amadey | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe
Size

1.1MB
MD5

f0521e19f6301f6353dcec5f6fd4fa44
SHA1

ceb665d8c8826561651eba2a39911c918bf2a1ee
SHA256

27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde
SHA512

d3ae67cb6e016aef33c9f40184e4319c0589d5894bced0007cf6a9da8f983f1604e307420f193a8e27c645ba99ce457689b89639845acfd2e9af8c4ab5f9b403
SSDEEP

24576:Iyxw7cqfpuOikuYIwABfbtKG4rgTY4llNPHCgV:Pxw7ZfpuOiVp5ug84lz

Score

10^/10

amadey healer mystic redline daf753 darts fb0fb8 dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darts

77.91.124.82:19071

Attributes

auth_value
3c8818da7045365845f15ec0946ebf11

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

http://77.91.68.52

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688
url_paths
/mac/index.php

rc4.plain

Extracted

Family

amadey

Version

3.89

Botnet

daf753

http://77.91.68.78

Attributes

install_dir
cb378487cf
install_file
legota.exe
strings_key
f3785cbeef2013b6724eed349fd316ba
url_paths
/help/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral6/memory/3160-39-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral6/memory/3160-42-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral6/memory/3160-40-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral6/memory/2560-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral6/memory/3620-46-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

legota.exet9738893.exeexplonde.exeu3516406.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	t9738893.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	u3516406.exe

Executes dropped EXE 18 IoCs

Processes:

z8425567.exez7612898.exez3120137.exez7822521.exeq6590072.exer2358962.exes2345378.exet9738893.exeexplonde.exeu3516406.exelegota.exew4971669.exeexplonde.exelegota.exeexplonde.exelegota.exeexplonde.exelegota.exe

pid	process
2396	z8425567.exe
1440	z7612898.exe
3676	z3120137.exe
712	z7822521.exe
1524	q6590072.exe
3944	r2358962.exe
4580	s2345378.exe
3232	t9738893.exe
4048	explonde.exe
3472	u3516406.exe
3752	legota.exe
2492	w4971669.exe
4948	explonde.exe
1984	legota.exe
1992	explonde.exe
3412	legota.exe
3372	explonde.exe
4480	legota.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z7822521.exe27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exez8425567.exez7612898.exez3120137.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z7822521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z8425567.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7612898.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z3120137.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

q6590072.exer2358962.exes2345378.exe

description	pid	process	target process
PID 1524 set thread context of 2560	1524	q6590072.exe	AppLaunch.exe
PID 3944 set thread context of 3160	3944	r2358962.exe	AppLaunch.exe
PID 4580 set thread context of 3620	4580	s2345378.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4608 1524 WerFault.exe q6590072.exe
3560 3944 WerFault.exe r2358962.exe
1388 4580 WerFault.exe s2345378.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3756 schtasks.exe
3024 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2560 AppLaunch.exe
2560 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2560 AppLaunch.exe

pid	pid_target	process	target process
4608	1524	WerFault.exe	q6590072.exe
3560	3944	WerFault.exe	r2358962.exe
1388	4580	WerFault.exe	s2345378.exe

pid	process
3756	schtasks.exe
3024	schtasks.exe

pid	process
2560	AppLaunch.exe
2560	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2560	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exez8425567.exez7612898.exez3120137.exez7822521.exeq6590072.exer2358962.exes2345378.exet9738893.exeexplonde.exeu3516406.exe

