amadey | 7f91b0066e36a8a2555c2a65bac5c760ceadd130fa3a1962a7de7cbed78dcfa3

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe
Size

1.5MB
MD5

380ee9a587e65797b4ceca5871ef37a5
SHA1

aff15c787ee6fb8765730aec417bbc0a1751c4bc
SHA256

bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03
SHA512

873c11818b0abd2d7ef02d50351b4f82b26d191e61d2bb40229811b39a0e4f31add06de80e94d76685fc94e6b8ea9cfe3adbeff6d9e7533e610d4a34c7891d5f
SSDEEP

24576:zyz3oBK18C/qnEE2+rj+RIYtLip+FxSLjps0eRcmMZ/wQR4:GzB8CVH40tOpqIJbZIQR

Score

10^/10

amadey mystic redline smokeloader homed backdoor evasion infostealer persistence stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

homed

109.107.182.133:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023354-37.dat	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2792-52-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	5oa8II8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	6Lt3VT0.exe

Executes dropped EXE 14 IoCs

pid	Process
880	Ak6Yi19.exe
2400	oM9lc00.exe
3204	BV6UL24.exe
2248	rQ3ll10.exe
1668	1Sv36TS9.exe
2608	2Nz7315.exe
4060	3dT74fJ.exe
3316	4Qs102UZ.exe
2164	5oa8II8.exe
4480	explothe.exe
2160	6Lt3VT0.exe
1712	explothe.exe
4144	explothe.exe
4532	ujabdtb

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023348-72.dat	upx
behavioral1/memory/2160-74-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2160-84-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ak6Yi19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	oM9lc00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	BV6UL24.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	rQ3ll10.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 3928	1668	1Sv36TS9.exe	99
PID 4060 set thread context of 2316	4060	3dT74fJ.exe	102
PID 3316 set thread context of 2792	3316	4Qs102UZ.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4084	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{A113F9C5-010A-4716-A45F-76FA892FD1C2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2316	AppLaunch.exe
2316	AppLaunch.exe
3928	AppLaunch.exe
3928	AppLaunch.exe
3928	AppLaunch.exe
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found
3404	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2316	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	AppLaunch.exe
Token: SeShutdownPrivilege	3404	Process not Found
Token: SeCreatePagefilePrivilege	3404	Process not Found
Token: SeShutdownPrivilege	3404	Process not Found
Token: SeCreatePagefilePrivilege	3404	Process not Found
Token: SeShutdownPrivilege	3404	Process not Found
Token: SeCreatePagefilePrivilege	3404	Process not Found
Token: SeShutdownPrivilege	3404	Process not Found
Token: SeCreatePagefilePrivilege	3404	Process not Found
Token: SeShutdownPrivilege	3404	Process not Found
Token: SeCreatePagefilePrivilege	3404	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3404	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 880	1476	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe	94
PID 1476 wrote to memory of 880	1476	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe	94
PID 1476 wrote to memory of 880	1476	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe	94
PID 880 wrote to memory of 2400	880	Ak6Yi19.exe	95
PID 880 wrote to memory of 2400	880	Ak6Yi19.exe	95
PID 880 wrote to memory of 2400	880	Ak6Yi19.exe	95
PID 2400 wrote to memory of 3204	2400	oM9lc00.exe	96
PID 2400 wrote to memory of 3204	2400	oM9lc00.exe	96
PID 2400 wrote to memory of 3204	2400	oM9lc00.exe	96
PID 3204 wrote to memory of 2248	3204	BV6UL24.exe	97
PID 3204 wrote to memory of 2248	3204	BV6UL24.exe	97
PID 3204 wrote to memory of 2248	3204	BV6UL24.exe	97
PID 2248 wrote to memory of 1668	2248	rQ3ll10.exe	98
PID 2248 wrote to memory of 1668	2248	rQ3ll10.exe	98
PID 2248 wrote to memory of 1668	2248	rQ3ll10.exe	98
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 1668 wrote to memory of 3928	1668	1Sv36TS9.exe	99
PID 2248 wrote to memory of 2608	2248	rQ3ll10.exe	100
PID 2248 wrote to memory of 2608	2248	rQ3ll10.exe	100
PID 2248 wrote to memory of 2608	2248	rQ3ll10.exe	100
PID 3204 wrote to memory of 4060	3204	BV6UL24.exe	101
PID 3204 wrote to memory of 4060	3204	BV6UL24.exe	101
PID 3204 wrote to memory of 4060	3204	BV6UL24.exe	101
PID 4060 wrote to memory of 2316	4060	3dT74fJ.exe	102
PID 4060 wrote to memory of 2316	4060	3dT74fJ.exe	102
PID 4060 wrote to memory of 2316	4060	3dT74fJ.exe	102
PID 4060 wrote to memory of 2316	4060	3dT74fJ.exe	102
PID 4060 wrote to memory of 2316	4060	3dT74fJ.exe	102
PID 4060 wrote to memory of 2316	4060	3dT74fJ.exe	102
PID 2400 wrote to memory of 3316	2400	oM9lc00.exe	103
PID 2400 wrote to memory of 3316	2400	oM9lc00.exe	103
PID 2400 wrote to memory of 3316	2400	oM9lc00.exe	103
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 3316 wrote to memory of 2792	3316	4Qs102UZ.exe	108
PID 880 wrote to memory of 2164	880	Ak6Yi19.exe	109
PID 880 wrote to memory of 2164	880	Ak6Yi19.exe	109
PID 880 wrote to memory of 2164	880	Ak6Yi19.exe	109
PID 2164 wrote to memory of 4480	2164	5oa8II8.exe	110
PID 2164 wrote to memory of 4480	2164	5oa8II8.exe	110
PID 2164 wrote to memory of 4480	2164	5oa8II8.exe	110
PID 1476 wrote to memory of 2160	1476	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe	111
PID 1476 wrote to memory of 2160	1476	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe	111
PID 1476 wrote to memory of 2160	1476	bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe	111
PID 4480 wrote to memory of 4084	4480	explothe.exe	112
PID 4480 wrote to memory of 4084	4480	explothe.exe	112
PID 4480 wrote to memory of 4084	4480	explothe.exe	112
PID 2160 wrote to memory of 4768	2160	6Lt3VT0.exe	114
PID 2160 wrote to memory of 4768	2160	6Lt3VT0.exe	114
PID 4480 wrote to memory of 4424	4480	explothe.exe	116
PID 4480 wrote to memory of 4424	4480	explothe.exe	116
PID 4480 wrote to memory of 4424	4480	explothe.exe	116
PID 4424 wrote to memory of 4428	4424	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe
"C:\Users\Admin\AppData\Local\Temp\bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ak6Yi19.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ak6Yi19.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oM9lc00.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oM9lc00.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\BV6UL24.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\BV6UL24.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rQ3ll10.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rQ3ll10.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Sv36TS9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Sv36TS9.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Nz7315.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Nz7315.exe
        6⤵
        Executes dropped EXE
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3dT74fJ.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3dT74fJ.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4060
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Qs102UZ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Qs102UZ.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5oa8II8.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5oa8II8.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
      "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4424
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4428
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        6⤵
        
