8fe
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	D6F7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	Utsysc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	A4D.exe

Deletes itself 1 IoCs

pid	Process
3524	Process not Found

Executes dropped EXE 5 IoCs

pid	Process
1884	D6F7.exe
116	Utsysc.exe
1532	A4D.exe
2004	Utsysc.exe
3512	Utsysc.exe

Loads dropped DLL 9 IoCs

pid	Process
1304	rundll32.exe
3056	rundll32.exe
1804	rundll32.exe
2924	rundll32.exe
1736	rundll32.exe
1744	rundll32.exe
780	rundll32.exe
4364	rundll32.exe
932	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	api.ipify.org
77	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 35 IoCs

pid	pid_target	Process	procid_target
2972	1884	WerFault.exe	94
1176	1884	WerFault.exe	94
4140	1884	WerFault.exe	94
4068	1884	WerFault.exe	94
4812	1884	WerFault.exe	94
4036	1884	WerFault.exe	94
4588	1884	WerFault.exe	94
3896	1884	WerFault.exe	94
4144	1884	WerFault.exe	94
3836	1884	WerFault.exe	94
4436	1884	WerFault.exe	94
1476	116	WerFault.exe	117
3784	116	WerFault.exe	117
852	1884	WerFault.exe	94
3272	116	WerFault.exe	117
3592	116	WerFault.exe	117
4088	116	WerFault.exe	117
3232	116	WerFault.exe	117
2532	116	WerFault.exe	117
4504	116	WerFault.exe	117
2572	116	WerFault.exe	117
4952	116	WerFault.exe	117
3004	116	WerFault.exe	117
3632	116	WerFault.exe	117
2016	116	WerFault.exe	117
1576	116	WerFault.exe	117
3580	116	WerFault.exe	117
3040	116	WerFault.exe	117
2692	116	WerFault.exe	117
4132	116	WerFault.exe	117
1696	116	WerFault.exe	117
904	2004	WerFault.exe	162
5020	116	WerFault.exe	117
824	3512	WerFault.exe	185
3684	116	WerFault.exe	117

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1368	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
856	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4328	d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe
4328	d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4328	d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	D6F7.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1884	3524	Process not Found	94
PID 3524 wrote to memory of 1884	3524	Process not Found	94
PID 3524 wrote to memory of 1884	3524	Process not Found	94
PID 1884 wrote to memory of 116	1884	D6F7.exe	117
PID 1884 wrote to memory of 116	1884	D6F7.exe	117
PID 1884 wrote to memory of 116	1884	D6F7.exe	117
PID 116 wrote to memory of 1368	116	Utsysc.exe	135
PID 116 wrote to memory of 1368	116	Utsysc.exe	135
PID 116 wrote to memory of 1368	116	Utsysc.exe	135
PID 3524 wrote to memory of 1532	3524	Process not Found	161
PID 3524 wrote to memory of 1532	3524	Process not Found	161
PID 116 wrote to memory of 1304	116	Utsysc.exe	165
PID 116 wrote to memory of 1304	116	Utsysc.exe	165
PID 116 wrote to memory of 1304	116	Utsysc.exe	165
PID 1304 wrote to memory of 3056	1304	rundll32.exe	166
PID 1304 wrote to memory of 3056	1304	rundll32.exe	166
PID 1532 wrote to memory of 4552	1532	A4D.exe	169
PID 1532 wrote to memory of 4552	1532	A4D.exe	169
PID 4552 wrote to memory of 856	4552	cmd.exe	171
PID 4552 wrote to memory of 856	4552	cmd.exe	171
PID 116 wrote to memory of 1804	116	Utsysc.exe	172
PID 116 wrote to memory of 1804	116	Utsysc.exe	172
PID 116 wrote to memory of 1804	116	Utsysc.exe	172
PID 1804 wrote to memory of 2924	1804	rundll32.exe	173
PID 1804 wrote to memory of 2924	1804	rundll32.exe	173
PID 116 wrote to memory of 1736	116	Utsysc.exe	176
PID 116 wrote to memory of 1736	116	Utsysc.exe	176
PID 116 wrote to memory of 1736	116	Utsysc.exe	176
PID 1736 wrote to memory of 1744	1736	rundll32.exe	177
PID 1736 wrote to memory of 1744	1736	rundll32.exe	177
PID 116 wrote to memory of 780	116	Utsysc.exe	180
PID 116 wrote to memory of 780	116	Utsysc.exe	180
PID 116 wrote to memory of 780	116	Utsysc.exe	180
PID 116 wrote to memory of 4364	116	Utsysc.exe	181
PID 116 wrote to memory of 4364	116	Utsysc.exe	181
PID 116 wrote to memory of 4364	116	Utsysc.exe	181
PID 116 wrote to memory of 932	116	Utsysc.exe	182
PID 116 wrote to memory of 932	116	Utsysc.exe	182
PID 116 wrote to memory of 932	116	Utsysc.exe	182

