amadey | fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.1MB
Sample240809-ynnltsxdlm
SHA256 fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
MD5 7adfc6a2e7a5daa59d291b6e434a59f3
SHA1 e21ef8be7b78912bed36121404270e5597a3fe25
SHA512 30f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b
SSDEEP 24576:RvqqvYZAFnc7EtexlphsFHMQSuRoEPmXG1YO:8qvOA1jexlDsoAmXKYO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey a51500 discovery trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

a51500

http://api.garageserviceoperation.com

Attributes

install_dir
0cf505a27f
install_file
ednfovi.exe
strings_key
0044a8b8e295529eaf3743c9bc3171d2
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3060 created 1244	3060	Beijing.pif	21
PID 3060 created 1244	3060	Beijing.pif	21

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3060	Beijing.pif

Loads dropped DLL 1 IoCs

pid	Process
2836	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com
26	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2908	tasklist.exe
1368	tasklist.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EquationExplorer	file.exe
File opened for modification	C:\Windows\TreeProfessor	file.exe
File opened for modification	C:\Windows\SysOrleans	file.exe
File opened for modification	C:\Windows\HostelGalleries	file.exe
File opened for modification	C:\Windows\ConfiguringUps	file.exe
File opened for modification	C:\Windows\ExplorerProprietary	file.exe
File opened for modification	C:\Windows\ChestAntique	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beijing.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Beijing.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Beijing.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Beijing.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Beijing.pif

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	tasklist.exe
Token: SeDebugPrivilege	1368	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3060	Beijing.pif
3060	Beijing.pif
3060	Beijing.pif

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2836	2240	file.exe	30
PID 2240 wrote to memory of 2836	2240	file.exe	30
PID 2240 wrote to memory of 2836	2240	file.exe	30
PID 2240 wrote to memory of 2836	2240	file.exe	30
PID 2836 wrote to memory of 2908	2836	cmd.exe	32
PID 2836 wrote to memory of 2908	2836	cmd.exe	32
PID 2836 wrote to memory of 2908	2836	cmd.exe	32
PID 2836 wrote to memory of 2908	2836	cmd.exe	32
PID 2836 wrote to memory of 2780	2836	cmd.exe	33
PID 2836 wrote to memory of 2780	2836	cmd.exe	33
PID 2836 wrote to memory of 2780	2836	cmd.exe	33
PID 2836 wrote to memory of 2780	2836	cmd.exe	33
PID 2836 wrote to memory of 1368	2836	cmd.exe	35
PID 2836 wrote to memory of 1368	2836	cmd.exe	35
PID 2836 wrote to memory of 1368	2836	cmd.exe	35
PID 2836 wrote to memory of 1368	2836	cmd.exe	35
PID 2836 wrote to memory of 2612	2836	cmd.exe	36
PID 2836 wrote to memory of 2612	2836	cmd.exe	36
PID 2836 wrote to memory of 2612	2836	cmd.exe	36
PID 2836 wrote to memory of 2612	2836	cmd.exe	36
PID 2836 wrote to memory of 2588	2836	cmd.exe	37
PID 2836 wrote to memory of 2588	2836	cmd.exe	37
PID 2836 wrote to memory of 2588	2836	cmd.exe	37
PID 2836 wrote to memory of 2588	2836	cmd.exe	37
PID 2836 wrote to memory of 2620	2836	cmd.exe	38
PID 2836 wrote to memory of 2620	2836	cmd.exe	38
PID 2836 wrote to memory of 2620	2836	cmd.exe	38
PID 2836 wrote to memory of 2620	2836	cmd.exe	38
PID 2836 wrote to memory of 2292	2836	cmd.exe	39
PID 2836 wrote to memory of 2292	2836	cmd.exe	39
PID 2836 wrote to memory of 2292	2836	cmd.exe	39
PID 2836 wrote to memory of 2292	2836	cmd.exe	39
PID 2836 wrote to memory of 3060	2836	cmd.exe	40
PID 2836 wrote to memory of 3060	2836	cmd.exe	40
PID 2836 wrote to memory of 3060	2836	cmd.exe	40
PID 2836 wrote to memory of 3060	2836	cmd.exe	40
PID 2836 wrote to memory of 752	2836	cmd.exe	41
PID 2836 wrote to memory of 752	2836	cmd.exe	41
PID 2836 wrote to memory of 752	2836	cmd.exe	41
PID 2836 wrote to memory of 752	2836	cmd.exe	41
PID 3060 wrote to memory of 1016	3060	Beijing.pif	42
PID 3060 wrote to memory of 1016	3060	Beijing.pif	42
PID 3060 wrote to memory of 1016	3060	Beijing.pif	42
PID 3060 wrote to memory of 1016	3060	Beijing.pif	42
PID 3060 wrote to memory of 572	3060	Beijing.pif	43
PID 3060 wrote to memory of 572	3060	Beijing.pif	43
PID 3060 wrote to memory of 572	3060	Beijing.pif	43
PID 3060 wrote to memory of 572	3060	Beijing.pif	43
PID 1016 wrote to memory of 1576	1016	cmd.exe	46
PID 1016 wrote to memory of 1576	1016	cmd.exe	46
PID 1016 wrote to memory of 1576	1016	cmd.exe	46
PID 1016 wrote to memory of 1576	1016	cmd.exe	46

