amadey | 4b0bfb1fb28ccb99ade42d20e49d3eada7e7d9ea6a7514fe303b430d2e55abcc

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe
Size

1.4MB
MD5

0bc27a2491501ac1f8d8010d8af1071a
SHA1

0e8cc9986c76a986593044e44c2489d675518295
SHA256

ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5
SHA512

e97d2d29eb673ef93db84ec41429917830d4d16d4fef919c3258daac1365b2e7ab75fefa2100ee9586a55cb70f0f85e72e6fe07211b45932d04db1761d3efc7d
SSDEEP

24576:5ye7KjbVGqBXh1pu9+rCDFZTSOO58v2yODPbNbOlcSGO6EC3gf/7qYP2mChCu4hP:szZh+am9eyWPhmtDC3eFP2quI

Score

10^/10

amadey mystic redline smokeloader grome backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2FN2831.exe	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1796-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5Qb5Lp1.exeexplothe.exe6Qc9be5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	5Qb5Lp1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	6Qc9be5.exe

Executes dropped EXE 13 IoCs

Processes:

ue6rA29.exeGt2Af11.exeZA4hP56.exemF1MZ63.exe1pg75EY7.exe2FN2831.exe3oQ78Qa.exe4Ri687QR.exe5Qb5Lp1.exeexplothe.exe6Qc9be5.exeexplothe.exeexplothe.exe

pid	process
1912	ue6rA29.exe
4740	Gt2Af11.exe
1820	ZA4hP56.exe
1940	mF1MZ63.exe
1040	1pg75EY7.exe
2680	2FN2831.exe
2200	3oQ78Qa.exe
5024	4Ri687QR.exe
4304	5Qb5Lp1.exe
1524	explothe.exe
2096	6Qc9be5.exe
4868	explothe.exe
4564	explothe.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mF1MZ63.exeba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exeue6rA29.exeGt2Af11.exeZA4hP56.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	mF1MZ63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ue6rA29.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Gt2Af11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	ZA4hP56.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1pg75EY7.exe4Ri687QR.exe

description	pid	process	target process
PID 1040 set thread context of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 5024 set thread context of 1796	5024	4Ri687QR.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3oQ78Qa.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3oQ78Qa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3oQ78Qa.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3oQ78Qa.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4016 schtasks.exe

pid	process
4016	schtasks.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-817259280-2658881748-983986378-1000\{5B1DC06E-96CC-494E-AFDE-3CF7F0291D7B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

AppLaunch.exe

pid process

908 AppLaunch.exe
908 AppLaunch.exe
908 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 908 AppLaunch.exe

pid	process
908	AppLaunch.exe
908	AppLaunch.exe
908	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	908	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exeue6rA29.exeGt2Af11.exeZA4hP56.exemF1MZ63.exe1pg75EY7.exe4Ri687QR.exe5Qb5Lp1.exe6Qc9be5.exeexplothe.execmd.exe