        PID:3112
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        6⤵
        
        PID:3188
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        6⤵
        
        PID:2832
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        6⤵
        
        PID:3652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lt3VT0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lt3VT0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\92CA.tmp\92CB.tmp\92CC.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lt3VT0.exe"
    3⤵
    PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4056 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:1
1⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5716 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:1
1⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3788 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4832 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:1
1⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5808 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:1
1⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6028 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:1
1⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6148 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:1
1⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6456 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6448 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6768 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6860 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3928

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5500 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:1356

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Users\Admin\AppData\Roaming\ujabdtb
C:\Users\Admin\AppData\Roaming\ujabdtb
1⤵
- Executes dropped EXE
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\92CA.tmp\92CB.tmp\92CC.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lt3VT0.exe

Filesize
45KB

MD5
2af6f7458ae29f319936d47fcccb0f86

SHA1
8ccfe83c81b8fe91978fef5b27fa90a20d0beeae

SHA256
b3087f728b6a577e5cccc4452308e0dc2509cd8f894c55fd666b75c925cd570c

SHA512
f43e28f39df0e37f117ba5bec4f51b48015f80f5226d73f00795a101d9fe45a288d093ed0450c5afab2f077dca78a673beaed73319942c8095cfe8500b2fd7e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ak6Yi19.exe

Filesize
1.4MB

MD5
1b6df1136e5f0f0c8834007e5c1ccfe7

SHA1
ed33689ca3f2e27a66b961da1b6546b2f379c7d7

SHA256
cf2baa4d5d1b68e299edc927ea5256aa4e8c215fd2b10e4e4905799e0b69b4cb

SHA512
f7b84a073d0dc6c158661431390f278af4c140220c53d7190fa145e2d522fe19812b7ef44c0dfb3855ccf6f5253964fc594a58e15e789f52a03ea808d1b969cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5oa8II8.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oM9lc00.exe

Filesize
1.2MB

MD5
509d1929fd804bb6625da8a8c3e7d82d

SHA1
17fe8baf1af75792f62d5bb0d9f6cca51ba75c16

SHA256
57956b1ed833f226e17944154d2b8c9d7af0dae3cca03b195ac2227d48b64719

SHA512
6695a095d49b775ebfcd5dbd30d3bff3da5329af05ca3c6e5ed222f175ace885bce6b251f807cc28796d9f553b91df6c9dc7e9d0b4797ecc2b9515af85a905f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Qs102UZ.exe

