Overview

overview

10

Static

static

3

5a0417adf3...91.exe

windows7-x64

10

5a0417adf3...91.exe

windows10-2004-x64

10

Resubmissions

18-06-2024 17:37

240618-v68syatapc 10

18-06-2024 17:32

240618-v4sc6sshrd 10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 17:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a0417adf39c3200f3b5704ff68fa942550dbd3927fd040b392fc5804eb68f91.exe

  • Size

    1.8MB

  • MD5

    fefaa057262091a3e858370c890329b5

  • SHA1

    df89aa3f53e121bc95aedcbb3a9ed314e56ec773

  • SHA256

    5a0417adf39c3200f3b5704ff68fa942550dbd3927fd040b392fc5804eb68f91

  • SHA512

    ed65b8ed06e777485841b4b8988371a1ffba58232e471dff1f598cdf936d3503c598de468ec5d181bedd12b1ff0b14313b0e64be1e2cc47f502130bef05952db

  • SSDEEP

    49152:U+xQxnvVzrVHPiaUQA0WCDBgBLRxsngVVojnG37uVMwxhoyBk:U+xeNzISA0dDBQLR18o7w3R

Score
10/10
amadeymonsterredlinee76b71newbilddiscoveryevasionexecutioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

C2

http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

C2

185.215.113.67:40960

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detects Monster Stealer. 2 IoCs
  • Monster

    Monster is a Golang stealer that was discovered in 2024.

    stealermonster
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 26 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 42 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 16 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 18 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a0417adf39c3200f3b5704ff68fa942550dbd3927fd040b392fc5804eb68f91.exe
    "C:\Users\Admin\AppData\Local\Temp\5a0417adf39c3200f3b5704ff68fa942550dbd3927fd040b392fc5804eb68f91.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:340
        • C:\Users\Admin\AppData\Local\Temp\onefile_340_133632058483240000\stub.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2792
      • C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
        "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2028
      • C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
        "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 52
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2324
      • C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe
        "C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Users\Admin\AppData\Local\Temp\SetupWizard.exe
          SetupWizard.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Users\Admin\AppData\Local\Temp\SetupWizard-fc557bf9815c0452\SetupWizard.exe
            "C:\Users\Admin\AppData\Local\Temp\SetupWizard-fc557bf9815c0452\SetupWizard.exe"
            5⤵
            • Executes dropped EXE
            PID:3004
      • C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 84
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2356
      • C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
        3⤵
        • Executes dropped EXE
        PID:2832
      • C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
        "C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
            PID:676
        • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
          "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:348
          • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2344
            • C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • Suspicious use of FindShellTrayWindow
              PID:2156
              • C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
                "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
                6⤵
                • Executes dropped EXE
                PID:1756
            • C:\Users\Admin\AppData\Local\Temp\1000004001\FirstZ.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\FirstZ.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              PID:2320
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Suspicious use of AdjustPrivilegeToken
                PID:1548
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                6⤵
                  PID:2316
                  • C:\Windows\system32\wusa.exe
                    wusa /uninstall /kb:890830 /quiet /norestart
                    7⤵
                    • Drops file in Windows directory
                    PID:1688
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop UsoSvc
                  6⤵
                  • Launches sc.exe
                  PID:2040
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                  6⤵
                  • Launches sc.exe
                  PID:2192
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop wuauserv
                  6⤵
                  • Launches sc.exe
                  PID:2760
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop bits
                  6⤵
                  • Launches sc.exe
                  PID:2832
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop dosvc
                  6⤵
                  • Launches sc.exe
                  PID:1796
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2784
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2460
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1040
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2000
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe delete "WSNKISKT"
                  6⤵
                  • Launches sc.exe
                  PID:484
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                  6⤵
                  • Launches sc.exe
                  PID:3068
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop eventlog
                  6⤵
                  • Launches sc.exe
                  PID:2400
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe start "WSNKISKT"
                  6⤵
                  • Launches sc.exe
                  PID:536
          • C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
            "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2228
            • C:\Users\Admin\AppData\Local\Temp\onefile_2228_133632058672624000\stub.exe
              "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1616
          • C:\Users\Admin\AppData\Local\Temp\1000073001\bin.exe
            "C:\Users\Admin\AppData\Local\Temp\1000073001\bin.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:2512
            • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              PID:1252
              • C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe
                "C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:1076
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1556
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:852
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1960
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:380
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe delete "YCSDKNAW"
                  6⤵
                  • Launches sc.exe
                  PID:1964
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe create "YCSDKNAW" binpath= "C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe" start= "auto"
                  6⤵
                  • Launches sc.exe
                  PID:2420
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop eventlog
                  6⤵
                  • Launches sc.exe
                  PID:1788
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe start "YCSDKNAW"
                  6⤵
                  • Launches sc.exe
                  PID:1900
          • C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
            "C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe"
            3⤵
            • Executes dropped EXE
            PID:2380
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 64
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:2236
      • C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
        C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:2880
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:320
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:580
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:2708
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1012
        • C:\Windows\system32\conhost.exe
          conhost.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1144
      • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
        C:\ProgramData\wikombernizc\reakuqnanrkn.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:1244
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1580
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          2⤵
            PID:2568
            • C:\Windows\system32\wusa.exe
              wusa /uninstall /kb:890830 /quiet /norestart
              3⤵
              • Drops file in Windows directory
              PID:380
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop UsoSvc
            2⤵
            • Launches sc.exe
            PID:848
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop WaaSMedicSvc
            2⤵
            • Launches sc.exe
            PID:2084
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop wuauserv
            2⤵
            • Launches sc.exe
            PID:2252
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop bits
            2⤵
            • Launches sc.exe
            PID:2992
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop dosvc
            2⤵
            • Launches sc.exe
            PID:1948
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2700
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2016
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2544
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:316
          • C:\Windows\system32\conhost.exe
            C:\Windows\system32\conhost.exe
            2⤵
              PID:1036
            • C:\Windows\explorer.exe
              explorer.exe
              2⤵
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2720

