Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 04:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 1.8MB
  • Sample240820-eynj2atane
  • SHA256 da8c8c3030b31ae0cfd9cfba987b6bd6124da45272df0cfb1f256548cfe07679
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummaredlinestealc14082024816fa@cloudytteama51500defaultfed3aalivetrafficcredential_accessdiscoveryevasioninfostealerspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 95.179.163.21:29257

Extracted

Family

  • redline

Botnet

  • @CLOUDYTTEAM

C2

  • 65.21.18.51:45580

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

  • redline

Botnet

  • 14082024

C2

  • 185.215.113.67:21405

Extracted

Family

  • redline

Botnet

  • 816FA

C2

  • 88.99.151.68:7200

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • a51500

C2

  • http://api.garageserviceoperation.com

Attributes
  • install_dir

    0cf505a27f

  • install_file

    ednfovi.exe

  • strings_key

    0044a8b8e295529eaf3743c9bc3171d2

  • url_paths

    /CoreOPT/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://potentioallykeos.shop/api

  • https://interactiedovspm.shop/api

  • https://charecteristicdxp.shop/api

  • https://cagedwifedsozm.shop/api

  • https://deicedosmzj.shop/api

  • https://southedhiscuso.shop/api

  • https://consciousourwi.shop/api

  • https://tenntysjuxmz.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 12 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 25 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:2104
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                PID:1084
            • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1892
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1504
                • C:\Users\Admin\AppData\Roaming\9rJixkDnC2.exe
                  "C:\Users\Admin\AppData\Roaming\9rJixkDnC2.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2172
                • C:\Users\Admin\AppData\Roaming\sEZEbPKjCD.exe
                  "C:\Users\Admin\AppData\Roaming\sEZEbPKjCD.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1360
            • C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:708
              • C:\Users\Admin\AppData\Local\Temp\12584a06d7\Hkbsse.exe
                "C:\Users\Admin\AppData\Local\Temp\12584a06d7\Hkbsse.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2232
            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:3052
            • C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe
              "C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:708
            • C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe
              "C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
            • C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe
              "C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3028
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k move Cassette Cassette.cmd & Cassette.cmd & exit
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2060
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2268
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa.exe opssvc.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1412
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:796
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:716
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 177479
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1812
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "FoolBurkeRetainedWait" Drop
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1244
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Tracked + ..\Luggage + ..\Prime + ..\Involved + ..\Fluid + ..\Newport + ..\Rod + ..\Society s
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2704
                • C:\Users\Admin\AppData\Local\Temp\177479\Community.pif
                  Community.pif s
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2096
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:2024
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:1060
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks.exe /create /tn "SkyPilot" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc onlogon /F /RL HIGHEST
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:2508
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2768
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2292
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 15
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1660
            • C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe
              "C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1800
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2144
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2220
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa.exe opssvc.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1528
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1600
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1780
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 40365
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:908
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "HopeBuildersGeniusIslam" Sonic
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1520
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2368
                • C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pif
                  Beijing.pif s
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2736
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2948
            • C:\Users\Admin\AppData\Local\Temp\1000151001\mobiletrans.exe
              "C:\Users\Admin\AppData\Local\Temp\1000151001\mobiletrans.exe"
              4⤵
              • Executes dropped EXE
              PID:2504
            • C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe
              "C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1760
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k move Anytime Anytime.cmd & Anytime.cmd & exit
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:320
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3064
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa.exe opssvc.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2684
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1600
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1608
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 297145
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1212
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "CorkBkConditionsMoon" Scary
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2788
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Dependence + ..\Nsw + ..\Developmental + ..\Shared + ..\Ranges + ..\Notify + ..\Pending + ..\Previously k
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2856
                • C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
                  Cultures.pif k
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:480
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:276
            • C:\Users\Admin\AppData\Local\Temp\1000160001\Identification.exe
              "C:\Users\Admin\AppData\Local\Temp\1000160001\Identification.exe"
              4⤵
              • Executes dropped EXE
              PID:2932
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2040
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:480
        • C:\Windows\SysWOW64\cmd.exe
          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit
          2⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          PID:2204
        • C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
          C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:2968

