amadey | 2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe
Size

1.2MB
MD5

3054d6b50fa20563cdac3e8f3879afc9
SHA1

aab0db34b3f0c3912872b7c4a4c8c82ed127393d
SHA256

2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea
SHA512

5f41b918d84a6f4c76f1c23d8b1d65319d5d0c423355275f7fa4c7c187ff7a47740e37425cbdc7898c2c7af81377b20472d7b3346fd1983381e7a145a884afff
SSDEEP

24576:gyYB1XWl1uTw5eKK4VzNRCURNW1WNKTRx+A9RGqlEyEYY:nYjIeKK4VJRC0o1WglNE

Score

10^/10

amadey healer mystic redline trush dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

trush

77.91.124.82:19071

Attributes

auth_value
c13814867cde8193679cd0cad2d774be

Extracted

Family

amadey

Version

3.89

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3360-35-0x0000000000400000-0x000000000042F000-memory.dmp	mystic_family
behavioral1/memory/3360-36-0x0000000000400000-0x000000000042F000-memory.dmp	mystic_family
behavioral1/memory/3360-37-0x0000000000400000-0x000000000042F000-memory.dmp	mystic_family
behavioral1/memory/3360-39-0x0000000000400000-0x000000000042F000-memory.dmp	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q9605826.exe	healer
behavioral1/memory/4452-28-0x0000000000240000-0x000000000024A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

q9605826.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q9605826.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q9605826.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q9605826.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q9605826.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q9605826.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q9605826.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4852-43-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3360-35-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/3360-36-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/3360-37-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/3360-39-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q9605826.exe	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4452-28-0x0000000000240000-0x000000000024A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with ConfuserEx Mod 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4852-43-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3360-35-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/3360-36-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/3360-37-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/3360-39-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

t1555293.exeexplonde.exeu7064660.exelegota.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	t1555293.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	u7064660.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 14 IoCs

Processes:

z0496335.exez9864428.exez6994770.exeq9605826.exer3873207.exes7705913.exet1555293.exeexplonde.exeu7064660.exelegota.exelegota.exeexplonde.exelegota.exeexplonde.exe

pid	process
4840	z0496335.exe
1584	z9864428.exe
3384	z6994770.exe
4452	q9605826.exe
3932	r3873207.exe
1208	s7705913.exe
1876	t1555293.exe
4408	explonde.exe
2956	u7064660.exe
5000	legota.exe
3932	legota.exe
1864	explonde.exe
4532	legota.exe
3260	explonde.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

q9605826.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q9605826.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q9605826.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exez0496335.exez9864428.exez6994770.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0496335.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9864428.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6994770.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

r3873207.exes7705913.exe

description	pid	process	target process
PID 3932 set thread context of 3360	3932	r3873207.exe	AppLaunch.exe
PID 1208 set thread context of 4852	1208	s7705913.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

872 3360 WerFault.exe AppLaunch.exe
1688 3932 WerFault.exe r3873207.exe
2848 1208 WerFault.exe s7705913.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4704 schtasks.exe
4120 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

q9605826.exe

pid process

4452 q9605826.exe
4452 q9605826.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

q9605826.exe

description pid process

Token: SeDebugPrivilege 4452 q9605826.exe

pid	pid_target	process	target process
872	3360	WerFault.exe	AppLaunch.exe
1688	3932	WerFault.exe	r3873207.exe
2848	1208	WerFault.exe	s7705913.exe

pid	process
4704	schtasks.exe
4120	schtasks.exe

pid	process
4452	q9605826.exe
4452	q9605826.exe

description	pid	process
Token: SeDebugPrivilege	4452	q9605826.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exez0496335.exez9864428.exez6994770.exer3873207.exes7705913.exet1555293.exeexplonde.exeu7064660.execmd.exelegota.exe

