amadey | 9b80269950e0f1b633a8f97657fa8c4843d63cc1062890797edcbbcf58625520

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe
Size

1.0MB
MD5

8ca2e2b6df85b28cc622787bdd25971c
SHA1

c6694cda5bba6ce87b6433a180dde1c90f6f22bb
SHA256

30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818
SHA512

a3b689b8deee65b87390a5bbb312eb188cac6485f1f485b98d0016f7180adec0db4c0e6e7aa8066c1c82925ee6257df4f221f16f61e67a358395d6ff019125f8
SSDEEP

24576:0ycblCljSywWSdCPVlvVqUIv/jzwvvAL9:DcblsjSyGdCPVlvUU2/HwHA

Score

10^/10

amadey healer mystic redline 04d170 daf753 gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

Botnet

04d170

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Extracted

Family

amadey

Version

3.89

Botnet

daf753

http://77.91.68.78

Attributes

install_dir
cb378487cf
install_file
legota.exe
strings_key
f3785cbeef2013b6724eed349fd316ba
url_paths
/help/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral4/memory/2508-40-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral4/memory/2508-41-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral4/memory/2508-43-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral4/files/0x0008000000023443-33.dat	healer
behavioral4/memory/1888-35-0x0000000000EE0000-0x0000000000EEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q7404994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q7404994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q7404994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q7404994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q7404994.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q7404994.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/3904-47-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	t7025584.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	u0608339.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 18 IoCs

pid	Process
3216	z5955212.exe
1132	z3893199.exe
4252	z0412229.exe
4124	z6680487.exe
1888	q7404994.exe
1852	r9294861.exe
4516	s2634145.exe
4656	t7025584.exe
3748	explothe.exe
4588	u0608339.exe
5028	legota.exe
2224	w0869032.exe
3964	explothe.exe
548	legota.exe
1528	explothe.exe
3708	legota.exe
2440	explothe.exe
3376	legota.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q7404994.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z6680487.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5955212.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3893199.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0412229.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 2508	1852	r9294861.exe	103
PID 4516 set thread context of 3904	4516	s2634145.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5040	1852	WerFault.exe	99
4380	4516	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1528	schtasks.exe
3552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	q7404994.exe
1888	q7404994.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	q7404994.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3216	2304	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe	84
PID 2304 wrote to memory of 3216	2304	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe	84
PID 2304 wrote to memory of 3216	2304	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe	84
PID 3216 wrote to memory of 1132	3216	z5955212.exe	85
PID 3216 wrote to memory of 1132	3216	z5955212.exe	85
PID 3216 wrote to memory of 1132	3216	z5955212.exe	85
PID 1132 wrote to memory of 4252	1132	z3893199.exe	86
PID 1132 wrote to memory of 4252	1132	z3893199.exe	86
PID 1132 wrote to memory of 4252	1132	z3893199.exe	86
PID 4252 wrote to memory of 4124	4252	z0412229.exe	87
PID 4252 wrote to memory of 4124	4252	z0412229.exe	87
PID 4252 wrote to memory of 4124	4252	z0412229.exe	87
PID 4124 wrote to memory of 1888	4124	z6680487.exe	88
PID 4124 wrote to memory of 1888	4124	z6680487.exe	88
PID 4124 wrote to memory of 1852	4124	z6680487.exe	99
PID 4124 wrote to memory of 1852	4124	z6680487.exe	99
PID 4124 wrote to memory of 1852	4124	z6680487.exe	99
PID 1852 wrote to memory of 1844	1852	r9294861.exe	101
PID 1852 wrote to memory of 1844	1852	r9294861.exe	101
PID 1852 wrote to memory of 1844	1852	r9294861.exe	101
PID 1852 wrote to memory of 2200	1852	r9294861.exe	102
PID 1852 wrote to memory of 2200	1852	r9294861.exe	102
PID 1852 wrote to memory of 2200	1852	r9294861.exe	102
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 1852 wrote to memory of 2508	1852	r9294861.exe	103
PID 4252 wrote to memory of 4516	4252	z0412229.exe	107
PID 4252 wrote to memory of 4516	4252	z0412229.exe	107
PID 4252 wrote to memory of 4516	4252	z0412229.exe	107
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 4516 wrote to memory of 3904	4516	s2634145.exe	109
PID 1132 wrote to memory of 4656	1132	z3893199.exe	112
PID 1132 wrote to memory of 4656	1132	z3893199.exe	112
PID 1132 wrote to memory of 4656	1132	z3893199.exe	112
PID 4656 wrote to memory of 3748	4656	t7025584.exe	113
PID 4656 wrote to memory of 3748	4656	t7025584.exe	113
PID 4656 wrote to memory of 3748	4656	t7025584.exe	113
PID 3216 wrote to memory of 4588	3216	z5955212.exe	114
PID 3216 wrote to memory of 4588	3216	z5955212.exe	114
PID 3216 wrote to memory of 4588	3216	z5955212.exe	114
PID 4588 wrote to memory of 5028	4588	u0608339.exe	117
PID 4588 wrote to memory of 5028	4588	u0608339.exe	117
PID 4588 wrote to memory of 5028	4588	u0608339.exe	117
PID 2304 wrote to memory of 2224	2304	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe	120
PID 2304 wrote to memory of 2224	2304	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe	120
PID 2304 wrote to memory of 2224	2304	30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe	120
PID 4652 wrote to memory of 3292	4652	cmd.exe	122
PID 4652 wrote to memory of 3292	4652	cmd.exe	122
PID 4652 wrote to memory of 3292	4652	cmd.exe	122
PID 4652 wrote to memory of 2192	4652	cmd.exe	123
PID 4652 wrote to memory of 2192	4652	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe
"C:\Users\Admin\AppData\Local\Temp\30323f682e6a32aa6d849428448a5ebd9b9590ee3a331da4fd2f5934b4c13818.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5955212.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5955212.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3893199.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3893199.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0412229.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0412229.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6680487.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6680487.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7404994.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7404994.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9294861.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9294861.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2200
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 156
        7⤵
        Program crash
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2634145.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2634145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4516
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 136
        6⤵
        Program crash
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7025584.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7025584.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3748
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1528
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:3992
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0608339.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0608339.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5028
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:1760
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1932
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:1368
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:1788
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4432
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:3116
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0869032.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0869032.exe
  2⤵
  - Executes dropped EXE
  PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1852 -ip 1852
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4516 -ip 4516
1⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:548