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2908
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1368
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 40365
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "HopeBuildersGeniusIslam" Sonic
      4⤵
      System Location Discovery: System Language Discovery
      PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pif
      Beijing.pif s
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3060
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\40365\s
Size 554KB
SHA256 ff64ae2a70b07eba7678241a8fa20f3569a03cc5cdc087306a4451acd97ee2db
MD5 30ab54ae1c615436d881fc336c264fef
SHA1 7e2a049923d49ae5859d2a0aa3a7dd092e672bd1
SHA512 1af06fd6d67c59df3a32fbc4c12e8788f5e3b46a1ca2e1ddc8bc9926d1bacb0b702f2d88e950fc04145d3b904e60e8910acf6fc0f87bd676459b10fc25707be9
SSDEEP 12288:5kdTEt7IAC8do9FExcbF22ALkjQRjFHwFjPiRJnPFTFcUzeyF:mluEUAFgcjRsFHwVqD/ee
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabCA24.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabCA24.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Continue

Path C:\Users\Admin\AppData\Local\Temp\Continue
Size 31KB
SHA256 a8181f349864c6c9a216935894392b75d0d1430d43a255ff3a9ad56c325487e7
MD5 6184a8fc79d602bc18c0badb08598580
SHA1 de3a273e7020d43729044e41272c301118cc3641
SHA512 41687b30ecd957eb1b6d332133f1c1d7e01cc1c8bf56526dfa20de3937ed549133e93872380e3b51b63b33134c62d4df91c7e08e908ca18b3e6f9d52e89378cb
SSDEEP 768:vzso+XZDvXwh7WaHnsAdKppiQljFTU6cOHd3:LsFBXc7WaMYQpiQljRN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Continues

Path C:\Users\Admin\AppData\Local\Temp\Continues
Size 14KB
SHA256 e04a1b86ce1a5352f7c3a5ddb8b500993f4342ef4e188ed156009e5271795af1
MD5 2226738a67da04cef580c99f70b9a514
SHA1 48bbfbfdce94231ebc1833b87ff6e79aa716e3b4
SHA512 c653aafd3aa2d320eef1d5b9cf9e58372e778c41147c3d85bcb6e231c8703d19f410ebb2f58f2a9f0671f027fce2baeeec70252e926bb9880128ba6dcedfdb08
SSDEEP 384:eVBYHob1k4dljIDMob5chIukwWXVU9/b16+atFkjPom:eR1k4HjIJa1OVa/b16+atAPom
MD5 SHA1 SHA512 SSDEEP

Submit Download

Corresponding

Path C:\Users\Admin\AppData\Local\Temp\Corresponding
Size 871KB
SHA256 fa349d460b066e9b325db200251ae35892353462c352728cfb0fa405c293f725
MD5 7eb7312237cf8653a876136046ce8b3e
SHA1 250d61e72b9a6d0d436e04b569459bb69bb2ab9e
SHA512 778fbbec7cd5c9d2aa3623f73604fd7a6e98d3673b50ab7e8ac54c8aa3d955c103d7cdc0838e00f256ade000c979860bf54d3d2b36dd3dcd4fe8fca9f1c82699
SSDEEP 12288:/pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:/T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dietary

Path C:\Users\Admin\AppData\Local\Temp\Dietary
Size 89KB
SHA256 6d86469ced96b57db84de11f9eac77c8076a3bfa65942776f7cc50625fbd31ca
MD5 30a3ed3849e36b4c26a02cf030ea985a
SHA1 d3d29d3ba2c033d0abb6105cd274001e65d07f4e
SHA512 158aabac6f79393a2a7faed30693f78191bf97771a6125229873abedceef71d5df7d5bb934fdfa1ff4c683df49a158e5ba3efea9a4dd10dce8ba24b3c4fc507d
SSDEEP 1536:W2Kcm/aSE8g+5pcwQJiCDvjkiEk1T7bmZCsbfRRzozVFb9/wHBxMJxCFF:W2w/u6AwQ9vjFjTvsCsbfRRozHgxMaFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Minister

Path C:\Users\Admin\AppData\Local\Temp\Minister
Size 98KB
SHA256 526b6cbf430fc40eb8d23cd2c4ee1c81e04a2c9e01167370527f19465f67c452
MD5 97dd60ac57e3f1873f3120688d47cd3d
SHA1 e8941900dac0dd9b9ac4b7a08d3ace40c3cc9736
SHA512 831eb3f1bd352173db735e4f5e2a4c9380006e3146ecd466b415d7ef7e2c0a345b4da0ebc0415043a9599859e2fb2a131e8d3fc5012d1ccc7473b0ebd4fd076a
SSDEEP 3072:brklr7dwYrsHKN3Il8do2mvAY6N3eUXBcbF2n23:bm7+KsYIl8do9FYhxcbF223
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mobile

