amadey | ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe
Size

1.1MB
MD5

bef9c3ff550ae7c1d2e492b3b085dece
SHA1

cc566ef43678af02d2c45026ea92dcd5db0d644f
SHA256

ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b
SHA512

cae40aba7bcefb88887be27b63d2a0227bccfdc1be23cddaa730ef497e64618842012b802a41ad51825c6e2922323cffe0e6d99bae858ff3f675f970c0ae56d0
SSDEEP

24576:gyWK0KwsvJ+xOwh1jBrnYydjxqjz8SpcvmX5JCw59UlBH3R:ndpPx871zndjqz8SWeV+BH

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 34 IoCs

resource	yara_rule
behavioral1/memory/1624-28-0x00000000024D0000-0x00000000024EA000-memory.dmp	healer
behavioral1/memory/1624-30-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/1624-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-58-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-54-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-52-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-50-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/1624-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/3060-64-0x0000000002470000-0x000000000248A000-memory.dmp	healer
behavioral1/memory/3060-65-0x00000000025B0000-0x00000000025C8000-memory.dmp	healer
behavioral1/memory/3060-73-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-75-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-93-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-91-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-89-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-87-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-83-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-81-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-80-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-77-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-71-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-69-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-85-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-67-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer
behavioral1/memory/3060-66-0x00000000025B0000-0x00000000025C2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	169879222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	281598029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	281598029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	169879222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	169879222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	169879222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	281598029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	281598029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	281598029.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	169879222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	169879222.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/3080-114-0x0000000002460000-0x000000000249C000-memory.dmp	family_redline
behavioral1/memory/3080-115-0x0000000005030000-0x000000000506A000-memory.dmp	family_redline
behavioral1/memory/3080-119-0x0000000005030000-0x0000000005065000-memory.dmp	family_redline
behavioral1/memory/3080-117-0x0000000005030000-0x0000000005065000-memory.dmp	family_redline
behavioral1/memory/3080-116-0x0000000005030000-0x0000000005065000-memory.dmp	family_redline
behavioral1/memory/3080-121-0x0000000005030000-0x0000000005065000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	326179846.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
4832	cq295742.exe
4288	VO258863.exe
4484	lB644166.exe
1624	169879222.exe
3060	281598029.exe
4392	326179846.exe
2000	oneetx.exe
3080	462992892.exe
4836	oneetx.exe
3068	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	281598029.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	169879222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	169879222.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	cq295742.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	VO258863.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	lB644166.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3560	3060	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VO258863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lB644166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cq295742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	169879222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	326179846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	462992892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	281598029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1624	169879222.exe
1624	169879222.exe
3060	281598029.exe
3060	281598029.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	169879222.exe
Token: SeDebugPrivilege	3060	281598029.exe
Token: SeDebugPrivilege	3080	462992892.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4392	326179846.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4832	2512	ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe	84
PID 2512 wrote to memory of 4832	2512	ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe	84
PID 2512 wrote to memory of 4832	2512	ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe	84
PID 4832 wrote to memory of 4288	4832	cq295742.exe	86
PID 4832 wrote to memory of 4288	4832	cq295742.exe	86
PID 4832 wrote to memory of 4288	4832	cq295742.exe	86
PID 4288 wrote to memory of 4484	4288	VO258863.exe	87
PID 4288 wrote to memory of 4484	4288	VO258863.exe	87
PID 4288 wrote to memory of 4484	4288	VO258863.exe	87
PID 4484 wrote to memory of 1624	4484	lB644166.exe	88
PID 4484 wrote to memory of 1624	4484	lB644166.exe	88
PID 4484 wrote to memory of 1624	4484	lB644166.exe	88
PID 4484 wrote to memory of 3060	4484	lB644166.exe	95
PID 4484 wrote to memory of 3060	4484	lB644166.exe	95
PID 4484 wrote to memory of 3060	4484	lB644166.exe	95
PID 4288 wrote to memory of 4392	4288	VO258863.exe	99
PID 4288 wrote to memory of 4392	4288	VO258863.exe	99
PID 4288 wrote to memory of 4392	4288	VO258863.exe	99
PID 4392 wrote to memory of 2000	4392	326179846.exe	100
PID 4392 wrote to memory of 2000	4392	326179846.exe	100
PID 4392 wrote to memory of 2000	4392	326179846.exe	100
PID 4832 wrote to memory of 3080	4832	cq295742.exe	101
PID 4832 wrote to memory of 3080	4832	cq295742.exe	101
PID 4832 wrote to memory of 3080	4832	cq295742.exe	101
PID 2000 wrote to memory of 4376	2000	oneetx.exe	102
PID 2000 wrote to memory of 4376	2000	oneetx.exe	102
PID 2000 wrote to memory of 4376	2000	oneetx.exe	102
PID 2000 wrote to memory of 556	2000	oneetx.exe	104
PID 2000 wrote to memory of 556	2000	oneetx.exe	104
PID 2000 wrote to memory of 556	2000	oneetx.exe	104
PID 556 wrote to memory of 3648	556	cmd.exe	106
PID 556 wrote to memory of 3648	556	cmd.exe	106
PID 556 wrote to memory of 3648	556	cmd.exe	106
PID 556 wrote to memory of 3976	556	cmd.exe	107
PID 556 wrote to memory of 3976	556	cmd.exe	107
PID 556 wrote to memory of 3976	556	cmd.exe	107
PID 556 wrote to memory of 212	556	cmd.exe	108
PID 556 wrote to memory of 212	556	cmd.exe	108
PID 556 wrote to memory of 212	556	cmd.exe	108
PID 556 wrote to memory of 3328	556	cmd.exe	109
PID 556 wrote to memory of 3328	556	cmd.exe	109
PID 556 wrote to memory of 3328	556	cmd.exe	109
PID 556 wrote to memory of 2148	556	cmd.exe	110
PID 556 wrote to memory of 2148	556	cmd.exe	110
PID 556 wrote to memory of 2148	556	cmd.exe	110
PID 556 wrote to memory of 2796	556	cmd.exe	111
PID 556 wrote to memory of 2796	556	cmd.exe	111
PID 556 wrote to memory of 2796	556	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe
"C:\Users\Admin\AppData\Local\Temp\ab7f858306a08653ec95886a6bad02947a7472c493f4e56cee99b32fbbf3682b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cq295742.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cq295742.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VO258863.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VO258863.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lB644166.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lB644166.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\169879222.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\169879222.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\281598029.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\281598029.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1076
        6⤵
        Program crash
        
        PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326179846.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326179846.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2000
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4376
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2148
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\462992892.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\462992892.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3060 -ip 3060
1⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cq295742.exe

Filesize
994KB

MD5
088f6cf506e30c4e829edb01e1f5c271

SHA1
e6cb9f5d6c5cf8f384f2e2d0260d48e62a7f5e9a

SHA256
d510cbaf52d57c0f75ed7c985c8d6658f7456e0565eca95c2367150b1ad68965

SHA512
d6e6ddd21ea5ec0704c35f573d96f72a6c159fb02da973209d619d3af469dec6a8a281c03ce3884bb696a5010819fcbb26f0117e5d2ac356bc8eb0324c16632d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\462992892.exe

Filesize
415KB

MD5
c50b844a387bae098dcb8a5fd65f05f2

SHA1
9e631380ed129979b5a4f49d5c3b77ca3864023a

SHA256
595022bdba0e388d82d666ad6bc80a236496b710bf6e7c61d7b2ed70cd24db02

SHA512
6095f85b463aab6c3add064f614d1569932a922c59680c06008ab8202657263b6a820c18dbf12da9428a9eb3f5afd21162cae4c6e85cb8134137e4904d6a3e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VO258863.exe

Filesize
610KB

MD5
3b7e8eab730bb1668bce9328c76371ff

SHA1
ae94e2becbcdb234b9de33414b075a42ad521f09

SHA256
a690958a21d72573e16fdb480230ac1fe76399f936cd93ff448e6f0c573fdf9e

SHA512
ce60a3f807ef46d7263fc67dc68e44a0bcaa529a81b41cc7bec649c6626cfe0ac967072e91fc014d52a59d9e7051021aac88e300eece18cb183d54f9add613b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\326179846.exe