description	pid	process	target process
PID 2532 wrote to memory of 1912	2532	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe	ue6rA29.exe
PID 2532 wrote to memory of 1912	2532	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe	ue6rA29.exe
PID 2532 wrote to memory of 1912	2532	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe	ue6rA29.exe
PID 1912 wrote to memory of 4740	1912	ue6rA29.exe	Gt2Af11.exe
PID 1912 wrote to memory of 4740	1912	ue6rA29.exe	Gt2Af11.exe
PID 1912 wrote to memory of 4740	1912	ue6rA29.exe	Gt2Af11.exe
PID 4740 wrote to memory of 1820	4740	Gt2Af11.exe	ZA4hP56.exe
PID 4740 wrote to memory of 1820	4740	Gt2Af11.exe	ZA4hP56.exe
PID 4740 wrote to memory of 1820	4740	Gt2Af11.exe	ZA4hP56.exe
PID 1820 wrote to memory of 1940	1820	ZA4hP56.exe	mF1MZ63.exe
PID 1820 wrote to memory of 1940	1820	ZA4hP56.exe	mF1MZ63.exe
PID 1820 wrote to memory of 1940	1820	ZA4hP56.exe	mF1MZ63.exe
PID 1940 wrote to memory of 1040	1940	mF1MZ63.exe	1pg75EY7.exe
PID 1940 wrote to memory of 1040	1940	mF1MZ63.exe	1pg75EY7.exe
PID 1940 wrote to memory of 1040	1940	mF1MZ63.exe	1pg75EY7.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1040 wrote to memory of 908	1040	1pg75EY7.exe	AppLaunch.exe
PID 1940 wrote to memory of 2680	1940	mF1MZ63.exe	2FN2831.exe
PID 1940 wrote to memory of 2680	1940	mF1MZ63.exe	2FN2831.exe
PID 1940 wrote to memory of 2680	1940	mF1MZ63.exe	2FN2831.exe
PID 1820 wrote to memory of 2200	1820	ZA4hP56.exe	3oQ78Qa.exe
PID 1820 wrote to memory of 2200	1820	ZA4hP56.exe	3oQ78Qa.exe
PID 1820 wrote to memory of 2200	1820	ZA4hP56.exe	3oQ78Qa.exe
PID 4740 wrote to memory of 5024	4740	Gt2Af11.exe	4Ri687QR.exe
PID 4740 wrote to memory of 5024	4740	Gt2Af11.exe	4Ri687QR.exe
PID 4740 wrote to memory of 5024	4740	Gt2Af11.exe	4Ri687QR.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 5024 wrote to memory of 1796	5024	4Ri687QR.exe	AppLaunch.exe
PID 1912 wrote to memory of 4304	1912	ue6rA29.exe	5Qb5Lp1.exe
PID 1912 wrote to memory of 4304	1912	ue6rA29.exe	5Qb5Lp1.exe
PID 1912 wrote to memory of 4304	1912	ue6rA29.exe	5Qb5Lp1.exe
PID 4304 wrote to memory of 1524	4304	5Qb5Lp1.exe	explothe.exe
PID 4304 wrote to memory of 1524	4304	5Qb5Lp1.exe	explothe.exe
PID 4304 wrote to memory of 1524	4304	5Qb5Lp1.exe	explothe.exe
PID 2532 wrote to memory of 2096	2532	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe	6Qc9be5.exe
PID 2532 wrote to memory of 2096	2532	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe	6Qc9be5.exe
PID 2532 wrote to memory of 2096	2532	ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe	6Qc9be5.exe
PID 2096 wrote to memory of 3676	2096	6Qc9be5.exe	cmd.exe
PID 2096 wrote to memory of 3676	2096	6Qc9be5.exe	cmd.exe
PID 1524 wrote to memory of 4016	1524	explothe.exe	schtasks.exe
PID 1524 wrote to memory of 4016	1524	explothe.exe	schtasks.exe
PID 1524 wrote to memory of 4016	1524	explothe.exe	schtasks.exe
PID 1524 wrote to memory of 1612	1524	explothe.exe	cmd.exe
PID 1524 wrote to memory of 1612	1524	explothe.exe	cmd.exe
PID 1524 wrote to memory of 1612	1524	explothe.exe	cmd.exe
PID 1612 wrote to memory of 3644	1612	cmd.exe	cmd.exe
PID 1612 wrote to memory of 3644	1612	cmd.exe	cmd.exe
PID 1612 wrote to memory of 3644	1612	cmd.exe	cmd.exe
PID 1612 wrote to memory of 4904	1612	cmd.exe	cacls.exe
PID 1612 wrote to memory of 4904	1612	cmd.exe	cacls.exe
PID 1612 wrote to memory of 4904	1612	cmd.exe	cacls.exe
PID 1612 wrote to memory of 1208	1612	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe
"C:\Users\Admin\AppData\Local\Temp\ba9bf75396aa0b37ebe542ff50745e18cd648bb996480160f4aebe4f262d17d5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ue6rA29.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ue6rA29.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gt2Af11.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gt2Af11.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZA4hP56.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZA4hP56.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mF1MZ63.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mF1MZ63.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pg75EY7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pg75EY7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2FN2831.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2FN2831.exe
        6⤵
        Executes dropped EXE
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3oQ78Qa.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3oQ78Qa.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        
        PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Ri687QR.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Ri687QR.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:1796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Qb5Lp1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Qb5Lp1.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
      "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4016
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3644
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        6⤵
        