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          System Services

          2
          T1569

          Service Execution

          2
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Power Settings

          1
          T1653

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Defense Evasion

          Impair Defenses

          1
          T1562

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Unsecured Credentials

          2
          T1552

          Credentials In Files

          2
          T1552.001

          Discovery

          Query Registry

          4
          T1012

          System Information Discovery

          2
          T1082

          Virtualization/Sandbox Evasion

          2
          T1497

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            7ebc379f8b5e4eefccae9a9e20332b82

            SHA1

            3a63d267b19ef7774faaef87ade78c5fc4674df3

            SHA256

            d7bee3936708aa3b183846078b3ffb2e3bfd82eb1d10f1957c423d3de6021aa8

            SHA512

            91d2f0e0ee2baefc88f9d465866a86ffb7c450fcc5a6d27bd415667ee037c876a57985075c1169e6dc643086afa6add4ea49aeff9c42afb7fd83939e4409d1db

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe
            Filesize

            2.5MB

            MD5

            fbfbe4ee13baecac3e7d16bec24cf079

            SHA1

            360caf2bb458bee7e65c316099a868b929839d25

            SHA256

            3d65e5f78fa228a79d279fd903b45e584effe6b680d3a3adcb582985de62d01e

            SHA512

            8f5d849e739430cdc560f9dbda5f2f72a07ed0493054298b0d195cf50c972e9a24effdb71cadeea6ced14663fc1268f4a0f45234f37aac334638ffcd8057b28a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe
            Filesize

            455KB

            MD5

            f8ec725e4b969f157fd70166e73a56a3

            SHA1

            8bc092817245f2727154454e0011a8d6704e2eb7

            SHA256

            eb74efaf4832a80809815051fc97704819fbc4b1d57f07faf39746a02ed1dd10

            SHA512

            7dc3acb485263fd616ea84999a897f0e298f21485a34457697c523a095083d7de599b3cfc4bc3d45a5d36bc374a3a5e8778646dfa97c447d4be710021678e040

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000004001\FirstZ.exe
            Filesize

