Malware Analysis Report

2025-01-23 07:37

Sample ID 241104-q8k3fazmgs
Target 615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa
SHA256 615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa
Tags
amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa

Threat Level: Known bad

The file 615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa was found to be: Known bad.

Malicious Activity Summary

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Amadey

Amadey family

Modifies Windows Defender Real-time Protection settings

RedLine

Redline family

RedLine payload

Detects Healer an antivirus disabler dropper

Healer

Healer family

Windows security modification

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-04 13:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-04 13:55

Reported

2024-11-04 13:58

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3640 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe
PID 3640 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe
PID 3640 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe
PID 2816 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe
PID 2816 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe
PID 2816 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe
PID 5008 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe
PID 5008 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe
PID 5008 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe
PID 3804 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe
PID 3804 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe
PID 3804 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe
PID 3804 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe
PID 3804 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe
PID 3804 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe
PID 5008 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe
PID 5008 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe
PID 5008 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe
PID 3912 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
PID 3912 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
PID 3912 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
PID 2816 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe
PID 2816 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe
PID 2816 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe
PID 3608 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 3608 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 3608 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 3608 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\cmd.exe
PID 3608 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 3648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 3648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4484 wrote to memory of 3648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe

"C:\Users\Admin\AppData\Local\Temp\615870ebb30e79d92aec7987a4f07d92b5278fa63b9edd426cd5793b59fc3aaa.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5000 -ip 5000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1040

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb7ae701b3" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb7ae701b3" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rl569171.exe

MD5 3a0d980351a33212baf9bedc01da9e25
SHA1 6469c4f136c41b57c6f254f9e6cac285e23d449c
SHA256 843b2a85e9d96389688eb78fed4eabaa98a5ab61c2494bf9c334c11125a8e3d6
SHA512 0d66da2337d163c39c5751117556349a93432aa444c7ee32253e2aaa3930efac8fd423c18c7af5604bf6f02d801ef71f50a1061eb9d9e89e9dbb0a14fdf6198e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ca888522.exe

MD5 e62f1bf96bee52f82b242c3f96ced612
SHA1 29efd35ee84f8d4772b0c77e25788e58c0ef9c41
SHA256 632e4d9bf3a1de85eb3fc711c7de9b4f3ce188dd4c1ec58e7fc31885e0e85faf
SHA512 45de0b38cdf5baa7c015c8a4347382f517d7778736984379e02fc8da24971f4597acaaaccac4b456cffd0e4dd9ba549e704097b2ea8d9f6a3114c3655bb03498

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SS778926.exe

MD5 2471fb44ec22a9e615193b0b1600ce52
SHA1 b4ae71820f93b4f7587e1d86be8c53ee59470f30
SHA256 431d499b392ae12560aa73214060309f43611dad2c393ac8f1d7cce7c15fe47c
SHA512 67a5b7f83e9ef61c0ff9b6a6b709adc55cb1b93730181bdd1b111a25ada771245e43857ac88cfbe6b8e45779a749e1b574ef0ba0767d012ce427fdbce127a9fd

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\130143453.exe

MD5 3d10b67208452d7a91d7bd7066067676
SHA1 e6c3ab7b6da65c8cc7dd95351f118caf3a50248d
SHA256 5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
SHA512 b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

memory/3976-28-0x0000000002370000-0x000000000238A000-memory.dmp

memory/3976-29-0x0000000004A50000-0x0000000004FF4000-memory.dmp

memory/3976-30-0x0000000004990000-0x00000000049A8000-memory.dmp

memory/3976-31-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-32-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-56-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-55-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-52-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-50-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-49-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-46-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-44-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-42-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-40-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-38-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-36-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-35-0x0000000004990000-0x00000000049A3000-memory.dmp

memory/3976-58-0x0000000004990000-0x00000000049A3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\218293813.exe

MD5 77d316da03eede3b58e200050242955e
SHA1 83c30aadd84e6854119431706ac1898a7713be0f
SHA256 1c7fc94ea33ad21f7c2c3abb0d74e36e2c630b115e8f94691815e4931434f184
SHA512 cbfd19818b7f071c66090edcee08df54695e0f43a502ecd2a6200123748670ac065822a5674ca1170ca0b93059ac0a8a6067f3b05b2ad8344f802b6577a1658d

memory/5000-93-0x0000000000400000-0x0000000002B9D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378356139.exe

MD5 1304f384653e08ae497008ff13498608
SHA1 d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA256 2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA512 4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\477439151.exe

MD5 c6630bae0e67a7466d117ba2f50fe027
SHA1 7ae1b03e8514f71f28cc45f1d6565a70d701f42c
SHA256 14cbb37265f618b78f8eeaee1443cf41f7bfbc166ee68ad8620f334be60a833f
SHA512 6743be557f3cd3b3aa213494cf459a3afb1cc207b554c5f5cd53bbecd08479ce5d3cb39863a012c8e6cc36d2303d3462ec39182efdc021b1410e6f92dd1584b8

memory/3656-112-0x0000000004AC0000-0x0000000004AFC000-memory.dmp

memory/3656-113-0x0000000007850000-0x000000000788A000-memory.dmp

memory/3656-119-0x0000000007850000-0x0000000007885000-memory.dmp

memory/3656-117-0x0000000007850000-0x0000000007885000-memory.dmp

memory/3656-115-0x0000000007850000-0x0000000007885000-memory.dmp

memory/3656-114-0x0000000007850000-0x0000000007885000-memory.dmp

memory/3656-906-0x000000000A3A0000-0x000000000A9B8000-memory.dmp

memory/3656-907-0x0000000009E20000-0x0000000009E32000-memory.dmp

memory/3656-908-0x0000000009E40000-0x0000000009F4A000-memory.dmp

memory/3656-909-0x0000000009F60000-0x0000000009F9C000-memory.dmp

memory/3656-910-0x00000000049C0000-0x0000000004A0C000-memory.dmp