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	A4D.exe

C:\Users\Admin\AppData\Local\Temp\d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe
"C:\Users\Admin\AppData\Local\Temp\d938ef8e52299d413f1bdb810c2267a4355e86a549dfbf9bb439f6420dd5cf04.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4328

C:\Users\Admin\AppData\Local\Temp\D6F7.exe
C:\Users\Admin\AppData\Local\Temp\D6F7.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 596
  2⤵
  - Program crash
  PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 680
  2⤵
  - Program crash
  PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 736
  2⤵
  - Program crash
  PID:4140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 860
  2⤵
  - Program crash
  PID:4068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 844
  2⤵
  - Program crash
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 864
  2⤵
  - Program crash
  PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1036
  2⤵
  - Program crash
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1164
  2⤵
  - Program crash
  PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1216
  2⤵
  - Program crash
  PID:4144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1560
  2⤵
  - Program crash
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 624
    3⤵
    - Program crash
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 744
    3⤵
    - Program crash
    PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 932
    3⤵
    - Program crash
    PID:3272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1004
    3⤵
    - Program crash
    PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 884
    3⤵
    - Program crash
    PID:4088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1036
    3⤵
    - Program crash
    PID:3232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1032
    3⤵
    - Program crash
    PID:2532
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 920
    3⤵
    - Program crash
    PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 612
    3⤵
    - Program crash
    PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 920
    3⤵
    - Program crash
    PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1208
    3⤵
    - Program crash
    PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1220
    3⤵
    - Program crash
    PID:3632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1216
    3⤵
    - Program crash
    PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1252
    3⤵
    - Program crash
    PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1284
    3⤵
    - Program crash
    PID:3580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1396
    3⤵
    - Program crash
    PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1436
    3⤵
    - Program crash
    PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1288
    3⤵
    - Program crash
    PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1556
    3⤵
    - Program crash
    PID:1696
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:3056
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2924
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1744
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:780
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4364
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1732
    3⤵
    - Program crash
    PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1028
    3⤵
    - Program crash
    PID:3684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 728
  2⤵
  - Program crash
  PID:4436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 648
  2⤵
  - Program crash
  PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1884 -ip 1884
1⤵
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1884 -ip 1884
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1884 -ip 1884
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1884 -ip 1884
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1884 -ip 1884
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1884 -ip 1884
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1884 -ip 1884
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1884 -ip 1884
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1884 -ip 1884
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1884 -ip 1884
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 116 -ip 116
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 116 -ip 116
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1884 -ip 1884
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 116 -ip 116
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 116 -ip 116
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 116 -ip 116
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 116 -ip 116
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 116 -ip 116
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 116 -ip 116
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 116 -ip 116
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 116 -ip 116
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 116 -ip 116
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 116 -ip 116
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 116 -ip 116
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 116 -ip 116
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 116 -ip 116
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 116 -ip 116
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 116 -ip 116
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 116 -ip 116
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 116 -ip 116
1⤵
PID:3664

C:\Users\Admin\AppData\Local\Temp\A4D.exe
C:\Users\Admin\AppData\Local\Temp\A4D.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A4D.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:856

C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
1⤵
- Executes dropped EXE
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 444
  2⤵
  - Program crash
  PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2004 -ip 2004
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 116 -ip 116
1⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
1⤵
- Executes dropped EXE
PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 444
  2⤵
  - Program crash
  PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3512 -ip 3512
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 116 -ip 116
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

