amadey | 02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe
Size

1.1MB
MD5

908e7c81bf3f9bc9e80347c82f147f43
SHA1

7a21a8adf597c55e58cd5fc0ae4c943789805de0
SHA256

02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92
SHA512

4f9afc68b98f1b56b3f52dfa88b535f510688a4b473a6b01660b3af38583eae6f4f1fc6433c0a7d0b9d2a5ce320800c6e0247197fffc0eb2f19b8bc92e3e565d
SSDEEP

24576:CyTTW1PLOqroZ05ehzbq5/bBu7bNLA9Jh+9bbuFOktazpcEVK:pPogAWzOFg7bBCh+9/u4kk

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 34 IoCs

resource	yara_rule
behavioral1/memory/1728-28-0x00000000048B0000-0x00000000048CA000-memory.dmp	healer
behavioral1/memory/1728-30-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/1728-58-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-56-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-54-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-52-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-50-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-48-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-46-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-44-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-42-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-40-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-38-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-36-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-34-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-32-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/1728-31-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/696-64-0x0000000002430000-0x000000000244A000-memory.dmp	healer
behavioral1/memory/696-65-0x0000000002490000-0x00000000024A8000-memory.dmp	healer
behavioral1/memory/696-66-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-75-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-93-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-91-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-89-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-87-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-85-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-83-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-81-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-79-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-77-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-73-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-71-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-69-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/696-67-0x0000000002490000-0x00000000024A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	227259317.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	227259317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	227259317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	227259317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	227259317.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/1876-114-0x0000000002490000-0x00000000024CC000-memory.dmp	family_redline
behavioral1/memory/1876-115-0x0000000002630000-0x000000000266A000-memory.dmp	family_redline
behavioral1/memory/1876-119-0x0000000002630000-0x0000000002665000-memory.dmp	family_redline
behavioral1/memory/1876-121-0x0000000002630000-0x0000000002665000-memory.dmp	family_redline
behavioral1/memory/1876-117-0x0000000002630000-0x0000000002665000-memory.dmp	family_redline
behavioral1/memory/1876-116-0x0000000002630000-0x0000000002665000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	339005948.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
2416	qw537855.exe
2276	Ph980043.exe
4276	Wh594337.exe
1728	180371227.exe
696	227259317.exe
2484	339005948.exe
1208	oneetx.exe
1876	460356665.exe
548	oneetx.exe
5304	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	180371227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	227259317.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	qw537855.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ph980043.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Wh594337.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	696	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	180371227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	227259317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ph980043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wh594337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	339005948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qw537855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	460356665.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1728	180371227.exe
1728	180371227.exe
696	227259317.exe
696	227259317.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	180371227.exe
Token: SeDebugPrivilege	696	227259317.exe
Token: SeDebugPrivilege	1876	460356665.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	339005948.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2416	3332	02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe	84
PID 3332 wrote to memory of 2416	3332	02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe	84
PID 3332 wrote to memory of 2416	3332	02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe	84
PID 2416 wrote to memory of 2276	2416	qw537855.exe	85
PID 2416 wrote to memory of 2276	2416	qw537855.exe	85
PID 2416 wrote to memory of 2276	2416	qw537855.exe	85
PID 2276 wrote to memory of 4276	2276	Ph980043.exe	86
PID 2276 wrote to memory of 4276	2276	Ph980043.exe	86
PID 2276 wrote to memory of 4276	2276	Ph980043.exe	86
PID 4276 wrote to memory of 1728	4276	Wh594337.exe	87
PID 4276 wrote to memory of 1728	4276	Wh594337.exe	87
PID 4276 wrote to memory of 1728	4276	Wh594337.exe	87
PID 4276 wrote to memory of 696	4276	Wh594337.exe	95
PID 4276 wrote to memory of 696	4276	Wh594337.exe	95
PID 4276 wrote to memory of 696	4276	Wh594337.exe	95
PID 2276 wrote to memory of 2484	2276	Ph980043.exe	100
PID 2276 wrote to memory of 2484	2276	Ph980043.exe	100
PID 2276 wrote to memory of 2484	2276	Ph980043.exe	100
PID 2484 wrote to memory of 1208	2484	339005948.exe	101
PID 2484 wrote to memory of 1208	2484	339005948.exe	101
PID 2484 wrote to memory of 1208	2484	339005948.exe	101
PID 2416 wrote to memory of 1876	2416	qw537855.exe	102
PID 2416 wrote to memory of 1876	2416	qw537855.exe	102
PID 2416 wrote to memory of 1876	2416	qw537855.exe	102
PID 1208 wrote to memory of 4428	1208	oneetx.exe	103
PID 1208 wrote to memory of 4428	1208	oneetx.exe	103
PID 1208 wrote to memory of 4428	1208	oneetx.exe	103
PID 1208 wrote to memory of 4680	1208	oneetx.exe	105
PID 1208 wrote to memory of 4680	1208	oneetx.exe	105
PID 1208 wrote to memory of 4680	1208	oneetx.exe	105
PID 4680 wrote to memory of 2084	4680	cmd.exe	107
PID 4680 wrote to memory of 2084	4680	cmd.exe	107
PID 4680 wrote to memory of 2084	4680	cmd.exe	107
PID 4680 wrote to memory of 2904	4680	cmd.exe	108
PID 4680 wrote to memory of 2904	4680	cmd.exe	108
PID 4680 wrote to memory of 2904	4680	cmd.exe	108
PID 4680 wrote to memory of 3940	4680	cmd.exe	109
PID 4680 wrote to memory of 3940	4680	cmd.exe	109
PID 4680 wrote to memory of 3940	4680	cmd.exe	109
PID 4680 wrote to memory of 5032	4680	cmd.exe	110
PID 4680 wrote to memory of 5032	4680	cmd.exe	110
PID 4680 wrote to memory of 5032	4680	cmd.exe	110
PID 4680 wrote to memory of 1992	4680	cmd.exe	111
PID 4680 wrote to memory of 1992	4680	cmd.exe	111
PID 4680 wrote to memory of 1992	4680	cmd.exe	111
PID 4680 wrote to memory of 2428	4680	cmd.exe	112
PID 4680 wrote to memory of 2428	4680	cmd.exe	112
PID 4680 wrote to memory of 2428	4680	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe
"C:\Users\Admin\AppData\Local\Temp\02dabcc00e262653a54741593c44926fde8de83d7d43913e09e738dd4a6b2d92.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qw537855.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qw537855.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ph980043.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ph980043.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wh594337.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wh594337.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\180371227.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\180371227.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\227259317.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\227259317.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 1076
        6⤵
        Program crash
        
        PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\339005948.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\339005948.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1208
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4428
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\460356665.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\460356665.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 696 -ip 696
1⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:548

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qw537855.exe

Filesize
993KB

MD5
97fe6aea1aca7d07c3b6662da3dc5410

SHA1
922e4e900a93288553029719eb838117b9dd502f

SHA256
7c2c7561d961125f4634014606933f7034e4604ea4596104d19db0b3e5ad1dd9

SHA512
a9e92f55972d90f23fd84fe2f43763b78d5d45ffe3caab17f0b18d761b54e6b2abe864c244357f878a9dae97b6e5f9272cc1ee6070e2551d78c69971071a9aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\460356665.exe

Filesize
415KB

MD5
b9d586e3e4e9d9cd8eb0a7adaf0d36f9

SHA1
f460a950dff6f7545cbfd38b12fe57e2da977a97

SHA256
0d910ca4eb426508d472d86a0d29efb5cfd28117def2a6a6d0cec3a570c4578d

SHA512
5bbc8b1d8645f9bb2a00deeb8910d6cb455a2d925b8311b2f312120df7f592b5bcffea6a76c67ac63cef63c97fa204072f898813756da1f9d8ce0cb3c98fca5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ph980043.exe

Filesize
609KB

MD5
0104e2d89d0c504985428c53ff71924a

SHA1
a0bfd800a2534733803d1fc0aa86c941de4e0593

SHA256
22e963fad4c21ec31ca0405ead2e973ad6161d7994e9b77c7c0f3b895b7092bf

SHA512
cd5102574f9911650d9b47ffd57a4119d6f11726f9d5b5f42a679527233129edd117437f57a48a3140d16d9d1849a744e9cccb72c5f61d3cbda4baa5c63536d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\339005948.exe

Filesize
204KB

MD5
cf4b50ef88bf94aee6764c7743ec1879

SHA1
8491060dece469da12dc57e8e38a4f3a72e33caa

SHA256
0a01b79e5d9cec1a8fd28449911f684f93cde07356ccfbb976c2465a3c4c3442

SHA512
ee3bd8726a0aa932ab24db759c0608ecdefde34288b662d07939bc7926469b77152e273b14bdb077817f980fafa371c61dc85a34defd7ffbd4326a8cccfd4dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wh594337.exe