description	pid	process	target process
PID 1988 wrote to memory of 2396	1988	27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe	z8425567.exe
PID 1988 wrote to memory of 2396	1988	27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe	z8425567.exe
PID 1988 wrote to memory of 2396	1988	27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe	z8425567.exe
PID 2396 wrote to memory of 1440	2396	z8425567.exe	z7612898.exe
PID 2396 wrote to memory of 1440	2396	z8425567.exe	z7612898.exe
PID 2396 wrote to memory of 1440	2396	z8425567.exe	z7612898.exe
PID 1440 wrote to memory of 3676	1440	z7612898.exe	z3120137.exe
PID 1440 wrote to memory of 3676	1440	z7612898.exe	z3120137.exe
PID 1440 wrote to memory of 3676	1440	z7612898.exe	z3120137.exe
PID 3676 wrote to memory of 712	3676	z3120137.exe	z7822521.exe
PID 3676 wrote to memory of 712	3676	z3120137.exe	z7822521.exe
PID 3676 wrote to memory of 712	3676	z3120137.exe	z7822521.exe
PID 712 wrote to memory of 1524	712	z7822521.exe	q6590072.exe
PID 712 wrote to memory of 1524	712	z7822521.exe	q6590072.exe
PID 712 wrote to memory of 1524	712	z7822521.exe	q6590072.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 1524 wrote to memory of 2560	1524	q6590072.exe	AppLaunch.exe
PID 712 wrote to memory of 3944	712	z7822521.exe	r2358962.exe
PID 712 wrote to memory of 3944	712	z7822521.exe	r2358962.exe
PID 712 wrote to memory of 3944	712	z7822521.exe	r2358962.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3944 wrote to memory of 3160	3944	r2358962.exe	AppLaunch.exe
PID 3676 wrote to memory of 4580	3676	z3120137.exe	s2345378.exe
PID 3676 wrote to memory of 4580	3676	z3120137.exe	s2345378.exe
PID 3676 wrote to memory of 4580	3676	z3120137.exe	s2345378.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 4580 wrote to memory of 3620	4580	s2345378.exe	AppLaunch.exe
PID 1440 wrote to memory of 3232	1440	z7612898.exe	t9738893.exe
PID 1440 wrote to memory of 3232	1440	z7612898.exe	t9738893.exe
PID 1440 wrote to memory of 3232	1440	z7612898.exe	t9738893.exe
PID 3232 wrote to memory of 4048	3232	t9738893.exe	explonde.exe
PID 3232 wrote to memory of 4048	3232	t9738893.exe	explonde.exe
PID 3232 wrote to memory of 4048	3232	t9738893.exe	explonde.exe
PID 2396 wrote to memory of 3472	2396	z8425567.exe	u3516406.exe
PID 2396 wrote to memory of 3472	2396	z8425567.exe	u3516406.exe
PID 2396 wrote to memory of 3472	2396	z8425567.exe	u3516406.exe
PID 4048 wrote to memory of 3756	4048	explonde.exe	schtasks.exe
PID 4048 wrote to memory of 3756	4048	explonde.exe	schtasks.exe
PID 4048 wrote to memory of 3756	4048	explonde.exe	schtasks.exe
PID 4048 wrote to memory of 1932	4048	explonde.exe	cmd.exe
PID 4048 wrote to memory of 1932	4048	explonde.exe	cmd.exe
PID 4048 wrote to memory of 1932	4048	explonde.exe	cmd.exe
PID 3472 wrote to memory of 3752	3472	u3516406.exe	legota.exe
PID 3472 wrote to memory of 3752	3472	u3516406.exe	legota.exe

C:\Users\Admin\AppData\Local\Temp\27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe
"C:\Users\Admin\AppData\Local\Temp\27768bc4484847752b8e6b935f4d0a7c52af11184186bd7e6297fb761bebcbde.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8425567.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8425567.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7612898.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7612898.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3120137.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3120137.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3676

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7822521.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7822521.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:712

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6590072.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6590072.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 568
7⤵
- Program crash
PID:4608

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2358962.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2358962.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 568
7⤵
- Program crash
PID:3560

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2345378.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2345378.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 584
6⤵
- Program crash
PID:1388

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9738893.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9738893.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
6⤵
- Creates scheduled task(s)
PID:3756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
6⤵
PID:1932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2380

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:N"
7⤵
PID:5072

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:R" /E
7⤵
PID:3144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:824

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
7⤵
PID:1504

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
7⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3516406.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3516406.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
5⤵
- Creates scheduled task(s)
PID:3024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
5⤵
PID:860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4276

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
6⤵
PID:3172

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
6⤵
PID:4320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4436

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
6⤵
PID:2520

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
6⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4971669.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4971669.exe
2⤵
- Executes dropped EXE
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1524 -ip 1524
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3944 -ip 3944
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4580 -ip 4580
1⤵
PID:388

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1992

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4971669.exe
Filesize
21KB

MD5
e5265310ac1a7524751ed38c5a04904e

SHA1
1f37a0bbd66de90cebc2cb8328162b47083f4576

SHA256
651797d652e7d0b75f31a23952ec9fa06e12fea349e5ad66f5371c21f0692e8f

SHA512
9993fdcc6f71ec6fdabcb87a998c13fab24506bee848d017ed7824037d3aa60aa5ab0d8a389ac2e9d9fa347d9fa2646130a2a13f92df68403e152123f1ca2e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8425567.exe
Filesize
997KB