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Virtualization/Sandbox Evasion

            2
            T1497

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            4
            T1552

            Credentials In Files

            4
            T1552.001

            Discovery

            Process Discovery

            1
            T1057

            Query Registry

            5
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Virtualization/Sandbox Evasion

            2
            T1497

            Lateral Movement

            Collection

            Data from Local System

            3
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GOLD.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
            • Size 323KB
            • SHA256 74e0bf30c9107fa716920c878521037db3ca4eeda5c14d745a2459eb14d1190e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            crypteda.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
            • Size 1.1MB
            • SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            anon.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe
            • Size 416KB
            • SHA256 ea4964f3eccefd735166a547f6fed7a123a292fab52f9a810936ccaabce8eaa9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            kitty.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000064001\kitty.exe
            • Size 319KB
            • SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            stealc_default.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
            • Size 187KB
            • SHA256 80befdb25413d68adbadd8f236a2e8c71b261d8befc04c99749e778b07bcde89
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            clcs.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe
            • Size 6.3MB
            • SHA256 95b45abfc66f31f500af4b03aa645bdf71e64bcbe52d1003a58e947e9f863bac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            14082024.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe
            • Size 304KB
            • SHA256 17b71b1895978b7aaf5a0184948e33ac3d70ce979030d5a9a195a1c256f6b368
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            BattleGermany.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe
            • Size 8.3MB
            • SHA256 7636d2367079eabd9da2bb40935df3da580affc47473fd93ed3b2e01ee6c46e5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            runtime.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe
            • Size 1.1MB
            • SHA256 fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            mobiletrans.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000151001\mobiletrans.exe
            • Size 20.3MB
            • SHA256 2a627e55b12be1b4521658c25d2d46d38b87442f648070311cad06e4995a5304
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            coreplugin.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe
            • Size 1.1MB
            • SHA256 a221b40667002cd19eece4e45e5dbb6f3c3dc1890870cf28ebcca0e4850102f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            download.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000159001\download.exe
            • Size 23KB
            • SHA256 b673eab5d8c09d1bc061e2dbf53e625cc258633a1c80f78abb092bd7b4fae995
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Identification.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1000160001\Identification.exe
            • Size 8.0MB
            • SHA256 17f256015c257cd0b73d14d0d908ccbc317b7e1d8f5ceab2f855c277d7f97e6d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            s
            • Path C:\Users\Admin\AppData\Local\Temp\177479\s
            • Size 550KB
            • SHA256 2dec1a0fd2bc8d3e538484d0c8914fbf3306ee9bec35afeabf9cee4104e1df8d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            axplong.exe
            • Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
            • Size 1.8MB
            • SHA256 da8c8c3030b31ae0cfd9cfba987b6bd6124da45272df0cfb1f256548cfe07679
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Cab2474.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Cab2474.tmp
            • Size 70KB
            • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Cassette
            • Path C:\Users\Admin\AppData\Local\Temp\Cassette
            • Size 6KB
            • SHA256 cd27421f2758e883e53d498e3fafba2b519688c1f482489d51ad75a4fbff3b5f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Continues
            • Path C:\Users\Admin\AppData\Local\Temp\Continues
            • Size 14KB
            • SHA256 e04a1b86ce1a5352f7c3a5ddb8b500993f4342ef4e188ed156009e5271795af1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Corresponding
            • Path C:\Users\Admin\AppData\Local\Temp\Corresponding
            • Size 871KB
            • SHA256 fa349d460b066e9b325db200251ae35892353462c352728cfb0fa405c293f725
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Dietary
            • Path C:\Users\Admin\AppData\Local\Temp\Dietary
            • Size 89KB
            • SHA256 6d86469ced96b57db84de11f9eac77c8076a3bfa65942776f7cc50625fbd31ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Drop
            • Path C:\Users\Admin\AppData\Local\Temp\Drop
            • Size 241B
            • SHA256 73bdf5cf3e6b23be2ad017516c63467578798c5c9b92923ac5a85fad74687505
            • MD5 SHA1 SHA512
            Submit Download