Path C:\Users\Admin\AppData\Local\Temp\Mobile
Size 76KB
SHA256 08e8e54417a8e7007aeedb0399f4e549fc31aaf6031416c8d30306fe350c1f84
MD5 b81b3a6c6725be1cdd528e5fb3a9aa07
SHA1 069d5fd30b48bf5345d21c2af0106325e9372c8f
SHA512 7a04ee23c0b3d832fa518390253c0153829e7ab0907209dc67c5eae687ad648ab18aa7d064e544c1da3b03cc610ed10fe63a73fc5aaa129402a561843aa975e2
SSDEEP 1536:tkUl1VfagFJ8VOATq22GEpmMb0mMDKzSUW+F/scfV5Uq/FypYOaJT:tkUlfagFJcOATl2bbCDKzTWMzUCwpzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Mr
Size 86KB
SHA256 5defb1b1225282e2ab46d4257416334b5344e5b0a020b4b7900436c59684de65
MD5 0c3f23378f256b116fca366d08dbd146
SHA1 c6c92667dea09b7a4b2b00193ee043278854db1e
SHA512 0db03b484ce0849bd005ec962e69fea3f8b728739e622ad57519e9411d5257026938b9eb8db050bb355a624f34b19bfe0e0fb8af888bab99d4febb5ec89381f3
SSDEEP 1536:CzYfX1FH8AhbqeIKIwpZOaIitfopTBXUZDJBL7EmQyi/:MYflx8Ah0AkdTEZDJl+y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sonic

Path C:\Users\Admin\AppData\Local\Temp\Sonic
Size 982B
SHA256 fc6ba37a8bfe546d8186e92c2f729080b00d4371ef2e8e3a18ec66acc1cf199e
MD5 1b5bba21607d9a9c3293ff564ecf4f1a
SHA1 de790d57fbfae12e649bf65fd9695e36a266696a
SHA512 b9e23dd79986397c9fe5c1ac150c60c8993f89488645f06e0865abb2491dc3b9949867753d76cab34352445459601c339a6f78ff8b48323951638f9666d6a74a
MD5 SHA1 SHA512

Submit Download

Speak

Path C:\Users\Admin\AppData\Local\Temp\Speak
Size 55KB
SHA256 93ddbcd9109129656049162e3f6a8d9fffdc5a3da262e0a2bf2bc4624014f7b0
MD5 0e16cafd2403c552149e325d90637d12
SHA1 efe1e6af41751ca9978c3a21c82ef135a8846f21
SHA512 0251de7abb9a4457cf16dab0b1e88d0897c5b6655cdf27b9c298c1796925ea2514cd2f065106eccd56b97a6804e84f459806d528837bf9718c7c9e525f7159ec
SSDEEP 1536:dv/iE+BO9feoh41Cm6o2QdecHYN/TVXbC:dHi9BOEs41JN2QdtHYFFbC
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarCA37.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarCA37.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Template

Path C:\Users\Admin\AppData\Local\Temp\Template
Size 56KB
SHA256 4734d4d0626e140398a788226a5985e814bbd674f4218b60a89fd2da8f4ceb94
MD5 0e70f873cb8f5615dd364325b714895a
SHA1 089a8f5d7d90e7eedd6d02e30aa458440c89d7a7
SHA512 867dbac35991b2222f5fb4f5fc6dca4640b386356dff12322fdc06bb05b8af7c438e15f9fc6b4d4cedc27f081480d4187c1b4007831d9a052c3beda8d3c56ac4
SSDEEP 768:tgPLJcZKaNZ6vBI1RggHmYLsbPsbrdPmOHv7J3LjgmvtCXK76MPraSv6KeJeQiKb:tgPLGZJNZhnmY9rdlzJD8Zm7Qi8M6UG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zinc

Path C:\Users\Admin\AppData\Local\Temp\Zinc
Size 63KB
SHA256 dc4aac8b9eb62788bd04316293cde7e3d839e828e3e3082a2d81922ca8a94c81
MD5 51143491656ae2ee983d709c45a41861
SHA1 1cf8eb8d13246195cfc6168524d212c9a65b4681
SHA512 239f2903b3b5177b32971ae3eb3eab2cc4c3d7856a3839f184c7f59b7e3cd53de4dac3363519e82acd183e564ae688dc8a7e5097c1283699714584ee13bed67d
SSDEEP 1536:pN68Jyg4Hxj+nYKff0E5cjEYsiYFCpw/ej4j93rtJl+:ykyTHxjsYpE50EYsnuyekrtJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beijing.pif

Path \Users\Admin\AppData\Local\Temp\40365\Beijing.pif
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3060-37-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download

memory/3060-38-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download

memory/3060-39-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download

memory/3060-40-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download

memory/3060-41-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download

memory/3060-42-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download

memory/3060-43-0x0000000003A30000-0x0000000003A9F000-memory.dmp

Download