            2.5MB

            MD5

            ffada57f998ed6a72b6ba2f072d2690a

            SHA1

            6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

            SHA256

            677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

            SHA512

            1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
            Filesize

            10.7MB

            MD5

            c09ff1273b09cb1f9c7698ed147bf22e

            SHA1

            5634aec5671c4fd565694aa12cd3bf11758675d2

            SHA256

            bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

            SHA512

            e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
            Filesize

            297KB

            MD5

            0efd5136528869a8ea1a37c5059d706e

            SHA1

            3593bec29dbfd333a5a3a4ad2485a94982bbf713

            SHA256

            7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e

            SHA512

            4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
            Filesize

            1.7MB

            MD5

            e8a7d0c6dedce0d4a403908a29273d43

            SHA1

            8289c35dabaee32f61c74de6a4e8308dc98eb075

            SHA256

            672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a

            SHA512

            c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe
            Filesize

            96KB

            MD5

            8677376c509f0c66d1f02c6b66d7ef90

            SHA1

            e057eddf9d2e319967e200a5801e4bbe6e45862a

            SHA256

            f7afac39d2754ac953bf129ee094c8b092e349cdf35f1ba23c2c76a0229f9e96

            SHA512

            e0c685e289c10a48b5fa251aa4414653c103dac69faf536b9ae9598e066aab5a03b03c09096c42a0f244aeaf80f2b9e4aa28d6b28da436587a3f52a9155473d0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
            Filesize

            522KB

            MD5

            70a578f7f58456e475facd69469cf20a

            SHA1

            83e147e7ba01fa074b2f046b65978f838f7b1e8e

            SHA256

            5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

            SHA512

            707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
            Filesize

            310KB

            MD5

            6e3d83935c7a0810f75dfa9badc3f199

            SHA1

            9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

            SHA256

            dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

            SHA512

            9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
            Filesize

            3.6MB

            MD5

            c28a2d0a008788b49690b333d501e3f3

            SHA1

            6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

            SHA256

            f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

            SHA512

            455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
            Filesize

            415KB

            MD5

            07101cac5b9477ba636cd8ca7b9932cb

            SHA1

            59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

            SHA256

            488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

            SHA512

            02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
            Filesize

            10.7MB

            MD5

            3f4f5c57433724a32b7498b6a2c91bf0

            SHA1

            04757ff666e1afa31679dd6bed4ed3af671332a3

            SHA256

            0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665

            SHA512

            cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000073001\bin.exe
            Filesize

            424KB

            MD5

            13e5872e9b7c47090e035dc228c5589f

            SHA1

            c55a9708091f19b5fc5baf7c37beb99d8d3bf760

            SHA256

            d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

            SHA512

            260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
            Filesize

            659KB

            MD5

            bbd06263062b2c536b5caacdd5f81b76

            SHA1

            c38352c1c08fb0fa5e67a079998ef30ebc962089

            SHA256

            1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

            SHA512

            7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\340930862140
            Filesize

            64KB

            MD5

            f09d06ff6316d9fefa057fec990b7ca0

            SHA1

            eb0346a758134ddab15e613e0d271532d70b0191

            SHA256

            4b4b1387ff2ef85aae80a91f59e978235ed7673ff6ba41ab5d9a8d6c2ca5bb31

            SHA512

            726c4ff07d35003074359579f5f98c0a6d45837d21acd8f086000fbb9a33f8cc624147deec97f1e5c8922837f30a464b17f5bffad65060d47f709bcf2e024fc3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
            Filesize

            1.8MB

            MD5

            fefaa057262091a3e858370c890329b5

            SHA1

            df89aa3f53e121bc95aedcbb3a9ed314e56ec773

            SHA256

            5a0417adf39c3200f3b5704ff68fa942550dbd3927fd040b392fc5804eb68f91

            SHA512

            ed65b8ed06e777485841b4b8988371a1ffba58232e471dff1f598cdf936d3503c598de468ec5d181bedd12b1ff0b14313b0e64be1e2cc47f502130bef05952db

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Cab51DA.tmp
            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\SetupWizard.exe
            Filesize

            36.2MB

            MD5

            bfa6ee61bd4d54d0168942bd934fca57

            SHA1

            fe32c8db5e2d86f45056b88a795cb64e89f9e9d9

            SHA256

            674c91e5221bea7c55e22322173859bbbdb4491e03ea17b19976c708d8c65397

            SHA512

            f542ff662ce5c9b394f7aca1adc8ccbf8384161f9a09274cc2a5c2a0a639cd43ae1babbebb54ce3a59e7b4450b67ed9f0156009a983f73db5d39aa79f115002b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Tar5298.tmp
            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\onefile_2228_133632058672624000\stub.exe
            Filesize

            18.0MB

            MD5

            ed9d600d2e640eaa1c915dc516da9988

            SHA1

            9c10629bc0255009434e64deaee5b898fc3711e2

            SHA256

            2b8a2a3c53a019ca674287e1513a8e0851f2181699e37f385541537801ed1d41

            SHA512

            9001454bfabf2d9621ad997726aad281638c4b2e8dc134994f479d391bae91c5d0aa24317e85e8e91956cc34357e1ed9d6682f2fe9a023d74b003a420325db68