Filesize
204KB

MD5
97193b2c3343334e0db48bb1fadf822d

SHA1
7bca3c872c39434e98dd67e086f6b1daedcba14e

SHA256
8712c7dd83f526dce4498822db04fd09515044956c2c3810d416ab91eb4cd4a4

SHA512
3ce6b2c8820b2c2a6039a49fae675c2a9ca4684dfe339a2fc1aa7ab7d55d49303afcc88d60ef33a3ff56e0b1a3d2875d8f41987299f42d8e25ac94c34a31cc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lB644166.exe

Filesize
438KB

MD5
a69cab46db2c824b9deda2ca8c10f406

SHA1
53e96ba05ae3e06ce48b50b43e82158e39791a1b

SHA256
336a974dfee704c6a113c64dfdec6753c239f922ab0b20785828a08d6c6a9e94

SHA512
b66f63526442bb28389fd402c26116fec06e9b583c9b727f4b38cc3c5d765e621669d26a4e086348479d60f4733eeed7978174bbf3dc3601c649330d4419764e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\169879222.exe

Filesize
176KB

MD5
1f0cedd8c4489414b2f3baa31b3e7abb

SHA1
383794249e96c296f663ff35ae789f8ad20b99a2

SHA256
d3eac9dd6063dd1ae3a9e84eb9d52e8869252e15fe7ac0a2c10a8f1b3ddfdcc5

SHA512
6642ee42dd65f966aa36ee5f10c3ddac7059d37bb75c94d7bff68a7976b9bff0cff7920ce969ca81d27b4167b0480cbb67320e99c89d21e6ca43d431a2c1c2df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\281598029.exe

Filesize
333KB

MD5
b06bb09f979a9e5be74040f617c45160

SHA1
b28380d838c5f910f9ee2228b2d6d1e1fe0358a0

SHA256
77e1f5dff641b43b3b0a7413f3e0fc4b536772e52882eed84aafdb1ba1abed92

SHA512
c3c431b8f69cee94ce88fe27dc615384bc2ea264aeb37c9786262a87f56a58944269183f34038da6cf674375e48a5f93e3acc74b14404230d6d2034a134d220c

Download Submit
memory/1624-28-0x00000000024D0000-0x00000000024EA000-memory.dmp

Filesize
104KB

Download
memory/1624-29-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/1624-30-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/1624-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-58-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-54-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-52-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-50-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/1624-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/3060-64-0x0000000002470000-0x000000000248A000-memory.dmp

Filesize
104KB

Download
memory/3060-65-0x00000000025B0000-0x00000000025C8000-memory.dmp

Filesize
96KB

Download
memory/3060-73-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-75-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-93-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-91-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-89-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-87-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-83-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-81-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-80-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-77-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-71-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-69-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-85-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-67-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-66-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/3060-94-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3060-96-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3080-114-0x0000000002460000-0x000000000249C000-memory.dmp

Filesize
240KB

Download
memory/3080-115-0x0000000005030000-0x000000000506A000-memory.dmp

Filesize
232KB

Download
memory/3080-119-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3080-117-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3080-116-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3080-121-0x0000000005030000-0x0000000005065000-memory.dmp

Filesize
212KB

Download
memory/3080-908-0x0000000007B60000-0x0000000008178000-memory.dmp

Filesize
6.1MB

Download
memory/3080-909-0x00000000075E0000-0x00000000075F2000-memory.dmp

Filesize
72KB

Download
memory/3080-910-0x0000000007600000-0x000000000770A000-memory.dmp

Filesize
1.0MB

Download
memory/3080-911-0x0000000007720000-0x000000000775C000-memory.dmp

Filesize
240KB

Download
memory/3080-912-0x0000000002350000-0x000000000239C000-memory.dmp

Filesize
304KB

Download