            Fluid
            • Path C:\Users\Admin\AppData\Local\Temp\Fluid
            • Size 77KB
            • SHA256 ee0d0d10a8e626b9ba71378297dc13dd0cc1f5814d505524be75a9b4cbf2e703
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Involved
            • Path C:\Users\Admin\AppData\Local\Temp\Involved
            • Size 92KB
            • SHA256 b32582f214374b6358e389038419f16912a4812fb139492677870b7cbd0fa00e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Luggage
            • Path C:\Users\Admin\AppData\Local\Temp\Luggage
            • Size 59KB
            • SHA256 73b17516142e6f26d6eec9da8e1700268175cfacb62303fb8b3ea073afa035c5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Minister
            • Path C:\Users\Admin\AppData\Local\Temp\Minister
            • Size 98KB
            • SHA256 526b6cbf430fc40eb8d23cd2c4ee1c81e04a2c9e01167370527f19465f67c452
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Mr
            • Path C:\Users\Admin\AppData\Local\Temp\Mr
            • Size 86KB
            • SHA256 5defb1b1225282e2ab46d4257416334b5344e5b0a020b4b7900436c59684de65
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Newport
            • Path C:\Users\Admin\AppData\Local\Temp\Newport
            • Size 81KB
            • SHA256 f261f507e779e7ec2b5580e7ebcc48024253f02b4478bad30020080c68241a9b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Prime
            • Path C:\Users\Admin\AppData\Local\Temp\Prime
            • Size 58KB
            • SHA256 a93408df366ea9bb432d6ee58b995b829193acad7790b4e2c7714aa4cf7676bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Rod
            • Path C:\Users\Admin\AppData\Local\Temp\Rod
            • Size 78KB
            • SHA256 2933796e3bee9cea7fcce9a06adc6260b02a1b6e2822e631d1a8cbe3c9948ede
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Society
            • Path C:\Users\Admin\AppData\Local\Temp\Society
            • Size 32KB
            • SHA256 169770a72d10369cc74decc8f5b9730f533772675021d17b66f62b9180f40aea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Sonic
            • Path C:\Users\Admin\AppData\Local\Temp\Sonic
            • Size 982B
            • SHA256 fc6ba37a8bfe546d8186e92c2f729080b00d4371ef2e8e3a18ec66acc1cf199e
            • MD5 SHA1 SHA512
            Submit Download

            Speak
            • Path C:\Users\Admin\AppData\Local\Temp\Speak
            • Size 55KB
            • SHA256 93ddbcd9109129656049162e3f6a8d9fffdc5a3da262e0a2bf2bc4624014f7b0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Strikes
            • Path C:\Users\Admin\AppData\Local\Temp\Strikes
            • Size 872KB
            • SHA256 f1de84e03842252e12584bb031466ddc3070291fdac398ca0f8d000421d34311
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Tar2486.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tar2486.tmp
            • Size 181KB
            • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Template
            • Path C:\Users\Admin\AppData\Local\Temp\Template
            • Size 56KB
            • SHA256 4734d4d0626e140398a788226a5985e814bbd674f4218b60a89fd2da8f4ceb94
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TmpBC5.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\TmpBC5.tmp
            • Size 2KB
            • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
            • MD5 SHA1 SHA512
            Submit Download

            Tracked
            • Path C:\Users\Admin\AppData\Local\Temp\Tracked
            • Size 73KB
            • SHA256 7f946ec102576eaadf519bed523deec5fe92a69ae849711f446c23b4ae36e886
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            9rJixkDnC2.exe
            • Path C:\Users\Admin\AppData\Roaming\9rJixkDnC2.exe
            • Size 544KB
            • SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            76b53b3ec448f7ccdda2063b15d2bfc3_1b224b15-1c83-42a0-a69a-d14ffe2f8138
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2257386474-3982792636-3902186748-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b224b15-1c83-42a0-a69a-d14ffe2f8138
            • Size 2KB
            • SHA256 e4920adbb0aa57f39b58f9fa9c0aa11d2b05a0ca8567437ede7f3065380f3d34
            • MD5 SHA1 SHA512
            Submit Download

