amadey | 94b31370c8afa5ed76290f1d847a123622e3ecd769eba80b650545a1b26bb363

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
Size

1.8MB
MD5

424c6708835f73f821184930d309d6b0
SHA1

a5fb4538c45704889ddb590990982d9742fde273
SHA256

94b31370c8afa5ed76290f1d847a123622e3ecd769eba80b650545a1b26bb363
SHA512

5be89e5c087dd1c7691bbf3ca5cd71cf56f58f4b50ccdfd008bdda514ebadaa66af07e02ca92863dd58e6c9095e721a7379b1675c38225636ef04bcc816fcb2c
SSDEEP

24576:fqBnW8ObEmywMFER21icNltzxHhy5VMiPovfqhWbqFB7BEG382MHyYWIRnb99JvZ:fqbUBmFEUlt1H6VToXFWR3IHjZaPcy

Score

10^/10

amadey monster redline e76b71 newbild discovery evasion infostealer spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Monster Stealer. 3 IoCs

resource	yara_rule
behavioral1/files/0x0006000000015d48-69.dat	family_monster
behavioral1/memory/1872-214-0x000000013F820000-0x0000000140A55000-memory.dmp	family_monster
behavioral1/files/0x00070000000165f9-425.dat	family_monster

Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001863a-78.dat	family_redline
behavioral1/memory/1628-88-0x0000000000C60000-0x0000000000CB0000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Executes dropped EXE 19 IoCs

pid	Process
2880	axplong.exe
1732	judit.exe
1872	stub.exe
1628	redline123123.exe
2960	upd.exe
320	setup222.exe
1192	gold.exe
2980	lummac2.exe
1612	SetupWizard.exe
2756	SetupWizard.exe
1216	Process not Found
1876	drivermanager.exe
1616	NewLatest.exe
2104	Hkbsse.exe
1568	monster.exe
2632	stub.exe
1880	bin.exe
1984	Hkbsse.exe
1904	legs.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
Key opened	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine	axplong.exe

Loads dropped DLL 31 IoCs

pid	Process
2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
2880	axplong.exe
1732	judit.exe
1872	stub.exe
2880	axplong.exe
2880	axplong.exe
2880	axplong.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2880	axplong.exe
2880	axplong.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2880	axplong.exe
2880	axplong.exe
320	setup222.exe
1612	SetupWizard.exe
2880	axplong.exe
2880	axplong.exe
1616	NewLatest.exe
2880	axplong.exe
1568	monster.exe
2632	stub.exe
2880	axplong.exe
1880	bin.exe
2880	axplong.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
2880	axplong.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1876 set thread context of 612	1876	drivermanager.exe	46

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe
File created	C:\Windows\Tasks\Hkbsse.job	bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2436	2960	WerFault.exe	33
2952	1192	WerFault.exe	36
2068	1904	WerFault.exe	52