description	pid	process	target process
PID 1516 wrote to memory of 4840	1516	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe	z0496335.exe
PID 1516 wrote to memory of 4840	1516	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe	z0496335.exe
PID 1516 wrote to memory of 4840	1516	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe	z0496335.exe
PID 4840 wrote to memory of 1584	4840	z0496335.exe	z9864428.exe
PID 4840 wrote to memory of 1584	4840	z0496335.exe	z9864428.exe
PID 4840 wrote to memory of 1584	4840	z0496335.exe	z9864428.exe
PID 1584 wrote to memory of 3384	1584	z9864428.exe	z6994770.exe
PID 1584 wrote to memory of 3384	1584	z9864428.exe	z6994770.exe
PID 1584 wrote to memory of 3384	1584	z9864428.exe	z6994770.exe
PID 3384 wrote to memory of 4452	3384	z6994770.exe	q9605826.exe
PID 3384 wrote to memory of 4452	3384	z6994770.exe	q9605826.exe
PID 3384 wrote to memory of 3932	3384	z6994770.exe	r3873207.exe
PID 3384 wrote to memory of 3932	3384	z6994770.exe	r3873207.exe
PID 3384 wrote to memory of 3932	3384	z6994770.exe	r3873207.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 3932 wrote to memory of 3360	3932	r3873207.exe	AppLaunch.exe
PID 1584 wrote to memory of 1208	1584	z9864428.exe	s7705913.exe
PID 1584 wrote to memory of 1208	1584	z9864428.exe	s7705913.exe
PID 1584 wrote to memory of 1208	1584	z9864428.exe	s7705913.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 1208 wrote to memory of 4852	1208	s7705913.exe	AppLaunch.exe
PID 4840 wrote to memory of 1876	4840	z0496335.exe	t1555293.exe
PID 4840 wrote to memory of 1876	4840	z0496335.exe	t1555293.exe
PID 4840 wrote to memory of 1876	4840	z0496335.exe	t1555293.exe
PID 1876 wrote to memory of 4408	1876	t1555293.exe	explonde.exe
PID 1876 wrote to memory of 4408	1876	t1555293.exe	explonde.exe
PID 1876 wrote to memory of 4408	1876	t1555293.exe	explonde.exe
PID 1516 wrote to memory of 2956	1516	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe	u7064660.exe
PID 1516 wrote to memory of 2956	1516	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe	u7064660.exe
PID 1516 wrote to memory of 2956	1516	2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe	u7064660.exe
PID 4408 wrote to memory of 4704	4408	explonde.exe	schtasks.exe
PID 4408 wrote to memory of 4704	4408	explonde.exe	schtasks.exe
PID 4408 wrote to memory of 4704	4408	explonde.exe	schtasks.exe
PID 4408 wrote to memory of 848	4408	explonde.exe	cmd.exe
PID 4408 wrote to memory of 848	4408	explonde.exe	cmd.exe
PID 4408 wrote to memory of 848	4408	explonde.exe	cmd.exe
PID 2956 wrote to memory of 5000	2956	u7064660.exe	legota.exe
PID 2956 wrote to memory of 5000	2956	u7064660.exe	legota.exe
PID 2956 wrote to memory of 5000	2956	u7064660.exe	legota.exe
PID 848 wrote to memory of 1072	848	cmd.exe	cmd.exe
PID 848 wrote to memory of 1072	848	cmd.exe	cmd.exe
PID 848 wrote to memory of 1072	848	cmd.exe	cmd.exe
PID 848 wrote to memory of 4988	848	cmd.exe	cacls.exe
PID 848 wrote to memory of 4988	848	cmd.exe	cacls.exe
PID 848 wrote to memory of 4988	848	cmd.exe	cacls.exe
PID 5000 wrote to memory of 4120	5000	legota.exe	schtasks.exe
PID 5000 wrote to memory of 4120	5000	legota.exe	schtasks.exe
PID 5000 wrote to memory of 4120	5000	legota.exe	schtasks.exe
PID 848 wrote to memory of 5104	848	cmd.exe	cacls.exe
PID 848 wrote to memory of 5104	848	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe
"C:\Users\Admin\AppData\Local\Temp\2a5fbbb9305976c9ccb1cfd3280d67d299003c58d85c9afc142e0d64213c3bea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0496335.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0496335.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4840

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9864428.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9864428.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6994770.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6994770.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q9605826.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q9605826.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r3873207.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r3873207.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 540
7⤵
- Program crash
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 136
6⤵
- Program crash
PID:1688

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s7705913.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s7705913.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 136
5⤵
- Program crash
PID:2848

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t1555293.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t1555293.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
5⤵
- Creates scheduled task(s)
PID:4704

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:1072

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:N"
6⤵
PID:4988

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:R" /E
6⤵
PID:5104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2504

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
6⤵
PID:2976

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
6⤵
PID:3504

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\u7064660.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\u7064660.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
4⤵
- Creates scheduled task(s)
PID:4120

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
4⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3116

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
5⤵
PID:4708

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
5⤵
PID:2640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4716

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
5⤵
PID:2552

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
5⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3932 -ip 3932
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3360 -ip 3360
1⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1208 -ip 1208
1⤵
PID:3680