MD5
a43b36e053d646c0126d1322bf5a98e0

SHA1
c79ac64a381da43f4fa5a1eaf5842a8ff966ca20

SHA256
cd7e4b25de5cffad2ebd1d6da2ff5300f84770057a0effda51315c7cd79c64ea

SHA512
ff8e365e8e4e377beed213eb136f254c28dd96ebadc6116dc1abadfe8a6d66ab37da8e5b2b48a71613de22a5f414ed4a65c765891f30fc6bb33624dad58b91a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3516406.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7612898.exe
Filesize
815KB

MD5
a423db0590f81b6c9813f49d7d959041

SHA1
ba51998b89e302defb4ed8b0e82447be129066f0

SHA256
20c34c68ceb5c5ec2d3851906f51bbcd6906786f068371e1bcfe347d2c0bad95

SHA512
d35237f7ff843f256d5f79df6284ca2f31d01642c9011a3cf6156148c638525be453a0ab108af18900658cf9ccea06359c8fcc6280894bab1a2090c337e701da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9738893.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3120137.exe
Filesize
632KB

MD5
721d0de1bc7f3d320a661f5c4a1ba2bb

SHA1
defcbb323d435fa5255ae7819fa604e56409d854

SHA256
10d6d9ebb23d0d56237b04cd7652ec9ac2421cdb3386e0f5899f20df5c80520d

SHA512
7b750768d94aaacd9753806d6a21004b8918124c649ccf510a6896bf19e5b6210ff7f62ae5e92126505af4cea00770b1a02adffacae60ea2263f9b6cf60390a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2345378.exe
Filesize
413KB

MD5
94ac454c7602e8dfefa6ace9f9d649f2

SHA1
a9073ff143819461dc3b1cac81eeb392e831c6d9

SHA256
557673fa11841f82c635805ae848756a91d2250d5a3d6e4567d114197f9ccb28

SHA512
0ae3743acc26159d9dc07fb7392f5f9bf5e786fd0d0c92f4d75267955c27e9ee633a192cc1b7a2a4cccd6db3c4d9af8a531be1ec0b841f914652a89ea2a2320b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7822521.exe
Filesize
354KB

MD5
a29f6807f8e3c9c280eb08dacf5ca19f

SHA1
ba5657fdc2c5abf5516b99658b6e51d06e2e93ca

SHA256
1897530db778ef2ef1226042d57d68071faaaa41d10ae457ba90336834961dc6

SHA512
bc167dc9d5c24d2bf306e4a2da27ac0665f5e9c829678509a1210914b46c3b4c3a9fb8ae1588903319406664c3c9b2db2b46eae0d8edef0fe83d8dcd8004a671

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6590072.exe
Filesize
250KB

MD5
eee557b4e2c8e1008a7e30ad98f88b78

SHA1
e219a2005015d9cb5205cb6e28bfacad9aac3716

SHA256
47aa66d6d5a4d6e04ca02afe9cac2ffceb06c4151c70990d809c21c27f30656c

SHA512
79faa564297ab0ed2a5bd4155d197a92f22935ca381ab050efe146cff9d8eb8f10fab5498285fad4e28369a61396139a1a247ad2f81f0cfb2aeb0b940e9f2e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2358962.exe
Filesize
379KB

MD5
cd5bc80b7b933c153652af1b50987798

SHA1
0b121baaae8706740ce26af7faa8aaf865de2fbc

SHA256
c7cb5510ee42fd6d05e0bd91b65f302050251ee3ac81110412d4d70dfc9a2405

SHA512
8344c0f2fe738b24b26194c50596e5bcfdfd8c5001a566d6d78c3da5d17f6c28302ff64c6e2d4cc5d789dfb3859682963abd83d80ed977fa9be1687c80273974

Download Submit
memory/2560-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3160-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3160-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3160-39-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3620-46-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3620-47-0x0000000005050000-0x0000000005056000-memory.dmp

Filesize
24KB

Download
memory/3620-53-0x000000000AA40000-0x000000000B058000-memory.dmp

Filesize
6.1MB

Download
memory/3620-58-0x000000000A5A0000-0x000000000A6AA000-memory.dmp

Filesize
1.0MB

Download
memory/3620-59-0x000000000A4E0000-0x000000000A4F2000-memory.dmp

Filesize
72KB

Download
memory/3620-65-0x000000000A540000-0x000000000A57C000-memory.dmp

Filesize
240KB

Download
memory/3620-69-0x0000000004900000-0x000000000494C000-memory.dmp

Filesize
304KB

Download