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\onefile_340_133632058483240000\stub.exe
            Filesize

            17.9MB

            MD5

            972d9d2422f1a71bed840709024302f8

            SHA1

            e52170710e3c413ae3cfa45fcdecf19db4aa382c

            SHA256

            1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

            SHA512

            3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

            Download Submit

          • C:\Windows\Tasks\Hkbsse.job
            Filesize

            266B

            MD5

            a0c7445cce46df81cfb154347b0e6a82

            SHA1

            e1539f81ab9a69419787cad93e7a0d6169da50af

            SHA256

            8a5821190ebf3d9a888896a1ddd86baa7e9f419735660f4c518569053a57ca2b

            SHA512

            88f4fa41db4b216479249063946d8035f6f300f59f93c2f8eb6f1dc4246b7d6497b2dada2faca50dbd89f65aff48df8c65c566d72ebc4277bdf6eb5c6bb62dce

            Download Submit

          • \Users\Admin\AppData\Local\Temp\SetupWizard-fc557bf9815c0452\SetupWizard.exe
            Filesize

            42.6MB

            MD5

            e4b86504b7f85a6248e3dfd4e2e9fdf5

            SHA1

            d932f240e9b50e58ee4962040d6c856d98630c09

            SHA256

            ae0b50c7c42615b19e0c4cf5d05611ca1e057929b8065fe9a99d7a492c9b441a

            SHA512

            7baac3b3eac897e06c7f7623d563fa9ab90c26ff04783a511a241ae59755316c9a580d7b91d0e227c6df14a21c4750c6c0a52f02e9c9282b597686878216ffa2

            Download Submit

          • \Users\Admin\AppData\Local\Temp\onefile_340_133632058483240000\python310.dll
            Filesize

            4.3MB

            MD5

            c80b5cb43e5fe7948c3562c1fff1254e

            SHA1

            f73cb1fb9445c96ecd56b984a1822e502e71ab9d

            SHA256

            058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

            SHA512

            faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

            Download Submit

          • memory/340-271-0x000000013FD60000-0x0000000140835000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1300-106-0x0000000000020000-0x0000000000021000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1548-711-0x000000001B560000-0x000000001B842000-memory.dmp

            Filesize

            2.9MB

            Download

          • memory/1548-712-0x0000000001E40000-0x0000000001E48000-memory.dmp

            Filesize

            32KB

            Download

          • memory/1580-665-0x0000000019ED0000-0x000000001A1B2000-memory.dmp

            Filesize

            2.9MB

            Download

          • memory/1580-666-0x00000000009C0000-0x00000000009C8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2028-89-0x00000000002F0000-0x0000000000340000-memory.dmp

            Filesize

            320KB

            Download

          • memory/2032-3-0x0000000000BD0000-0x0000000001090000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2032-17-0x0000000006A20000-0x0000000006EE0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2032-16-0x0000000000BD0000-0x0000000001090000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2032-5-0x0000000000BD0000-0x0000000001090000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2032-10-0x0000000000BD0000-0x0000000001090000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2032-2-0x0000000000BD1000-0x0000000000BFF000-memory.dmp

            Filesize

            184KB

            Download

          • memory/2032-1-0x00000000776D0000-0x00000000776D2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2032-0-0x0000000000BD0000-0x0000000001090000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2372-322-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-282-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-318-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-316-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-314-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-312-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-310-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-308-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-306-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-304-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-302-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-300-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-298-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-296-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-294-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-292-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-324-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-290-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-288-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-286-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-284-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-320-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-280-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-278-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-276-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-275-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-326-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-328-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-270-0x00000000013E0000-0x000000000177C000-memory.dmp

            Filesize

            3.6MB

            Download

          • memory/2372-330-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-272-0x0000000000DE0000-0x0000000000EE6000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/2372-332-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2372-274-0x0000000000AD0000-0x0000000000AEC000-memory.dmp

            Filesize

            112KB

            Download

          • memory/2372-273-0x00000000012C0000-0x00000000013AC000-memory.dmp

            Filesize

            944KB

            Download

          • memory/2632-481-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2632-460-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2632-406-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2632-220-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2632-22-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2632-20-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2632-19-0x0000000000C21000-0x0000000000C4F000-memory.dmp

            Filesize

            184KB

            Download

          • memory/2632-18-0x0000000000C20000-0x00000000010E0000-memory.dmp

            Filesize

            4.8MB

            Download