        PID:4904
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        6⤵
        
        PID:1208
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4004
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        6⤵
        
        PID:2984
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        6⤵
        
        PID:1392
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Qc9be5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Qc9be5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BA95.tmp\BA96.tmp\BA97.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Qc9be5.exe"
    3⤵
    PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3704 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:1
1⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5760 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:1
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5908 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:1
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5928 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:1
1⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5444 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:1
1⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5752 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6692 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6756 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6436 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BA95.tmp\BA96.tmp\BA97.bat

Filesize
568B

MD5
bcbb9cb105a5466367c5f6ceb38e614a

SHA1
be7f3382e1a4a78428c8285e961c65cefb98affb

SHA256
878c05348c1269420ec01dd070212589b5118eba58a4592f89fc36b2a5860d8d

SHA512
efed12dc71ded17bde4a2f7849ef77d80db75d29c52351f6338f4a9ab5d8b42ba7b9fdca7eb472866819749587f79eb3c6b73e0398f4813b51f300d9a65b0fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Qc9be5.exe

Filesize
87KB

MD5
4d758d7dd4253618b3750dbc02e9ba8f

SHA1
d25c25ed9d0d72199f81690c145a6586136b7a16

SHA256
b4402966b9ecd41ac74a5e6e9632bccc9790d47fadb30e303054be0ed75b05ac

SHA512
76c72f9f4122d5430f6858485573930aea32709570a5b223abf9d1251bbeeff691dbd76e4b32a302c869793598537e57dc8a25a9fb4ce94a6ae0365a73c46bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ue6rA29.exe

Filesize
1.3MB

MD5
07d5a4981604d6c3bcd5a9f7b1f6f4ef

SHA1
a12e9e83a98483bab36e881c5512012c5e848af8

SHA256
7b994d3b12efb064f84f8784324d612c913b1d52446556fd2f564c4e4fed4227

SHA512
ad191363781985d579fe4853281bbc3fa6f950eb88d342818307a5631fce8b9e270f38f0b87d6444eede56d5d59381cabaa6529f4252b6b2285d90a4a37ea275

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Qb5Lp1.exe

Filesize
219KB

MD5
ff32549725de81479d2849fddcaba456

SHA1
e6fd7d684fa167c632f3a666d3213267a0e3eb5a

SHA256
d66bba14a81476dd4cdc0e8a11abe4832c7df1ada84f44a952e2b391f34eb9bd

SHA512
2878b38f535640331ba28633b0cf8c27b54406314da7fb4b1b8683aef20b52c86f510df1bcad4d7b11a7fd91967de74323a3a539055f90f54e742257c04727bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gt2Af11.exe

Filesize
1.1MB

MD5
ed173328d1931f2916a4ed40cdcae723

SHA1
3c3b26c1a9bc4d35778f509d11356926de59ccad

SHA256
b2b2eadfca132eeca8517d05f6128823281b2ff9f10b59ad902209bf986ddd00

SHA512
03b0ea1f56b60ef777ce030e2d1a6079ba7ac1e97dd4eadc90305cf30a3e2e700e9de73286521557ce56b7a87440135d16a3777a485fb0fd4132ed3c0eb5e483

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Ri687QR.exe

Filesize
1.1MB

MD5
028acd6b8d59c554ff41f837cbc3886c

SHA1
db3e10489bfbe192006373f7d004a6d21fe59787

SHA256
a7da8994326d83f8ee2902b8b96608ed588cafa99a9fd6f53bfdc72d0c9b7ada

SHA512
c13f3a6cc1919feb2bd129fc8c983be9a5f794177a14dfd63d34fa0add0e5c491b85ead7487bf417e827fba04a6fbc01154c69bb5ff453b4c725376d35c6b599