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	setup222.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	setup222.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
2880	axplong.exe
1628	redline123123.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	drivermanager.exe
Token: SeDebugPrivilege	1628	redline123123.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
1616	NewLatest.exe
1880	bin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2880	2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe	28
PID 2488 wrote to memory of 2880	2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe	28
PID 2488 wrote to memory of 2880	2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe	28
PID 2488 wrote to memory of 2880	2488	424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe	28
PID 2880 wrote to memory of 1732	2880	axplong.exe	30
PID 2880 wrote to memory of 1732	2880	axplong.exe	30
PID 2880 wrote to memory of 1732	2880	axplong.exe	30
PID 2880 wrote to memory of 1732	2880	axplong.exe	30
PID 1732 wrote to memory of 1872	1732	judit.exe	31
PID 1732 wrote to memory of 1872	1732	judit.exe	31
PID 1732 wrote to memory of 1872	1732	judit.exe	31
PID 2880 wrote to memory of 1628	2880	axplong.exe	32
PID 2880 wrote to memory of 1628	2880	axplong.exe	32
PID 2880 wrote to memory of 1628	2880	axplong.exe	32
PID 2880 wrote to memory of 1628	2880	axplong.exe	32
PID 2880 wrote to memory of 2960	2880	axplong.exe	33
PID 2880 wrote to memory of 2960	2880	axplong.exe	33
PID 2880 wrote to memory of 2960	2880	axplong.exe	33
PID 2880 wrote to memory of 2960	2880	axplong.exe	33
PID 2960 wrote to memory of 2436	2960	upd.exe	34
PID 2960 wrote to memory of 2436	2960	upd.exe	34
PID 2960 wrote to memory of 2436	2960	upd.exe	34
PID 2960 wrote to memory of 2436	2960	upd.exe	34
PID 2880 wrote to memory of 320	2880	axplong.exe	35
PID 2880 wrote to memory of 320	2880	axplong.exe	35
PID 2880 wrote to memory of 320	2880	axplong.exe	35
PID 2880 wrote to memory of 320	2880	axplong.exe	35
PID 2880 wrote to memory of 1192	2880	axplong.exe	36
PID 2880 wrote to memory of 1192	2880	axplong.exe	36
PID 2880 wrote to memory of 1192	2880	axplong.exe	36
PID 2880 wrote to memory of 1192	2880	axplong.exe	36
PID 1192 wrote to memory of 2952	1192	gold.exe	37
PID 1192 wrote to memory of 2952	1192	gold.exe	37
PID 1192 wrote to memory of 2952	1192	gold.exe	37
PID 1192 wrote to memory of 2952	1192	gold.exe	37
PID 2880 wrote to memory of 2980	2880	axplong.exe	39
PID 2880 wrote to memory of 2980	2880	axplong.exe	39
PID 2880 wrote to memory of 2980	2880	axplong.exe	39
PID 2880 wrote to memory of 2980	2880	axplong.exe	39
PID 320 wrote to memory of 1612	320	setup222.exe	41
PID 320 wrote to memory of 1612	320	setup222.exe	41
PID 320 wrote to memory of 1612	320	setup222.exe	41
PID 1612 wrote to memory of 2756	1612	SetupWizard.exe	42
PID 1612 wrote to memory of 2756	1612	SetupWizard.exe	42
PID 1612 wrote to memory of 2756	1612	SetupWizard.exe	42
PID 2880 wrote to memory of 1876	2880	axplong.exe	43
PID 2880 wrote to memory of 1876	2880	axplong.exe	43
PID 2880 wrote to memory of 1876	2880	axplong.exe	43
PID 2880 wrote to memory of 1876	2880	axplong.exe	43
PID 2880 wrote to memory of 1616	2880	axplong.exe	44
PID 2880 wrote to memory of 1616	2880	axplong.exe	44
PID 2880 wrote to memory of 1616	2880	axplong.exe	44
PID 2880 wrote to memory of 1616	2880	axplong.exe	44
PID 1616 wrote to memory of 2104	1616	NewLatest.exe	45
PID 1616 wrote to memory of 2104	1616	NewLatest.exe	45
PID 1616 wrote to memory of 2104	1616	NewLatest.exe	45
PID 1616 wrote to memory of 2104	1616	NewLatest.exe	45
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46
PID 1876 wrote to memory of 612	1876	drivermanager.exe	46

C:\Users\Admin\AppData\Local\Temp\424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\424c6708835f73f821184930d309d6b0_NeikiAnalytics.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\onefile_1732_133631855437166000\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1872
- - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
    "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:2436
- - C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe
    "C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\SetupWizard.exe
      SetupWizard.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\SetupWizard-b0192c1695652b81\SetupWizard.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SetupWizard-b0192c1695652b81\SetupWizard.exe"
        5⤵
        Executes dropped EXE
        
        PID:2756
- - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 84
      4⤵
      Loads dropped DLL
      Program crash
      PID:2952
- - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
    3⤵
    - Executes dropped EXE
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
    "C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:612
- - C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
    "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      PID:2104
- - C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
    "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\onefile_1568_133631855707514000\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2632
- - C:\Users\Admin\AppData\Local\Temp\1000073001\bin.exe
    "C:\Users\Admin\AppData\Local\Temp\1000073001\bin.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      PID:1984
- - C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
    "C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe"
    3⤵
    - Executes dropped EXE
    PID:1904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 64
      4⤵
      Loads dropped DLL
      Program crash
      PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe