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0869032.exe

Filesize
23KB

MD5
25d5248a5ad44231735e67ac18009d63

SHA1
8f95abb73587b14e916a8930a896e7e4cc9ee684

SHA256
051fc08c6e91f51067f5a6061a0a50fba4a0fe20ef07eafd061c743c5781ef0a

SHA512
d590b86603537dd414c4b9e87f552a1b61fd46a201e7624b0dd5f70cab38032afde0354ce0a47d2868c6e508e508d20815320a10770d0fb722895eb035beec70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5955212.exe

Filesize
972KB

MD5
04beb9f495034e4d9df89f11b1d4c1d1

SHA1
ebf13b9b85f6f186222dab7de5ef37df8fd19f0a

SHA256
a189299869b7c6143bb1a5f6b53447400757f76ff6618e9fefae5987a9dcb9fe

SHA512
4b66e5b930776734396466b3360d64c2387fa983d919a50df818636af5791797ea0ec2e2e694bfd11dafe28c79e707906013a79403016a69ebd7397b6727ff5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0608339.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3893199.exe

Filesize
789KB

MD5
1d11abec72557c8b0388f8230e11e4d4

SHA1
2377c5bf858cdca42367baf3e640dbbce514d6f1

SHA256
d7dc4234985318324cb1b9ccac14a02438e45596fd269957f21d1ce4c4730914

SHA512
1b07db0e08d8f74ff7d6edab0fd076a4af37f1ad4b26832e048d3988c6ffe7d640f68c8b1407bfaabcec295ef347c17ed0bb8f31522567d323aef94859dc4f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7025584.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0412229.exe

Filesize
606KB

MD5
0854ada23a417a62022095e9a8e83119

SHA1
ab7be11512a46c282599094b9cee8746967db2e6

SHA256
f43be19e10a069c0ba0ecdea733c1f6a84dbe6a0a3d81b51d6e36168e7562d90

SHA512
258cf5aa5a1555e8b8bfae6214336708f82e825337f12db728cd55eb48d1b7eb893f06b9ee78658926160caedfb2d40c03c7e76adccfb44b059a7bda24de175a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2634145.exe

Filesize
390KB

MD5
84906a7a28bd18f27fd4347b3fc2a327

SHA1
facfb2ab031afd940dddc98287c9bd954edc1cfc

SHA256
f684c0abc3ce7c67d394c02485cf9d9ca27296ad98d91cc7cfc2f593b84c498a

SHA512
71d28d9235b38eec8fe2989d2297a76fc089445be3e0e1f7f6685f1b8d88ebc4b93393cbf7773673d764b6f88aa541b9b3c453eed36623c7f64859096977f45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6680487.exe

Filesize
335KB

MD5
28c0c502af27f1ad2796bf861346d4c0

SHA1
68cbc3501838be07c67013599385c6750337d8ab

SHA256
fd2aa21a54bba01d5274f2807d398b82ec0ee42d24ee98435eeb820c71a45287

SHA512
0b7652d3ff7c6783a6746623550d156e79e0ae1ce123ab75467cef23f356899368b6c1bd218c7f944e342d8e4080a5c262f607c8c897bcb57518a625af8d5a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7404994.exe

Filesize
11KB

MD5
34e777d726d9ace8ff94fef89c94425f

SHA1
b9c48c06eceda0a113e80325a3d9a3edd71df79b

SHA256
eceab4e67ae35fd59df582b5eec58110c2168ce99b78717be9b956422930eed8

SHA512
67de061e9ae8a1a675c4e212c9f8e898281fab4c21f958bb242a77378e7e0a1238b93771094c942b0cb1c96f28071c1c5722a87dbe14baba94ed65cb8e1f649e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9294861.exe

Filesize
356KB

MD5
3535c5260fe707c5f0ffef7c54a5f189

SHA1
5a81af0753fc190a5e57211db267c7566d2053d7

SHA256
92988ebd8dad0647fb682ab4a619e3d4b99c0e055b249dca4b066bc9518d1ee0

SHA512
609938930f896653a173502080df67e128dbdf57386fd0afafe200dde1fe7dd91d14fc5bf1bbc0e8fd2f28fa1a0c1b1e221ed1de7672b9789405255a6fe41ec4

Download Submit
memory/1888-35-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

Filesize
40KB

Download
memory/2508-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2508-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2508-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3904-47-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3904-48-0x0000000003450000-0x0000000003456000-memory.dmp

Filesize
24KB

Download
memory/3904-54-0x0000000006130000-0x0000000006748000-memory.dmp

Filesize
6.1MB

Download
memory/3904-55-0x0000000005C20000-0x0000000005D2A000-memory.dmp

Filesize
1.0MB

Download
memory/3904-56-0x00000000034A0000-0x00000000034B2000-memory.dmp

Filesize
72KB

Download
memory/3904-63-0x0000000005A50000-0x0000000005A8C000-memory.dmp

Filesize
240KB

Download
memory/3904-67-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Filesize
304KB

Download