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1864

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0496335.exe
Filesize
1.0MB

MD5
e95335fbfb0443027c4c438f6b6fd4c0

SHA1
ebcad9c2180c6fb7f70acafca4d53b9301bb90bc

SHA256
1f38f0b40a7f46723bc3a4aee6f772fbacbf253a86d489f4fc73d1cad63b1c96

SHA512
fce8d7f05ce26c1232559de77696973cc88b700b46be95aa1c6a53b1d2e017f0f48e1ba398598ffc0f3cdc02483cad22c48b7aab368913d8651915cdf76df957

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t1555293.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9864428.exe
Filesize
867KB

MD5
7384031483f19afd77a2b122d0482941

SHA1
b884f001268527ff5ebb464a0f6d81659eac1b5e

SHA256
02eb6e7d044aedc63de3200022733fb8cc39da3369dc21111fa62afb64d092e6

SHA512
e17f26eb49c249de91b76deff7125ae86f8bf909056940c978368ea466cd4051248c7a5d80a845d6370676ac3a20ec917dc8fa5e8c1ab3cb3923a02e306a4ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s7705913.exe
Filesize
1.0MB

MD5
8068345317a8275d6c40f76bb1dd5fe1

SHA1
42e69f613c8981d3d6de36c5b958aa3a820c9590

SHA256
b7dcdb3e3ac824a16b8b56bca0d5c76bc17cb6460c973194fb0e09b1f1707630

SHA512
5f9486bc12e10227abda1e8c80920084f4c1530cfcd5e377ea49c3d03e99dc5958a679d866bc573398b6a9b2ceb929012f93fd5e25be6cfbd8a11883a534f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6994770.exe
Filesize
475KB

MD5
beb5b94e2ee44d9e7c25e2e5a4002e8c

SHA1
275e4b66e56662b79b20f064b4bdc330a5397d97

SHA256
7644aa389273bc7400478b8be7be1f6755ada6c489ef757d2071ba6b29845233

SHA512
686e9556ee174dd4f7ea40b99a436db4ab4e8eda06998ae2f01a05c7324877011f80704252995a89a52401958a3b9c014673664f187924343169f006042c72d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q9605826.exe
Filesize
11KB

MD5
256541c79ebd537a8cfc6f7787a03205

SHA1
5ce13e898d5fbdf25295c5f94e1a6197e7362030

SHA256
e585d958c3e06f068d612e8bee2618222fadd4da63a98d58869242c9e5faf0ff

SHA512
3267ef7a2598216f827c6f7f0e3da6ec8f99acddfd9a6cd711e8b8cbbe2ef19083fcf03da7619d780044a0cd6cc8a8bc668455fe799fba86fe942fe03e2eee83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r3873207.exe
Filesize
1.0MB

MD5
7006f4633e856d4f7902c4512919a23f

SHA1
569d98afd89bd7a13d96bbf9279c9cabbe8137ce

SHA256
80b202014080de3be4ff56032cfa8c6ef158b1d543e40b84df8f322a70663467

SHA512
791168bfc6e68ee0e2b584639a31cdade02193014feb0503d81d86252cae655bb2dc3dd6bc0cadaf0f8e3b98d1e3fb456ac7ee89205258898b7a931f19d26c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
memory/3360-35-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3360-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3360-37-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3360-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4452-31-0x00007FF9727E0000-0x00007FF9732A1000-memory.dmp

Filesize
10.8MB

Download
memory/4452-29-0x00007FF9727E0000-0x00007FF9732A1000-memory.dmp

Filesize
10.8MB

Download
memory/4452-28-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/4852-60-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

Filesize
64KB

Download
memory/4852-45-0x0000000074070000-0x0000000074820000-memory.dmp

Filesize
7.7MB

Download
memory/4852-55-0x0000000005980000-0x0000000005F98000-memory.dmp

Filesize
6.1MB

Download
memory/4852-56-0x0000000005470000-0x000000000557A000-memory.dmp

Filesize
1.0MB

Download
memory/4852-43-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4852-61-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/4852-44-0x0000000002DB0000-0x0000000002DB6000-memory.dmp

Filesize
24KB

Download
memory/4852-67-0x00000000053C0000-0x00000000053FC000-memory.dmp

Filesize
240KB

Download
memory/4852-75-0x0000000005400000-0x000000000544C000-memory.dmp

Filesize
304KB

Download
memory/4852-76-0x0000000074070000-0x0000000074820000-memory.dmp

Filesize
7.7MB

Download
memory/4852-79-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

Filesize
64KB

Download