Filesize
10.7MB

MD5
c09ff1273b09cb1f9c7698ed147bf22e

SHA1
5634aec5671c4fd565694aa12cd3bf11758675d2

SHA256
bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

SHA512
e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe

Filesize
297KB

MD5
0efd5136528869a8ea1a37c5059d706e

SHA1
3593bec29dbfd333a5a3a4ad2485a94982bbf713

SHA256
7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e

SHA512
4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe

Filesize
1.7MB

MD5
e8a7d0c6dedce0d4a403908a29273d43

SHA1
8289c35dabaee32f61c74de6a4e8308dc98eb075

SHA256
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a

SHA512
c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe

Filesize
96KB

MD5
8677376c509f0c66d1f02c6b66d7ef90

SHA1
e057eddf9d2e319967e200a5801e4bbe6e45862a

SHA256
f7afac39d2754ac953bf129ee094c8b092e349cdf35f1ba23c2c76a0229f9e96

SHA512
e0c685e289c10a48b5fa251aa4414653c103dac69faf536b9ae9598e066aab5a03b03c09096c42a0f244aeaf80f2b9e4aa28d6b28da436587a3f52a9155473d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe

Filesize
522KB

MD5
70a578f7f58456e475facd69469cf20a

SHA1
83e147e7ba01fa074b2f046b65978f838f7b1e8e

SHA256
5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

SHA512
707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe

Filesize
310KB

MD5
6e3d83935c7a0810f75dfa9badc3f199

SHA1
9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

SHA256
dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

SHA512
9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe

Filesize
3.6MB

MD5
c28a2d0a008788b49690b333d501e3f3

SHA1
6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

SHA256
f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

SHA512
455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe

Filesize
415KB

MD5
07101cac5b9477ba636cd8ca7b9932cb

SHA1
59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

SHA256
488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

SHA512
02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe

Filesize
10.7MB

MD5
3f4f5c57433724a32b7498b6a2c91bf0

SHA1
04757ff666e1afa31679dd6bed4ed3af671332a3

SHA256
0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665

SHA512
cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000073001\bin.exe

Filesize
424KB

MD5
13e5872e9b7c47090e035dc228c5589f

SHA1
c55a9708091f19b5fc5baf7c37beb99d8d3bf760

SHA256
d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

SHA512
260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe

Filesize
659KB

MD5
bbd06263062b2c536b5caacdd5f81b76

SHA1
c38352c1c08fb0fa5e67a079998ef30ebc962089

SHA256
1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

SHA512
7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\812790648315

Filesize
85KB

MD5
aa3c870d06e3eb8a9ef507ce026f4285

SHA1
25da588193c6c70e695e96446f2837bd1b13e553

SHA256
f42a5dcc07ae237c82a11450b0843e658111f21cbb2c7768a6fa3a958f94ecde

SHA512
fde0db34658923c4563587d9342eec76bbe606e2d40cdb6e161a5a0f6352283bbf8c48dfd4eb8855b5b8b5d52d8f46a9b776e8a07ad7d74c7f985fa42cbf4e10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3813.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3933.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
C:\Windows\Tasks\Hkbsse.job

Filesize
266B

MD5
60b27bbaebc9fac69c7798cdf42e8151

SHA1
80aae5cef677ff13ef06d7d5c46cdb86e5f1564b

SHA256
e30934f1dde775d875d65c94b32c459c811597e771f7deb55de7de82442c222a

SHA512
c408eb0cdfbdfc0c54627f61b02c28b2cc21cafa09ff4feb558b0cfb97e089d1161c64cb5e49f380eb1147ef8f631af30d1086b4368700752dcf2bdd004c740c

Download Submit
\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe

Filesize
1.8MB

MD5
424c6708835f73f821184930d309d6b0

SHA1
a5fb4538c45704889ddb590990982d9742fde273

SHA256
94b31370c8afa5ed76290f1d847a123622e3ecd769eba80b650545a1b26bb363

SHA512
5be89e5c087dd1c7691bbf3ca5cd71cf56f58f4b50ccdfd008bdda514ebadaa66af07e02ca92863dd58e6c9095e721a7379b1675c38225636ef04bcc816fcb2c

Download Submit
\Users\Admin\AppData\Local\Temp\SetupWizard-b0192c1695652b81\SetupWizard.exe