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZA4hP56.exe

Filesize
698KB

MD5
294702aad4a50e2904aabc229bf63222

SHA1
06496ad15d675ed3a2909cdfc3a2fdfa4e7ef955

SHA256
572e5bb001ea13fe9116f22e5ef156f8441285e4daf89889a2c9aea50f82e231

SHA512
15063c6fd56b0020f2f9928caf911ac43428ed00d5577d2fbdcd99bf7d1f4a1b69d5752d44169b2ac564a513b04b87ef10340a765d7214f68ecd990d38b64a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3oQ78Qa.exe

Filesize
30KB

MD5
a2a8503fa5b0909fc7061ab2526dcf79

SHA1
6de70590fbce34fcecd14fa489eebe32ddc54705

SHA256
c22853b040f35efa42761bbfad1455d3f552c61ceddfab30f180f2b0d50268fb

SHA512
b9b8db133956f578e13cb77ffd8d881a86e957048c452aaade2f501a22ba7b821323d1d62e7656d4856c8d9dff497ad9076373c29e2d3eed5545e0451750c6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mF1MZ63.exe

Filesize
574KB

MD5
8ac38c2fe934b7249b579786a31f6416

SHA1
2f75c2d2a83b9a13ade2321c2f5c0f55964fe42c

SHA256
9e404bc764a48d9ea36b18e7e1786890a3f111ad76d50160ffee3fd8b7a80abd

SHA512
04d4f2800a807599e11363c02c7988da34f567c1815cd4a2cd5f4503f8e525a2bca4fcddc64bb4a3610b83e3dec42d56a2a55e844f8178bc35fb523783446b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pg75EY7.exe

Filesize
1.6MB

MD5
29e9546e7fe835b413a5d65599213b53

SHA1
64d6d2eca4e197a390702a08b074c5ef6da2fa32

SHA256
d65b10dc2c1598935786fd0d562aaee9c9fc6b7d6f950da6de13db6686cab814

SHA512
e556877abd79052f3d3bc6175971001531f363745d396aa96302218cf11b4fc94980f946aae758ff14d8cc8af4d9dcb26503142e2d1cded2d21ab37ddc009658

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2FN2831.exe

Filesize
180KB

MD5
c48daf2acb868a7a781de9b5aa6af69c

SHA1
04a9e5ac7d3b2a326b64b5cdabdfd4c75f07742d

SHA256
c74ac1603c2417b67ff88a4011d5f4ea9e972ca80d554237c845269bc68d562a

SHA512
1690f6f0d3228467f8fc9ff5a2a843a103acf4cd68df058df8794b1e11e3a9d01175434821edd0f79626f885f4f808cf08c743c4ea6ab21525790bd8fd8f0ebf

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/908-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/908-79-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/908-45-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/908-70-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1796-56-0x0000000007380000-0x0000000007412000-memory.dmp

Filesize
584KB

Download
memory/1796-73-0x00000000076A0000-0x00000000077AA000-memory.dmp

Filesize
1.0MB

Download
memory/1796-69-0x0000000007330000-0x000000000733A000-memory.dmp

Filesize
40KB

Download
memory/1796-61-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/1796-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1796-49-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1796-72-0x0000000008460000-0x0000000008A78000-memory.dmp

Filesize
6.1MB

Download
memory/1796-55-0x0000000007890000-0x0000000007E34000-memory.dmp

Filesize
5.6MB

Download
memory/1796-74-0x00000000075B0000-0x00000000075C2000-memory.dmp

Filesize
72KB

Download
memory/1796-75-0x0000000007610000-0x000000000764C000-memory.dmp

Filesize
240KB

Download
memory/1796-76-0x0000000007650000-0x000000000769C000-memory.dmp

Filesize
304KB

Download
memory/1796-77-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1796-80-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/2200-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2200-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download