791175113106

Path C:\Users\Admin\AppData\Local\Temp\791175113106
Size 76KB
SHA256 baac61140bb41c4cd24b7a706bcb6ecd8dbe69f62a909a6ce4f3da03ed467e05
MD5 2d00009922a049b8d5efb557e5e76749
SHA1 f3d89f7b7c4068bd44200944341038829ee7e617
SHA512 9da0ce5fc95f6d9429ba3a9638f2718b00835644a630b8afa71b4705155bcd488be4d97d750a84d9e92b03935d83e28047fef6ea23496bb115241c7cbd2c6073
SSDEEP 1536:sugNVkjW9zBJeaIIZQSRGoBR8caMc8iM26wwTp6YQ/6d:+k6OaFQSRGi6caMc8L26wwAqd
MD5 SHA1 SHA512 SSDEEP

Submit Download

A4D.exe

Path C:\Users\Admin\AppData\Local\Temp\A4D.exe
Size 1.5MB
SHA256 32a99da5f96e8cc9b48d57838e133c001e6f40b706ffa69dace5edfe1ae82d14
MD5 f7ed576f6323369201afbecb7c2db04e
SHA1 7a46c6b9746488b3053ed5a8cccb184a743b6f2a
SHA512 6b043632070d216f9dcd59ee9d27ad04ceecdf5ccfa1287cba5799eb3ea3ac30fcb9b86d25dada29d9541c0949ddf255b12b6753ad20ed57123081501dd8986b
SSDEEP 24576:2WdsFTXC4NvGxoydoDkNkwwZGX2JDlQlCQrDHjXav8nu1quDo:wFTXC49+oydoD23X2JhQlr7vuDo
MD5 SHA1 SHA512 SSDEEP

Submit Download

D6F7.exe

Path C:\Users\Admin\AppData\Local\Temp\D6F7.exe
Size 380KB
SHA256 eff4277928c25b245dc7271d6a8853422a0eec67bd87578f989a59f362f31a31
MD5 7f4a3968a2d1d219d8e4f73919d8f01b
SHA1 6f91ae025366beda6373f5916b999cb514b93047
SHA512 971ab6e2d94a3243090a18006b6e9b8a21785e4a6b660c09284b2fc4d0e0f484ed13a3e07e1b70bd0d43d069a9d5571a0f9eca4ec0532480b38c5aa96d22dae0
SSDEEP 6144:C97a9MP/LCx+6QhWe1s7s0RpaactWm270tC4D5MzG9CbU:T6/LuRlegfgtV1CE5Mz2C
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll
Size 102KB
SHA256 97e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
MD5 4194e9b8b694b1e9b672c36f0d868e32
SHA1 252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA512 f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
SSDEEP 3072:SbEDxEOC3+EX4W2sosmLWuQRAwQrT7xUCYNS60Z:iM7HQ+sCWuQRYoNS60Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll
Size 1.1MB
SHA256 83ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
MD5 f01f5bc76b9596e0cfeab8a272cba3a5
SHA1 19cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA512 ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
SSDEEP 24576:Pc6CX/YqLAS81Un+J35XBMpZ9+Jo73Jw/tDMX/td:rqLAS81UnI5XQZ92ogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-136-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-124-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-121-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-116-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-35-0x0000000002140000-0x00000000021AF000-memory.dmp

Download

memory/116-36-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-34-0x0000000000540000-0x0000000000640000-memory.dmp

Download

memory/116-84-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-138-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-140-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-101-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/116-100-0x0000000000540000-0x0000000000640000-memory.dmp

Download

memory/1532-91-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-57-0x00007FF70BF80000-0x00007FF70BF81000-memory.dmp

Download

memory/1532-90-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-118-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-92-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-93-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-96-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-117-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-86-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1532-89-0x00007FF78BE70000-0x00007FF78BFFD000-memory.dmp

Download

memory/1884-37-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/1884-18-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/1884-17-0x00000000007E0000-0x000000000084F000-memory.dmp

Download

memory/1884-16-0x0000000000850000-0x0000000000950000-memory.dmp

Download

memory/2004-102-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2004-99-0x00000000004B0000-0x00000000005B0000-memory.dmp

Download

memory/3512-143-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download

memory/3512-144-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3524-4-0x0000000002EB0000-0x0000000002EC6000-memory.dmp

Download

memory/4328-2-0x0000000002190000-0x000000000219B000-memory.dmp

Download

memory/4328-5-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/4328-3-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/4328-1-0x00000000006B0000-0x00000000007B0000-memory.dmp

Download