Filesize
1.1MB

MD5
408142150615ac9ec9fffa52a667cab7

SHA1
58e136f41fc5b754b0372e34679f41b4ca931fd9

SHA256
693bede9cea5901b6b60bbf4d78c08d00bc9b3a3c06a431f86a3f96f569260a8

SHA512
5e28bdbbacc34bcddf37df672fcbfc85f7b165e4eabf2b63fbb0b3eeaf923b6819c9272962835d0af8c6b83ebff9263ecdfc2a42b27624a2c1097fdd323396da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\BV6UL24.exe

Filesize
820KB

MD5
ec81f8e43fcf7ef77fda8bbadf597b84

SHA1
1513e8e9137680c076970b284cb87b5b3f8ef6bc

SHA256
e1df1a0f6f2d4668f94304f040477f9e176f46c1a058301cd4d2225f672d1a72

SHA512
c3f38d7840562395373f9d552ccd38513e784f609d0931c24803040acde2ea71143ff35ab0653def43187f760a8b247d3e09c34cd27d5bd9aaf1af009a5000ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3dT74fJ.exe

Filesize
897KB

MD5
2e3f17e7e9001ff7b7cf8ab412462a48

SHA1
2a49c0e715ecd73ccd9d0fcfb21de36cc3ee03ba

SHA256
674e07c8188ea9be50a002c9850c7704541b44b35adc7528216dc73dd4a531b8

SHA512
d42e8a4801f1c73733b37efb5ae17f321bd5463829ab9283566f38882624e284ff4c7c53b212c35ca53f9de825625a455393012ffbdc0e4caebd178fc716ee27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rQ3ll10.exe

Filesize
458KB

MD5
0079b31ca14f399c84cf54b643b54cac

SHA1
d65bb341ac6f99e8bb9818a0e82895c994a4d3ed

SHA256
ee392ce4664c7c931ae3e0423e5df09bd5ee968e54d2d6bd96bb41e2a5c7297e

SHA512
6b169144ee21ed7da4ee4e7986e22605c6a22e0d807c2e362dde89012cfcaa076cb14a3d8185da1e2ea4bc2607b717b008f4b94066108312974f2cc0bd51e5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Sv36TS9.exe

Filesize
875KB

MD5
73d86751a127f28504b4239773c328be

SHA1
a7b5a37edc0841e9a269b827bb0bf28ae0d8c330

SHA256
e0923f519bbf0f9c43922d26954359eed1c352db6deda6e655f838a44d655030

SHA512
464df937ab7ed3a7af81f18d5238019b4268a78dfd8b9d0df6a459c5fd19dfa480c441ce2f20f8b63dcba806e6fc646beaa6b778b52fedee7077739634bad3e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Nz7315.exe

Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
C:\Users\Admin\AppData\Roaming\ujabdtb

Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
memory/2160-84-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2160-74-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2316-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2316-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2316-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-76-0x00000000074A0000-0x00000000075AA000-memory.dmp

Filesize
1.0MB

Download
memory/2792-79-0x0000000007430000-0x000000000747C000-memory.dmp

Filesize
304KB

Download
memory/2792-62-0x00000000072B0000-0x00000000072BA000-memory.dmp

Filesize
40KB

Download
memory/2792-60-0x0000000007110000-0x00000000071A2000-memory.dmp

Filesize
584KB

Download
memory/2792-59-0x00000000076C0000-0x0000000007C64000-memory.dmp

Filesize
5.6MB

Download
memory/2792-73-0x0000000008290000-0x00000000088A8000-memory.dmp

Filesize
6.1MB

Download
memory/2792-56-0x0000000073C70000-0x0000000074420000-memory.dmp

Filesize
7.7MB

Download
memory/2792-77-0x0000000007390000-0x00000000073A2000-memory.dmp

Filesize
72KB

Download
memory/2792-78-0x00000000073F0000-0x000000000742C000-memory.dmp

Filesize
240KB

Download
memory/2792-61-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/2792-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-89-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/2792-88-0x0000000073C70000-0x0000000074420000-memory.dmp

Filesize
7.7MB

Download
memory/3404-48-0x0000000004140000-0x0000000004156000-memory.dmp

Filesize
88KB

Download
memory/3928-82-0x0000000073C70000-0x0000000074420000-memory.dmp

Filesize
7.7MB

Download
memory/3928-42-0x0000000073C70000-0x0000000074420000-memory.dmp

Filesize
7.7MB

Download
memory/3928-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download