amadey | b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe
Size

1.1MB
MD5

6a371a62893c4883c8dfb598eb33fc2d
SHA1

df187be18528e363e66328c3ee3e95a91e9e1810
SHA256

b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d
SHA512

d93c706bfd4486a0f266570ad93a32059488a346ee5d8b2d80fccda19d209c8debb490ea7cdbeaff436da68a6d9114a1ee0621b7710c3d3c4f90a86efc24aeab
SSDEEP

24576:ryl6dA8jj3XTtC4g7g2qX6SC049on/pPzo:eMdA8jjnhCJ7g2qX6S5Pz

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3644-28-0x00000000048D0000-0x00000000048EA000-memory.dmp	healer
behavioral1/memory/3644-30-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/3644-54-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-58-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-56-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-46-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-44-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-34-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-32-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-31-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-52-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-50-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-48-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-42-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-40-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-38-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3644-36-0x0000000004980000-0x0000000004993000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	210760503.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	210760503.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	210760503.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	210760503.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	210760503.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/4716-112-0x0000000004AE0000-0x0000000004B1C000-memory.dmp	family_redline
behavioral1/memory/4716-113-0x0000000007180000-0x00000000071BA000-memory.dmp	family_redline
behavioral1/memory/4716-117-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline
behavioral1/memory/4716-119-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline
behavioral1/memory/4716-115-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline
behavioral1/memory/4716-114-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	359077904.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
1972	DS574987.exe
1040	OZ107911.exe
4984	GA344183.exe
3644	189292868.exe
4208	210760503.exe
4976	359077904.exe
452	oneetx.exe
4716	485336308.exe
4984	oneetx.exe
2140	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	189292868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	210760503.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	189292868.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	DS574987.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	OZ107911.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	GA344183.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4928	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
772	4208	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	485336308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GA344183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	189292868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	359077904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	210760503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OZ107911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DS574987.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3644	189292868.exe
3644	189292868.exe
4208	210760503.exe
4208	210760503.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	189292868.exe
Token: SeDebugPrivilege	4208	210760503.exe
Token: SeDebugPrivilege	4716	485336308.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4976	359077904.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1972	5100	b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe	84
PID 5100 wrote to memory of 1972	5100	b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe	84
PID 5100 wrote to memory of 1972	5100	b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe	84
PID 1972 wrote to memory of 1040	1972	DS574987.exe	85
PID 1972 wrote to memory of 1040	1972	DS574987.exe	85
PID 1972 wrote to memory of 1040	1972	DS574987.exe	85
PID 1040 wrote to memory of 4984	1040	OZ107911.exe	86
PID 1040 wrote to memory of 4984	1040	OZ107911.exe	86
PID 1040 wrote to memory of 4984	1040	OZ107911.exe	86
PID 4984 wrote to memory of 3644	4984	GA344183.exe	87
PID 4984 wrote to memory of 3644	4984	GA344183.exe	87
PID 4984 wrote to memory of 3644	4984	GA344183.exe	87
PID 4984 wrote to memory of 4208	4984	GA344183.exe	97
PID 4984 wrote to memory of 4208	4984	GA344183.exe	97
PID 4984 wrote to memory of 4208	4984	GA344183.exe	97
PID 1040 wrote to memory of 4976	1040	OZ107911.exe	102
PID 1040 wrote to memory of 4976	1040	OZ107911.exe	102
PID 1040 wrote to memory of 4976	1040	OZ107911.exe	102
PID 4976 wrote to memory of 452	4976	359077904.exe	103
PID 4976 wrote to memory of 452	4976	359077904.exe	103
PID 4976 wrote to memory of 452	4976	359077904.exe	103
PID 1972 wrote to memory of 4716	1972	DS574987.exe	104
PID 1972 wrote to memory of 4716	1972	DS574987.exe	104
PID 1972 wrote to memory of 4716	1972	DS574987.exe	104
PID 452 wrote to memory of 2812	452	oneetx.exe	105
PID 452 wrote to memory of 2812	452	oneetx.exe	105
PID 452 wrote to memory of 2812	452	oneetx.exe	105
PID 452 wrote to memory of 2560	452	oneetx.exe	107
PID 452 wrote to memory of 2560	452	oneetx.exe	107
PID 452 wrote to memory of 2560	452	oneetx.exe	107
PID 2560 wrote to memory of 2644	2560	cmd.exe	109
PID 2560 wrote to memory of 2644	2560	cmd.exe	109
PID 2560 wrote to memory of 2644	2560	cmd.exe	109
PID 2560 wrote to memory of 3852	2560	cmd.exe	110
PID 2560 wrote to memory of 3852	2560	cmd.exe	110
PID 2560 wrote to memory of 3852	2560	cmd.exe	110
PID 2560 wrote to memory of 4496	2560	cmd.exe	111
PID 2560 wrote to memory of 4496	2560	cmd.exe	111
PID 2560 wrote to memory of 4496	2560	cmd.exe	111
PID 2560 wrote to memory of 4148	2560	cmd.exe	112
PID 2560 wrote to memory of 4148	2560	cmd.exe	112
PID 2560 wrote to memory of 4148	2560	cmd.exe	112
PID 2560 wrote to memory of 3916	2560	cmd.exe	113
PID 2560 wrote to memory of 3916	2560	cmd.exe	113
PID 2560 wrote to memory of 3916	2560	cmd.exe	113
PID 2560 wrote to memory of 3712	2560	cmd.exe	114
PID 2560 wrote to memory of 3712	2560	cmd.exe	114
PID 2560 wrote to memory of 3712	2560	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe
"C:\Users\Admin\AppData\Local\Temp\b2fdc078bc230d8e259c39a4b2f89f120f664c414a6413e3b933ee1408e7294d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DS574987.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DS574987.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OZ107911.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OZ107911.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GA344183.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GA344183.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\189292868.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\189292868.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\210760503.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\210760503.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 1084
        6⤵
        Program crash
        