            Google Chrome.lnk
            • Path C:\Users\Public\Desktop\Google Chrome.lnk
            • Size 2KB
            • SHA256 5e0070fadbedfc2e8e8c1ed6d725db788ea259099888149ebcb1d5db1a069f9f
            • MD5 SHA1 SHA512
            Submit Download

            mozglue.dll
            • Path \ProgramData\mozglue.dll
            • Size 593KB
            • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            nss3.dll
            • Path \ProgramData\nss3.dll
            • Size 2.0MB
            • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Community.pif
            • Path \Users\Admin\AppData\Local\Temp\177479\Community.pif
            • Size 872KB
            • SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sEZEbPKjCD.exe
            • Path \Users\Admin\AppData\Roaming\sEZEbPKjCD.exe
            • Size 304KB
            • SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/708-317-0x0000000000400000-0x0000000001069000-memory.dmp
            Download

            memory/708-344-0x0000000000400000-0x0000000001069000-memory.dmp
            Download

            memory/1084-50-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1084-43-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1084-41-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1084-49-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1084-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
            Download

            memory/1084-45-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1084-48-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1084-39-0x0000000000400000-0x0000000000452000-memory.dmp
            Download

            memory/1360-115-0x00000000009A0000-0x00000000009F2000-memory.dmp
            Download

            memory/1504-89-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-110-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-87-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-91-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-83-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-85-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-98-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-97-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-95-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-94-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1504-81-0x0000000000400000-0x000000000050D000-memory.dmp
            Download

            memory/1604-298-0x0000000000F60000-0x0000000000FB2000-memory.dmp
            Download

            memory/1892-78-0x0000000000DF0000-0x0000000000F02000-memory.dmp
            Download

            memory/1904-37-0x0000000000EB0000-0x0000000000F04000-memory.dmp
            Download

            memory/2172-114-0x0000000001230000-0x00000000012BE000-memory.dmp
            Download

            memory/2544-0-0x0000000000A20000-0x0000000000EED000-memory.dmp
            Download

            memory/2544-1-0x00000000776A0000-0x00000000776A2000-memory.dmp
            Download

            memory/2544-2-0x0000000000A21000-0x0000000000A4F000-memory.dmp
            Download

            memory/2544-3-0x0000000000A20000-0x0000000000EED000-memory.dmp
            Download

            memory/2544-4-0x0000000000A20000-0x0000000000EED000-memory.dmp
            Download

            memory/2544-14-0x0000000000A20000-0x0000000000EED000-memory.dmp
            Download

            memory/2544-15-0x00000000073B0000-0x000000000787D000-memory.dmp
            Download

            memory/2736-436-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-437-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-435-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-434-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-433-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-431-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-432-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2736-446-0x0000000003A40000-0x0000000003AAF000-memory.dmp
            Download

            memory/2768-414-0x0000000000080000-0x00000000000D2000-memory.dmp
            Download

            memory/2768-415-0x0000000000080000-0x00000000000D2000-memory.dmp
            Download

            memory/2768-416-0x0000000000080000-0x00000000000D2000-memory.dmp
            Download

            memory/2796-174-0x00000000063C0000-0x0000000006603000-memory.dmp
            Download

            memory/2796-176-0x00000000063C0000-0x0000000006603000-memory.dmp
            Download

            memory/2796-17-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-18-0x0000000000DA1000-0x0000000000DCF000-memory.dmp
            Download

            memory/2796-19-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-430-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-22-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-21-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-245-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-548-0x00000000063C0000-0x0000000006603000-memory.dmp
            Download

            memory/2796-79-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-413-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-547-0x00000000063C0000-0x0000000006603000-memory.dmp
            Download

            memory/2796-314-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-345-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-157-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-156-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/2796-131-0x0000000000DA0000-0x000000000126D000-memory.dmp
            Download

            memory/3052-175-0x0000000000120000-0x0000000000363000-memory.dmp
            Download

            memory/3052-313-0x0000000000120000-0x0000000000363000-memory.dmp
            Download

            memory/3052-211-0x0000000061E00000-0x0000000061EF3000-memory.dmp
            Download