Filesize
42.6MB

MD5
e4b86504b7f85a6248e3dfd4e2e9fdf5

SHA1
d932f240e9b50e58ee4962040d6c856d98630c09

SHA256
ae0b50c7c42615b19e0c4cf5d05611ca1e057929b8065fe9a99d7a492c9b441a

SHA512
7baac3b3eac897e06c7f7623d563fa9ab90c26ff04783a511a241ae59755316c9a580d7b91d0e227c6df14a21c4750c6c0a52f02e9c9282b597686878216ffa2

Download Submit
\Users\Admin\AppData\Local\Temp\SetupWizard.exe

Filesize
36.2MB

MD5
bfa6ee61bd4d54d0168942bd934fca57

SHA1
fe32c8db5e2d86f45056b88a795cb64e89f9e9d9

SHA256
674c91e5221bea7c55e22322173859bbbdb4491e03ea17b19976c708d8c65397

SHA512
f542ff662ce5c9b394f7aca1adc8ccbf8384161f9a09274cc2a5c2a0a639cd43ae1babbebb54ce3a59e7b4450b67ed9f0156009a983f73db5d39aa79f115002b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1568_133631855707514000\stub.exe

Filesize
18.0MB

MD5
ed9d600d2e640eaa1c915dc516da9988

SHA1
9c10629bc0255009434e64deaee5b898fc3711e2

SHA256
2b8a2a3c53a019ca674287e1513a8e0851f2181699e37f385541537801ed1d41

SHA512
9001454bfabf2d9621ad997726aad281638c4b2e8dc134994f479d391bae91c5d0aa24317e85e8e91956cc34357e1ed9d6682f2fe9a023d74b003a420325db68

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1732_133631855437166000\python310.dll

Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1732_133631855437166000\stub.exe

Filesize
17.9MB

MD5
972d9d2422f1a71bed840709024302f8

SHA1
e52170710e3c413ae3cfa45fcdecf19db4aa382c

SHA256
1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

SHA512
3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

Download Submit
memory/320-285-0x000000013FDC0000-0x000000013FDE4000-memory.dmp

Filesize
144KB

Download
memory/1628-88-0x0000000000C60000-0x0000000000CB0000-memory.dmp

Filesize
320KB

Download
memory/1732-250-0x000000013F820000-0x00000001402F5000-memory.dmp

Filesize
10.8MB

Download
memory/1872-214-0x000000013F820000-0x0000000140A55000-memory.dmp

Filesize
18.2MB

Download
memory/1876-298-0x0000000005350000-0x000000000543C000-memory.dmp

Filesize
944KB

Download
memory/1876-331-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-319-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-300-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-301-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-303-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-305-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-283-0x0000000000170000-0x000000000050C000-memory.dmp

Filesize
3.6MB

Download
memory/1876-307-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-309-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-297-0x0000000004A70000-0x0000000004B76000-memory.dmp

Filesize
1.0MB

Download
memory/1876-311-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-299-0x0000000002060000-0x000000000207C000-memory.dmp

Filesize
112KB

Download
memory/1876-347-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-355-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-353-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-351-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-349-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-345-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-343-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-341-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-339-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-337-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-335-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-333-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-313-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-329-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-328-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-325-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-323-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-321-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-317-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1876-315-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/2488-16-0x00000000002C0000-0x0000000000770000-memory.dmp

Filesize
4.7MB

Download
memory/2488-0-0x00000000002C0000-0x0000000000770000-memory.dmp

Filesize
4.7MB

Download
memory/2488-1-0x0000000077900000-0x0000000077902000-memory.dmp

Filesize
8KB

Download
memory/2488-2-0x00000000002C1000-0x00000000002EF000-memory.dmp

Filesize
184KB

Download
memory/2488-3-0x00000000002C0000-0x0000000000770000-memory.dmp

Filesize
4.7MB

Download
memory/2488-5-0x00000000002C0000-0x0000000000770000-memory.dmp

Filesize
4.7MB

Download
memory/2488-14-0x0000000006EF0000-0x00000000073A0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-18-0x0000000000841000-0x000000000086F000-memory.dmp

Filesize
184KB

Download
memory/2880-375-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-21-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-19-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-265-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-166-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-17-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2880-284-0x0000000000840000-0x0000000000CF0000-memory.dmp

Filesize
4.7MB

Download
memory/2960-105-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download