        PID:772
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\359077904.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\359077904.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:452
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2812
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\485336308.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\485336308.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4208 -ip 4208
1⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DS574987.exe

Filesize
925KB

MD5
09c179cea059eab4d91b80c5207a257a

SHA1
8ce86f987d3a68dfcd57a1d430ec01a8c31a3e20

SHA256
8c3058938c26131ee587f0724a414ffbb2498d5ab11210d3727160829058e1c6

SHA512
3e43f040155df8c5732694788e0bd022ebf548becb91a5e0dc261c29af93c389283d3b14ef2d09795561964eca28d49c788c80436a72664195e3d101644e605f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\485336308.exe

Filesize
328KB

MD5
8a0eb7e8a70c2389f556496c617f6f52

SHA1
b654e9deb2ba40860b9b5f30cd26b8fa90b9cee6

SHA256
e3ad1522b0d886ee9ebc16ada6aa54644e87994c287180d8b20c82184a5dc47a

SHA512
8503b9c6d7c78c6a2bb027801cffe77b9047b496f5dab6908395b061e1c466985d0a55427cb3bb2ed543b98f1a8888abf343c674316200265c76684e041ae1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OZ107911.exe

Filesize
582KB

MD5
043fff5fefe171c1b3e2a8a0441a4b7f

SHA1
991586986f7770c2539466446ac55017cf684e7d

SHA256
2696f93b5e7e46102c9f7ddfdfbaaf8e2b91b2189fcd703411725b52058901a3

SHA512
dd2e1ea533cd4ec07f4406684c3a0d383cd1ac0f8faf75ad6f81fabcfddc282a6735404028551c511dd851ebed99de3d7f66485e9754185999ab9ce23d6c47b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\359077904.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GA344183.exe

Filesize
411KB

MD5
a04ba8cd21358e0cb5da934090304a75

SHA1
962365d46f05f78bd361873869c748371d97a402

SHA256
54060daefaa01e15e372c53c3a8ce2be8185ed2d6ddc61843c1b0a3b432a0d2b

SHA512
51b1e779198d58aa3f854db0e70a0a9c0670ef4d31d39c6afd7a29e2cbb9e33a283603714d63e4d7268b944ef7268b09f9774c5ecebf40b55b30a4570594566d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\189292868.exe

Filesize
175KB

MD5
3d10b67208452d7a91d7bd7066067676

SHA1
e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

SHA256
5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

SHA512
b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\210760503.exe

Filesize
263KB

MD5
5116f7b65c8a365e966139b4e95c5d90

SHA1
2ebb80c964bf3efba22a4026a106aa0a967dc941

SHA256
66313ff2245b2fc17ccbd80cb8d4c72081ac709dd517a41b90192cbb90abbeb7

SHA512
1f4ad3a20f6dc6ed78b5c1b057a0689cd41cf396a9dfec4459872297db24633b7df6102e8c239ccaf3fea30028c619f8d2073f1d8ec1d1f0d69440f95b71144a

Download Submit
memory/3644-42-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-30-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/3644-56-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-46-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-44-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-34-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-32-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-31-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-52-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-50-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-48-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-54-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-40-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-38-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-36-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-58-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3644-28-0x00000000048D0000-0x00000000048EA000-memory.dmp

Filesize
104KB

Download
memory/3644-29-0x0000000004A80000-0x0000000005024000-memory.dmp

Filesize
5.6MB

Download
memory/4208-94-0x0000000000400000-0x0000000002B99000-memory.dmp

Filesize
39.6MB

Download
memory/4208-92-0x0000000000400000-0x0000000002B99000-memory.dmp

Filesize
39.6MB

Download
memory/4716-115-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/4716-113-0x0000000007180000-0x00000000071BA000-memory.dmp

Filesize
232KB

Download
memory/4716-117-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/4716-119-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/4716-112-0x0000000004AE0000-0x0000000004B1C000-memory.dmp

Filesize
240KB

Download
memory/4716-114-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/4716-906-0x0000000009CB0000-0x000000000A2C8000-memory.dmp

Filesize
6.1MB

Download
memory/4716-907-0x000000000A330000-0x000000000A342000-memory.dmp

Filesize
72KB

Download
memory/4716-908-0x000000000A350000-0x000000000A45A000-memory.dmp

Filesize
1.0MB

Download
memory/4716-909-0x000000000A470000-0x000000000A4AC000-memory.dmp

Filesize
240KB

Download
memory/4716-910-0x0000000006CB0000-0x0000000006CFC000-memory.dmp

Filesize
304KB

Download