Filesize
437KB

MD5
e079e646387b66f9e787853df45de3b8

SHA1
6b01092b45c0896d456261f0bce732c835559f52

SHA256
83c56c16106ec896b3282350ad6bc75f425d03a26bbfd79e64dd6bb068844dc9

SHA512
14225f71929a1f11f9146ae3995e87c5e0f01ed0c906ac0586ae4c9ac22373dcabb435b6304d125434e4038ae808d4ecd48d433b91b0d21feb4ac0887e8c5520

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\180371227.exe

Filesize
175KB

MD5
6ff5343969f992d09e8d1939532680de

SHA1
eef1ab6f734d185aec7d960cd26887dc97021184

SHA256
10803ae0da01118be04287a8c94654b78bd743b9fa5884c8e8c8f964e5212d4d

SHA512
b203818fbd45afd6093d6320f6394d53f113264cc417b956e16e1fa8ab8912c95b1e3022dacf378a9a125525acffb684ba83b0fc75819f4656a784bd1f970039

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\227259317.exe

Filesize
332KB

MD5
ddf66d84e65ea513fe12671fffa06ae5

SHA1
a7e0adf78c03874160e7014d775aaed8a31d145a

SHA256
6146181d317f01e1af476e0c048d3d81992cce0ce9e649e8a13433d2c6fc3817

SHA512
dfad1086604d58d512ed8cdda68dfa844e3a94a00f0c7eea3b693a3ac714c221cf4afe7fe9e37a4522ee08b6a85652c41cea31ce39584bc4ad0c656398ebc81b

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
11KB

MD5
b7759166a0f1807b202b45f510c2172e

SHA1
ef160ebdf82a6cadd27197fb589a3786e58e3fa5

SHA256
825eb1a627f34c3d1fad85cb5904b5ac0fded65f677c5a85fa992e42c450fd99

SHA512
5085882d85f2d3ab9fa2c2b3bfbde24072ae732b02529946700df1ee92fbafb0e7d305bf21f6034b44012d310495bc7ebd4826b226685a1cc3790b429d0169ec

Download Submit
memory/696-91-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-93-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-96-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/696-94-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/696-67-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-69-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-71-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-73-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-77-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-79-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-81-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-83-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-85-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-87-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-89-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-64-0x0000000002430000-0x000000000244A000-memory.dmp

Filesize
104KB

Download
memory/696-65-0x0000000002490000-0x00000000024A8000-memory.dmp

Filesize
96KB

Download
memory/696-66-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/696-75-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/1728-32-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-30-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/1728-56-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-31-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-54-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-34-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-36-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-38-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-40-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-42-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-44-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-46-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-48-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-50-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-52-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-58-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/1728-29-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/1728-28-0x00000000048B0000-0x00000000048CA000-memory.dmp

Filesize
104KB

Download
memory/1876-115-0x0000000002630000-0x000000000266A000-memory.dmp

Filesize
232KB

Download
memory/1876-119-0x0000000002630000-0x0000000002665000-memory.dmp

Filesize
212KB

Download
memory/1876-121-0x0000000002630000-0x0000000002665000-memory.dmp

Filesize
212KB

Download
memory/1876-117-0x0000000002630000-0x0000000002665000-memory.dmp

Filesize
212KB

Download
memory/1876-116-0x0000000002630000-0x0000000002665000-memory.dmp

Filesize
212KB

Download
memory/1876-908-0x0000000007C70000-0x0000000008288000-memory.dmp

Filesize
6.1MB

Download
memory/1876-909-0x0000000004BA0000-0x0000000004BB2000-memory.dmp

Filesize
72KB

Download
memory/1876-910-0x0000000007650000-0x000000000775A000-memory.dmp

Filesize
1.0MB

Download
memory/1876-911-0x0000000004BD0000-0x0000000004C0C000-memory.dmp

Filesize
240KB

Download
memory/1876-912-0x00000000023B0000-0x00000000023FC000-memory.dmp

Filesize
304KB

Download
memory/1876-114-0x0000000002490000-0x00000000024CC000-memory.dmp

Filesize
240KB

Download